4e88a40af47431ccc64cc047f655a10c_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

4e88a40af47431ccc64cc047f655a10c_JaffaCakes118
Size

1.8MB
MD5

4e88a40af47431ccc64cc047f655a10c
SHA1

38cfa4d551c2ed14f40d54fae521b9c9a4507720
SHA256

b92841f934adb8f8a4d611ab15dcce01b452e807c794c0f2ca9e312f5c5f956c
SHA512

1e46500b07103891fd20b9d20d579b139aea08b613500ab7c9d74c1383b819ba577fb91da4ed4d63a3b4c08b947269f766af2d338e06903b0d0946a64674f3f3
SSDEEP

24576:UpP6wJichMBP+7jIZMF6xDbGmCoQZGGVJb62iReMq8WGn2Yuf67DxzpdyC9:8PT2+PIZRnQQGVJbDiMD8WG2Yuf67Db9

Score

7^/10

aspackv2 upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/jishiyuwaigua/及时雨7.75稳定版/WGSHELL.DLL	acprotect

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/jishiyuwaigua/及时雨7.75稳定版/JSY.dll	aspack_v212_v242
static1/unpack001/jishiyuwaigua/及时雨7.75稳定版/jsy.dat	aspack_v212_v242

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/jishiyuwaigua/及时雨7.75稳定版/WGSHELL.DLL	upx

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/jishiyuwaigua/及时雨7.75稳定版/JSY.dll
unpack001/jishiyuwaigua/及时雨7.75稳定版/WGSHELL.DLL
unpack001/jishiyuwaigua/及时雨7.75稳定版/jsy.dat
unpack001/jishiyuwaigua/及时雨7.75稳定版/启动及时雨.exe

Files

4e88a40af47431ccc64cc047f655a10c_JaffaCakes118
.rar
jishiyuwaigua/及时雨7.75稳定版/BMPINFO.BIN
jishiyuwaigua/及时雨7.75稳定版/JSY.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

InstHookProc
UnInstHookProc

Sections

.text
Size: 106KB - Virtual size: 340KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.share
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 19KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 19KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
jishiyuwaigua/及时雨7.75稳定版/MAPINFO.BIN
jishiyuwaigua/及时雨7.75稳定版/WGSHELL.DLL
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DeRegisterShell
RegisterShell

Sections

UPX0
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
jishiyuwaigua/及时雨7.75稳定版/jsy.dat
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 87KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 9KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 41KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
jishiyuwaigua/及时雨7.75稳定版/使用说明.txt
jishiyuwaigua/及时雨7.75稳定版/启动及时雨.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 13KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

45vip
Size: 116KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
jishiyuwaigua/及时雨7.75稳定版/孟度斯-免装软件园.url

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

.text Size: 106KB - Virtual size: 340KB

.share Size: 512B - Virtual size: 4KB

.idata Size: 4KB - Virtual size: 4KB

.rdata Size: 19KB - Virtual size: 68KB

.rsrc Size: 21KB - Virtual size: 84KB

.reloc Size: 19KB - Virtual size: 28KB

.aspack Size: 4KB - Virtual size: 8KB

.adata Size: - Virtual size: 4KB

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 36KB

UPX1 Size: 14KB - Virtual size: 16KB

UPX2 Size: 512B - Virtual size: 4KB

Headers

File Characteristics

Sections

.text Size: 87KB - Virtual size: 168KB

.idata Size: 13KB - Virtual size: 48KB

.rdata Size: 9KB - Virtual size: 68KB

.rsrc Size: 41KB - Virtual size: 200KB

.aspack Size: 15KB - Virtual size: 16KB

.adata Size: - Virtual size: 4KB

Headers

File Characteristics

Sections

Size: 13KB - Virtual size: 20KB

Size: 2KB - Virtual size: 4KB

Size: 2KB - Virtual size: 8KB

Size: 5KB - Virtual size: 16KB

.rsrc Size: 512B - Virtual size: 4KB

45vip Size: 116KB - Virtual size: 120KB

.adata Size: - Virtual size: 4KB

.text
Size: 106KB - Virtual size: 340KB

.share
Size: 512B - Virtual size: 4KB

.idata
Size: 4KB - Virtual size: 4KB

.rdata
Size: 19KB - Virtual size: 68KB

.rsrc
Size: 21KB - Virtual size: 84KB

.reloc
Size: 19KB - Virtual size: 28KB

.aspack
Size: 4KB - Virtual size: 8KB

.adata
Size: - Virtual size: 4KB

UPX0
Size: - Virtual size: 36KB

UPX1
Size: 14KB - Virtual size: 16KB

UPX2
Size: 512B - Virtual size: 4KB

.text
Size: 87KB - Virtual size: 168KB

.idata
Size: 13KB - Virtual size: 48KB

.rdata
Size: 9KB - Virtual size: 68KB

.rsrc
Size: 41KB - Virtual size: 200KB

.aspack
Size: 15KB - Virtual size: 16KB

.adata
Size: - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 4KB

45vip
Size: 116KB - Virtual size: 120KB

.adata
Size: - Virtual size: 4KB