Static task
static1
Behavioral task
behavioral1
Sample
HA_HeapMemView1.01_LRH/HeapMemView_Unpack.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
HA_HeapMemView1.01_LRH/HeapMemView_Unpack.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
HA_HeapMemView1.01_LRH/新云软件.url
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
HA_HeapMemView1.01_LRH/新云软件.url
Resource
win10v2004-20240611-en
General
-
Target
19d6ae31ccd7fdab94a5b944836831ba_JaffaCakes118
-
Size
32KB
-
MD5
19d6ae31ccd7fdab94a5b944836831ba
-
SHA1
09b59b0b2f5f297c1977241b2d57f42b4d30049d
-
SHA256
c0ee472296a1756d1861869d1f934e760a6bd56a133e845097dd5ceb7ec13a3e
-
SHA512
15b5c9666c78af448cfced1f782cac62e99a1ee473e1ddcb57ec14861e00ae5ad7a6c06c2730796481330202f0e9d0f7e26ab32d14767ab5d71cad6059527ceb
-
SSDEEP
768:whyxlSPvnWPLtnrop4LY58PMYlXh2XwMGQyUr/WJsSFCVzkFmJHx:5YPvnup0pR8d0gvUSOSF4zUmBx
Malware Config
Signatures
-
Nirsoft 1 IoCs
resource yara_rule static1/unpack001/HA_HeapMemView1.01_LRH/HeapMemView_Unpack.exe Nirsoft -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/HA_HeapMemView1.01_LRH/HeapMemView_Unpack.exe
Files
-
19d6ae31ccd7fdab94a5b944836831ba_JaffaCakes118.rar
-
HA_HeapMemView1.01_LRH/HeapMemView_Unpack.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 44KB - Virtual size: 48KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 28KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
HA_HeapMemView1.01_LRH/新云软件.url.url