fb97877ab6852ebf9471cc277159345d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
fb97877ab6852ebf9471cc277159345d_JaffaCakes118
Size 897KB
Sample240420-bk6a5scd97
SHA256 24574706d373ea0de2e011ef33739ede79c43f9b4ebe94ad5db4169d8570cfe7
MD5 fb97877ab6852ebf9471cc277159345d
SHA1 e2f250c3abf99b27a315f88c9ee6d5a074b96195
SHA512 9376b8c2f49a67f8439610fd05825e95f250d4d4153cd2324cb4e7d8821c32202b18590183239a1957ecd4c3b845f20b40099a9cc2097722c5fc2d4294a75eeb
SSDEEP 24576:k9VD3s5RhL3ZwQykZx5fVHSxWbqXO2DrV6nypPX8Szk:+VD3gn360ZrfzbUJfg03zk
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/ImageSee/ImageSee.exe	aspack_v212_v242

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ImageSee/ImageSee.exe

File Explorer

fb97877ab6852ebf9471cc277159345d_JaffaCakes118

.rar 897KB
ImageSee/ImageSee.exe

.exe 1000KB
ImageSee/新云软件.url

.url 133B

fb97877ab6852ebf9471cc277159345d_JaffaCakes118

SHA256 24574706d373ea0de2e011ef33739ede79c43f9b4ebe94ad5db4169d8570cfe7
MD5 fb97877ab6852ebf9471cc277159345d
SHA1 e2f250c3abf99b27a315f88c9ee6d5a074b96195
SHA512 9376b8c2f49a67f8439610fd05825e95f250d4d4153cd2324cb4e7d8821c32202b18590183239a1957ecd4c3b845f20b40099a9cc2097722c5fc2d4294a75eeb
SSDEEP 24576:k9VD3s5RhL3ZwQykZx5fVHSxWbqXO2DrV6nypPX8Szk:+VD3gn360ZrfzbUJfg03zk
MD5 SHA1 SHA512 SSDEEP

ImageSee/ImageSee.exe

SHA256 048fc88d4a59f74a636a14e5676fb75f92496e29785bb195e16fbbcf49718831
MD5 1a0d5ec13998674dd3fb0bd4a04e39e9
SHA1 42c1e0d77989f8da2d47e5fb8ff640bed2584f69
SHA512 910611f50acc5a40ef098e2df6926b0c557e8c3c90efc94c22f59cdcb1c32a7ebc0d6862ad50362550094709ad5a502662c4af9ae3391bb3efff23105e6de741
SSDEEP 12288:jHk3TV3CJu/0JCHIUXcevHzTRu/hGO2aYZVFQrU7g2H2h+elLW5tcJGm:Lk3TV3CxFSvHHRqhG/D9B82k+eFW7c
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ASPack v2.12-2.42

Detects executables packed with ASPack v2.12-2.42

aspackv2
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2732033

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

709KB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

DATA

Size

43KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

77KB

Virtual Size

524KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.aspack

Size

164KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

fb97877ab6852ebf9471cc277159345d_JaffaCakes118

ImageSee/ImageSee.exe

generic

ImageSee/新云软件.url