Behavioral task
behavioral1
Sample
xiaomixgqfzgj/三国小镇修改器.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
xiaomixgqfzgj/三国小镇修改器.exe
Resource
win10v2004-20240508-en
General
-
Target
a1a88e843ee803e8a84a7d18f95bf392_JaffaCakes118
-
Size
1.3MB
-
MD5
a1a88e843ee803e8a84a7d18f95bf392
-
SHA1
93adf40efb92d28e28b9b2694b55aa16f27701a3
-
SHA256
ba9b4fbfdf3ec7673b927dd2880adca72a4c874b0f4c121480f2b7be62545cc1
-
SHA512
6031b40e2af12a35c8069e32c86e37594cb11bdc0ea3b211f9a5843b1bcafd71400aa7736d20edc2692044c98f72c5b21881ec6f8b9de8074836de483041c5f1
-
SSDEEP
24576:tGWzZ6lthRuZpv5qJnY/iyFT/X8BMpkqTdPwA31wZrh7N/hLoz:tGOZOthsv50npMsBYpPZArhRJLu
Malware Config
Signatures
-
resource yara_rule static1/unpack001/xiaomixgqfzgj/三国小镇修改器.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/xiaomixgqfzgj/三国小镇修改器.exe
Files
-
a1a88e843ee803e8a84a7d18f95bf392_JaffaCakes118.rar
-
xiaomixgqfzgj/三国小镇修改器.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE