012812c5d77460952c32d2c5c975fcc8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

012812c5d77460952c32d2c5c975fcc8_JaffaCakes118
Size

1.4MB
MD5

012812c5d77460952c32d2c5c975fcc8
SHA1

ee55d95a80e02569adccbd38ce40a36be04b5b6f
SHA256

3ebdcd6fe2b3eac20b8754c22eae3eee06f70a43f91297884428bae5f0700a9c
SHA512

2a33d87e0bb290a6ecb8601bb21358538274203c66b7610e551725bc2844a50a761b30c30e8eae203b929d353148920f6c9ebd857289a66cd411875c7932fc53
SSDEEP

24576:GzYbB4pfpSzp5U8HpVemX7EcvXPjlsTs5h7gagMyIOYlvX1M12Adb+qoH84n16mj:ZwSzpyCjXgcnyTsr5gMy7kX1fQkH808k

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/cvery.comdel62452358244/client.exe	upx
static1/unpack001/cvery.comdel62452358244/server.exe	upx

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/cvery.comdel62452358244/client.exe
unpack002/out.upx
unpack001/cvery.comdel62452358244/server.exe
unpack003/out.upx
unpack001/cvery.comdel62452358244/文件捆绑.exe

Files

012812c5d77460952c32d2c5c975fcc8_JaffaCakes118
.rar
cvery.comdel62452358244/Project1.cfg
cvery.comdel62452358244/Project1.dof
cvery.comdel62452358244/Project1.dpr
cvery.comdel62452358244/Project1.res
cvery.comdel62452358244/SKIN/A.skn
cvery.comdel62452358244/SKIN/B.skn
cvery.comdel62452358244/SKIN/C.skn
cvery.comdel62452358244/SKIN/D.skn
cvery.comdel62452358244/SKIN/E.skn
cvery.comdel62452358244/Unit1.dcu
cvery.comdel62452358244/Unit1.ddp
cvery.comdel62452358244/Unit1.dfm
cvery.comdel62452358244/Unit1.pas
.js
cvery.comdel62452358244/Unit2.ddp
cvery.comdel62452358244/Unit2.dfm
cvery.comdel62452358244/Unit2.pas
cvery.comdel62452358244/Unit4.ddp
cvery.comdel62452358244/Unit4.dfm
cvery.comdel62452358244/Unit4.pas
.js
cvery.comdel62452358244/client.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 856KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 618KB - Virtual size: 620KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 973KB - Virtual size: 973KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 8KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 20B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 369KB - Virtual size: 369KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
cvery.comdel62452358244/server.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 440KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 244KB - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 552KB - Virtual size: 551KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 20B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
cvery.comdel62452358244/sourcecodechina.url
cvery.comdel62452358244/unit2.dcu
cvery.comdel62452358244/unit4.dcu
cvery.comdel62452358244/下载说明.htm
.html .js polyglot
cvery.comdel62452358244/文件捆绑.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

.CQSN
Size: - Virtual size: 272KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CQSN
Size: 156KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CQSN
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 856KB

UPX1 Size: 618KB - Virtual size: 620KB

.rsrc Size: 7KB - Virtual size: 8KB

Headers

File Characteristics

Sections

CODE Size: 973KB - Virtual size: 973KB

DATA Size: 14KB - Virtual size: 14KB

BSS Size: - Virtual size: 8KB

.idata Size: 10KB - Virtual size: 10KB

.tls Size: - Virtual size: 20B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 62KB - Virtual size: 61KB

.rsrc Size: 369KB - Virtual size: 369KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 440KB

UPX1 Size: 244KB - Virtual size: 244KB

.rsrc Size: 5KB - Virtual size: 8KB

Headers

File Characteristics

Sections

CODE Size: 552KB - Virtual size: 551KB

DATA Size: 9KB - Virtual size: 8KB

BSS Size: - Virtual size: 4KB

.idata Size: 11KB - Virtual size: 10KB

.tls Size: - Virtual size: 20B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 39KB - Virtual size: 38KB

.rsrc Size: 32KB - Virtual size: 32KB

Headers

File Characteristics

Sections

.CQSN Size: - Virtual size: 272KB

.CQSN Size: 156KB - Virtual size: 160KB

.CQSN Size: 4KB - Virtual size: 4KB

UPX0
Size: - Virtual size: 856KB

UPX1
Size: 618KB - Virtual size: 620KB

.rsrc
Size: 7KB - Virtual size: 8KB

CODE
Size: 973KB - Virtual size: 973KB

DATA
Size: 14KB - Virtual size: 14KB

BSS
Size: - Virtual size: 8KB

.idata
Size: 10KB - Virtual size: 10KB

.tls
Size: - Virtual size: 20B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 62KB - Virtual size: 61KB

.rsrc
Size: 369KB - Virtual size: 369KB

UPX0
Size: - Virtual size: 440KB

UPX1
Size: 244KB - Virtual size: 244KB

.rsrc
Size: 5KB - Virtual size: 8KB

CODE
Size: 552KB - Virtual size: 551KB

DATA
Size: 9KB - Virtual size: 8KB

BSS
Size: - Virtual size: 4KB

.idata
Size: 11KB - Virtual size: 10KB

.tls
Size: - Virtual size: 20B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 39KB - Virtual size: 38KB

.rsrc
Size: 32KB - Virtual size: 32KB

.CQSN
Size: - Virtual size: 272KB

.CQSN
Size: 156KB - Virtual size: 160KB

.CQSN
Size: 4KB - Virtual size: 4KB