Behavioral task
behavioral1
Sample
CSOL2.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
CSOL2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
hqs-av0.7.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
hqs-av0.7.exe
Resource
win10v2004-20240611-en
General
-
Target
ab92987701706c932464e27205b57f42_JaffaCakes118
-
Size
3.0MB
-
MD5
ab92987701706c932464e27205b57f42
-
SHA1
65faea9e59a239d8f8678fcc7904ac9beef6f095
-
SHA256
cb8e7a50fd22172271c62e19366f198e6992a1e08d8ff2bdefd2f11426c51a2a
-
SHA512
d7cc88f2877f15cb2d30b0d528e5239e17f1de0f37743f405e6af616141a71b7e053eecae59e5656ed7374d166a6c07e9e2caeb89a8ac23bf89058cada6ebcd2
-
SSDEEP
49152:ptXHDBnxFzCcj0d2TMrfwtBP1oAgYv0aJLEx5fqlJeiyDdmPmv2sNIN+UGvenafh:X1vad2g0ZS6vTQx9qreN5Wmv2sSnGveO
Malware Config
Signatures
-
resource yara_rule static1/unpack001/hqs-av0.7.exe aspack_v212_v242 -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/CSOL2.exe unpack001/hqs-av0.7.exe
Files
-
ab92987701706c932464e27205b57f42_JaffaCakes118.rar
-
CSOL2.exe.exe windows:4 windows x86 arch:x86
baa93d47220682c04d92f7797d9224ce
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpy
comctl32
InitCommonControls
Sections
Size: 1.5MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 1000KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
tgoutskd Size: 824KB - Virtual size: 824KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ruujfroe Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
hqs-av0.7.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 282KB - Virtual size: 640KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 372KB - Virtual size: 592KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 29KB - Virtual size: 356KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bq0ele0 Size: 22KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
使用说明.txt