0a86c95202afe4f77356150625dad4d0_JaffaCakes118
- SHA256 9290d2121fa92bc3cd299b695d695c625cb30e6d553a1790d16820b0675a28f5
Behavioral task
behavioral1
Sample
IOS)Plugin_zh_CN0.23.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
IOS)Plugin_zh_CN0.23.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 0a86c95202afe4f77356150625dad4d0_JaffaCakes118
- Size 417KB
- Sample240430-12mb2aha3t
- SHA256 9290d2121fa92bc3cd299b695d695c625cb30e6d553a1790d16820b0675a28f5
- MD5 0a86c95202afe4f77356150625dad4d0
- SHA1 e56634a5a04389421feb6992f2b94629e635033a
- SHA512 6bb9e0f23ac8a9286afcd6f3e5b2084703bcd20fcea7ea67a1adb082d1ed6e38d87a9d9f2ded694ad937bb5f16e3296dfb1ea989b896d9d4945ec65da8ff7100
- SSDEEP 12288:63dOGjBwOJhOumO7wRzgioRncBn5CN7O++VxwEbrCNhH2Zj:03jBw4wu5Wzgi+xNS+A1rAR2Zj
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/IOS)Plugin_zh_CN0.23.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/IOS)Plugin_zh_CN0.23.exe unpack002/out.upx
File Explorer
-
0a86c95202afe4f77356150625dad4d0_JaffaCakes118.zip 417KB
-
IOS)Plugin_zh_CN0.23.exe.exe 445KB
-
out.upx.exe 1.0MB
IOS)Plugin_zh_CN0.23.exe
- SHA256 9560c86ee688d4e3ee665079e3d907a6335fade64b90c089c849786f81310d2a
- MD5 9f0a4eb44ae2ef43690d16add8bfb9ac
- SHA1 4c9b3f53fc5650338ee8cd4359e117c4fd33b28a
- SHA512 c78df341677321ca9c267e15d9d1e2a20df376446d7ddc8f2ea0290d00e646ac3f16b7fbc156b85999cbd3b2db3b0a6f5d0048451cff4431480b97bdfb791f7e
- SSDEEP 12288:vSFq80CohHGfUphTFB3qq7hnKY4b6RCPAyNumZLk/LDn:58JogUTF9q2nKAiN2H
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1302704
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
852KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
417KB
Virtual Size
420KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
27KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=5, id=12, version=7291,
count=12, id=11, version=8047,
count=6, id=10, version=8047,
count=44, id=14, version=7299,
count=44, id=19, version=8022,
count=24, id=19, version=8034,
count=675, id=1, productName=Unmarked objects,
count=3, id=93, version=2179,
count=230, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=105, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=98, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=27, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=91, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
out.upx
- SHA256 139705eddce0c6038c8b23e74b79dee9842d7df6bd710db24b6cc82467452689
- MD5 a968d92ec782e007bc608aac4d1cbcdb
- SHA1 19242bf4fc4304916322972687fd06ab28bfea47
- SHA512 cd46d70309f92ba64f16553a7c3bb10762d57f1bc472b4517ffccbcff0f96ebcf5992942d48519339905dd6fa5b3e7fbdb27d100c5890d298c363c1ebd80ac82
- SSDEEP 12288:1guKsEZhfiSogR4EeqlqL2CIK1ib1ecnACEYjUltJHLjR7iSdH+VNntbdNxLV+Sr:1guKsEZLVR43qg2OiZeyAlw8HiH8iIo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
628953
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
760KB
Virtual Size
758KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
140KB
Virtual Size
139KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
108KB
Virtual Size
314KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
44KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=5, id=12, version=7291,
count=12, id=11, version=8047,
count=6, id=10, version=8047,
count=44, id=14, version=7299,
count=44, id=19, version=8022,
count=24, id=19, version=8034,
count=675, id=1, productName=Unmarked objects,
count=3, id=93, version=2179,
count=230, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=105, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=98, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=27, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=91, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,