a3d6845ef63c4ee65553d22329d46447_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
a3d6845ef63c4ee65553d22329d46447_JaffaCakes118
Size 10.7MB
Sample240613-e7yrcsxhmq
SHA256 c14be10cbaa4747884c8795a313f504cbf95c3961f4c27dc86a6989a7105b311
MD5 a3d6845ef63c4ee65553d22329d46447
SHA1 1c5d5d2080771e634f4300bc025845a03979d002
SHA512 027d14543dafa46355fe6a25bcaf2d1851d67d977fefd2b1ab7b786e0ac8eb22d56b592f60884775b43f8e44dfb2dab2b91299c50645f5baab35ae3695e02bb1
SSDEEP 196608:TYuR332e6gjeagAR/MsEv+a2MVNH+e1Xd+W3ZRJpw8HJ5:LR33T6gjeaZR99a2e+e1N+qnnxHJ5
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/五三传奇.exe	aspack_v212_v242

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/五三传奇.exe

File Explorer

a3d6845ef63c4ee65553d22329d46447_JaffaCakes118

.rar 10.7MB
五三传奇.exe

.exe 10.8MB

a3d6845ef63c4ee65553d22329d46447_JaffaCakes118

SHA256 c14be10cbaa4747884c8795a313f504cbf95c3961f4c27dc86a6989a7105b311
MD5 a3d6845ef63c4ee65553d22329d46447
SHA1 1c5d5d2080771e634f4300bc025845a03979d002
SHA512 027d14543dafa46355fe6a25bcaf2d1851d67d977fefd2b1ab7b786e0ac8eb22d56b592f60884775b43f8e44dfb2dab2b91299c50645f5baab35ae3695e02bb1
SSDEEP 196608:TYuR332e6gjeagAR/MsEv+a2MVNH+e1Xd+W3ZRJpw8HJ5:LR33T6gjeaZR99a2e+e1N+qnnxHJ5
MD5 SHA1 SHA512 SSDEEP

五三传奇.exe

SHA256 1c8657b5c3d201e82a0ffd37e6137bd38204bfbd47c795f061d8c1a424fc7f6b
MD5 44b486f8c406cbc45b2aa0eb433ad272
SHA1 ef21ca5c7446283277453608085f489898d6b2b9
SHA512 97f98e3b8016232a3a18e13de4c0081edd6fdb65fc61a0c2de108f81ca595404e5d6411c3dd1df40fbad27488fc7cabb6550a852fb08143a08da875f32d4c1ed
SSDEEP 196608:HMUZmvh4u36Iydc1IAxHbG6rjY/GjEJvlB8QTGVVCIm9tQFM5VseFA1hvjk4JM0:HMqe6IzeANC6PYeju92QyVoIm9tp56SS
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ASPack v2.12-2.42

Detects executables packed with ASPack v2.12-2.42

aspackv2
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5992449

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

424KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

DATA

Size

29KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.6MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.aspack

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

a3d6845ef63c4ee65553d22329d46447_JaffaCakes118

五三传奇.exe

generic