0ca894cb503ae044945836b161644141_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
0ca894cb503ae044945836b161644141_JaffaCakes118
Size 6.4MB
Sample240621-ssaymsvhph
SHA256 7629f878ba09da98ec0fa56671804eb22e38ffbd310e406e112cf365264c713d
MD5 0ca894cb503ae044945836b161644141
SHA1 ecfb42fb4c53b5761471af047985a4cfe9d0a6c5
SHA512 b09b03b7022afd65bcef95e50a1ba1914e365b19eda78c6bc37fa4ee276c5dccb23ea3dfebaf34ceccfa249c11d50e96a0082d0028852962ffd597a6cfd65f02
SSDEEP 196608:gSJXeR0NOrAqvDJXY5XigqipNy7I86wIpHLcql208:xXeocI7eF8Hoql208
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/HFSKY高校实验中心教学管理系统/setup.exe	aspack_v212_v242

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/HFSKY高校实验中心教学管理系统/setup.exe

File Explorer

0ca894cb503ae044945836b161644141_JaffaCakes118

.rar 6.4MB
HFSKY高校实验中心教学管理系统/20061101

1.6MB
HFSKY高校实验中心教学管理系统/setup.exe

.exe 6.4MB
HFSKY高校实验中心教学管理系统/下载说明.htm

.html .js 5KB
HFSKY高校实验中心教学管理系统/新云软件.url

.url 261B

0ca894cb503ae044945836b161644141_JaffaCakes118

SHA256 7629f878ba09da98ec0fa56671804eb22e38ffbd310e406e112cf365264c713d
MD5 0ca894cb503ae044945836b161644141
SHA1 ecfb42fb4c53b5761471af047985a4cfe9d0a6c5
SHA512 b09b03b7022afd65bcef95e50a1ba1914e365b19eda78c6bc37fa4ee276c5dccb23ea3dfebaf34ceccfa249c11d50e96a0082d0028852962ffd597a6cfd65f02
SSDEEP 196608:gSJXeR0NOrAqvDJXY5XigqipNy7I86wIpHLcql208:xXeocI7eF8Hoql208
MD5 SHA1 SHA512 SSDEEP

HFSKY高校实验中心教学管理系统/setup.exe

SHA256 5cd65c4bb03b931a5c49eef70fd411e70880f176fd0628bc35fb74f8207b8605
MD5 6be87553acd8d7442c636d1728196676
SHA1 c44027eedf47828906a6649ed66b6e5f7db2f30c
SHA512 7acff0f04fc021f6a2358fd0c769635054c01c1c3823555486eeec9e9e117ed9fd22e31c532f38cc09fc016a03e28cbda1824ec38ce7328557f59cd3a860eb11
SSDEEP 196608:K1KPeka6oPZfHCUUnZxlIji9dxNzSrIF6I4O0:boPpKIG9dHuIb0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ASPack v2.12-2.42

Detects executables packed with ASPack v2.12-2.42

aspackv2
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1560577

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

271KB

Virtual Size

728KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

DATA

Size

77KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

489KB

Virtual Size

616KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.aspack

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

0ca894cb503ae044945836b161644141_JaffaCakes118

HFSKY高校实验中心教学管理系统/20061101

HFSKY高校实验中心教学管理系统/setup.exe

generic

HFSKY高校实验中心教学管理系统/下载说明.htm

HFSKY高校实验中心教学管理系统/新云软件.url