Behavioral task
behavioral1
Sample
377/dvt-fnv.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
377/dvt-fnv.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
377/Архив трейнеров.url
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
377/Архив трейнеров.url
Resource
win10v2004-20240508-en
General
-
Target
07b60b3a555f256767104042095d895f_JaffaCakes118
-
Size
208KB
-
MD5
07b60b3a555f256767104042095d895f
-
SHA1
4a252a8998faefa84365b05106a6f2b4b4914ea7
-
SHA256
42d7e4d77f3aa77105154d5534d2efe2d3185d71428ce18eac9ecf94b7f721cf
-
SHA512
b25a343333b8f645faa95c74a7b0bbf4241e2fd7cda2528667e2e90287d789d3c1a2db15cb1302b5c4b8c6ed10ed1c7b700f13f2f1c00078af8a08d33f9f9f29
-
SSDEEP
6144:uZbM50TViyFqosvmKjPlTmmlPQdl7nJxM0:uZfTViyFoLlTmmlPUl7XH
Malware Config
Signatures
-
resource yara_rule static1/unpack001/377/dvt-fnv.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/377/dvt-fnv.exe unpack002/out.upx
Files
-
07b60b3a555f256767104042095d895f_JaffaCakes118.rar
-
377/dEViATED.nfo
-
377/dvt-fnv.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 540KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 177KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 55KB - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 522KB - Virtual size: 521KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
377/Архив трейнеров.url