02811191dab51478dd948863c3a6c1c2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

02811191dab51478dd948863c3a6c1c2_JaffaCakes118
Size

3.6MB
MD5

02811191dab51478dd948863c3a6c1c2
SHA1

083325bb49afce1f6fb13f144159c859beda698d
SHA256

14ccb12514eb3cfd213566d45afcb6731e659064cc6550913f1ac591a0116e5e
SHA512

ae15002aec10c43433bd764d8f9b1abcbca5fa98c0004c9dcd9f95fccdaf5c314a1fb51f1f6836257489e0158f75c4a5bdcc287e2c876e26f59343d263db10dd
SSDEEP

98304:U8gaz0d0KMRq7o5QZrdjI5213MLv8JtWyjC:U8gaAIRWocrdH1QkJNe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/万象2008收银助手.exe

Files

02811191dab51478dd948863c3a6c1c2_JaffaCakes118
.rar
WX2008.jpg
.jpg
万象2008收银助手.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 299KB - Virtual size: 868KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 2.9MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

paldu
Size: 361KB - Virtual size: 364KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
新云软件.url
.url
说明.txt