Behavioral task
behavioral1
Sample
兲地劫(绿色版).exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
兲地劫(绿色版).exe
Resource
win10v2004-20240226-en
General
-
Target
ad0e6df386f1eebd4c664c9c80225b95_JaffaCakes118
-
Size
2.3MB
-
MD5
ad0e6df386f1eebd4c664c9c80225b95
-
SHA1
3e73633b54c4b60a15c671d9e66435e41d4cddb6
-
SHA256
2d4d62cdeaf52ba2cc9abc0c03277d4dfff72001797a023cb32e969459b5a863
-
SHA512
cf17800f8990e4682fe6a28b78fb80b74b8eaec90f5aedd0756b41970b4df052cb494cf4a01c65d109fc09ad124fd94c849d879cac5aa4f64516cb7399a561cd
-
SSDEEP
49152:suvlv+9pUhmcrst4PICR3bTy1sOHdOp7WszvBXAVXD1aN2zJ3lKdas4aFbSx:sKyUhmIst4U1pdOp7bBXAxJaNexgV9Sx
Malware Config
Signatures
-
resource yara_rule static1/unpack001/兲地劫(绿色版).exe aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/兲地劫(绿色版).exe
Files
-
ad0e6df386f1eebd4c664c9c80225b95_JaffaCakes118.rar
-
bestitem.ini
-
兲地劫(绿色版).exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 433KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.itext Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 14KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 60B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 49KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.5MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 10KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE