37c9936a449bb3469728ffdb2b3903d1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

37c9936a449bb3469728ffdb2b3903d1_JaffaCakes118
Size

1.1MB
MD5

37c9936a449bb3469728ffdb2b3903d1
SHA1

aeeed742dadafc87ddb027af7cb893570c6b1aa9
SHA256

92021231f48cbc5e345e93a5ee11e0b50d6c2648d3931e8364effff860b7af18
SHA512

ee7d80c193b0554a0c4b3344e53b02442f51413abd1033364c039dfdb6bf0987068209d14f8694663bff0916a4a67bb2389fb43d861fb0a508e89dc8de1b43af
SSDEEP

24576:MvbW3C0w9cjuDRsknKDamcpjueTtaHq6NdRhSpCj0c1Pc94BTDb:ubIw98knKDaHbhaHq6PaV9WDb

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/7z自解压仿深度界面自动生成工具.exe	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack002/out.upx	autoit_exe

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/7z自解压仿深度界面自动生成工具.exe
unpack002/out.upx

Files

37c9936a449bb3469728ffdb2b3903d1_JaffaCakes118
.rar
7Z安装制作教材.doc
.doc windows office2003
7z自解压仿深度界面自动生成工具.exe
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 444KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 252KB - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 495KB - Virtual size: 495KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
logo.gif
.gif
下载使用说明.txt