26ca9bfbe08f4ad8b6f7b26d577126a9_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

26ca9bfbe08f4ad8b6f7b26d577126a9_JaffaCakes118
Size

13.0MB
MD5

26ca9bfbe08f4ad8b6f7b26d577126a9
SHA1

c8dd204dc80e489b2366971d1cf28cfc8b4bb896
SHA256

c2d1d634206661c0070bf945f69344d35d82154d689593a853bbb228ed24253a
SHA512

ca612bac2b422fdcbf00626ed86a68026d2f2fb6af3f12a9ca4de3c75b6f0b266e7c8df0672aeade71a4ab26ec97519ffa09654e4beb21f1d0b6b1a3026526f9
SSDEEP

393216:v6K9wfESwqxVaKkzBZnSQwo2T9GECjlPJw:yKWsSwqxQ1cQD2rCjzw

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/StarOCRM.exe	aspack_v212_v242
static1/unpack001/单机版试用/StarCRM.exe	aspack_v212_v242
static1/unpack001/数据库连接设置.exe	aspack_v212_v242

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/DATA/StarEnc.exe
unpack001/StarOCRM.exe
unpack001/单机版试用/DATA/StarEnc.exe
unpack001/单机版试用/StarCRM.exe
unpack001/数据库连接设置.exe

Files

26ca9bfbe08f4ad8b6f7b26d577126a9_JaffaCakes118
.rar
DATA/StarEnc.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 423KB - Virtual size: 423KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
DATA/StarEnc.htm
.html
DATA/StarEnc.swf
DATA/calendar.mht
.eml
email-html-1.txt
.html .js polyglot
DATA/下载说明.htm
.html .js polyglot
IMAGE/Mail1.ico
IMAGE/Mail2.ico
IMAGE/Mail3.ico
IMAGE/Mail4.ico
IMAGE/Mail5.ico
IMAGE/top1.gif
.gif
IMAGE/top2.gif
.gif
IMAGE/top3.gif
.gif
IMAGE/top4.gif
.gif
IMAGE/top5.gif
.gif
IMAGE/top6.gif
.gif
IMAGE/top7.gif
.gif
IMAGE/下载说明.htm
.html .js polyglot
StarOCRM.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 2.3MB - Virtual size: 7.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 20KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 584KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 738KB - Virtual size: 4.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Templates/Action.xls
.xls windows office2003
Templates/BuyOrder.xls
.xls windows office2003
Templates/BuyOrderO.xls
.xls windows office2003
Templates/BuyOrderS.xls
.xls windows office2003
Templates/PriceRep.xls
.xls windows office2003
Templates/RepairCard.xls
.xls windows office2003
Templates/SaleO.xls
.xls windows office2003
Templates/SalePre.xls
.xls windows office2003
Templates/SaleS.xls
.xls windows office2003
Templates/bargain.xls
.xls windows office2003
Templates/bargainE.xls
.xls windows office2003
Templates/chairtalk.xls
.xls windows office2003
Templates/client.xls
.xls windows office2003
Templates/communion.xls
.xls windows office2003
Templates/compete.xls
.xls windows office2003
Templates/department.xls
.xls windows office2003
Templates/deptask.xls
.xls windows office2003
Templates/knowledge.xls
.xls windows office2003
Templates/leave.xls
.xls windows office2003
Templates/linkman.xls
.xls windows office2003
Templates/meeting.xls
.xls windows office2003
Templates/needmoney.xls
.xls windows office2003
Templates/needrei.xls
.xls windows office2003
Templates/notes.xls
.xls windows office2003
Templates/outside.xls
.xls windows office2003
Templates/product.xls
.xls windows office2003
Templates/project.xls
.xls windows office2003
Templates/servicelog.xls
.xls windows office2003
Templates/shtbr.xls
.xls windows office2003
Templates/tasl.xls
.xls windows office2003
Templates/workform.xls
.xls windows office2003
Templates/worklog.xls
.xls windows office2003
Templates/下载说明.htm
.html .js polyglot
下载说明.htm
.html .js polyglot
单机版试用/DATA/StarEnc.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 423KB - Virtual size: 423KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
单机版试用/DATA/StarEnc.htm
.html
单机版试用/DATA/StarEnc.swf
单机版试用/DATA/Wsdn_StarOCRM.mdb
单机版试用/DATA/calendar.mht
.eml
email-html-1.txt
.html .js polyglot
单机版试用/IMAGE/Mail1.ico
单机版试用/IMAGE/Mail2.ico
单机版试用/IMAGE/Mail3.ico
单机版试用/IMAGE/Mail4.ico
单机版试用/IMAGE/Mail5.ico
单机版试用/IMAGE/Thumbs.db
单机版试用/IMAGE/top1.gif
.gif
单机版试用/IMAGE/top2.gif
.gif
单机版试用/IMAGE/top3.gif
.gif
单机版试用/IMAGE/top4.gif
.gif
单机版试用/IMAGE/top5.gif
.gif
单机版试用/IMAGE/top6.gif
.gif
单机版试用/IMAGE/top7.gif
.gif
单机版试用/StarCRM.chm
.chm
单机版试用/StarCRM.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 2.3MB - Virtual size: 7.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 20KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 580KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 719KB - Virtual size: 3.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
单机版试用/Templates/Action.xls
.xls windows office2003
单机版试用/Templates/BuyOrder.xls
.xls windows office2003
单机版试用/Templates/BuyOrderO.xls
.xls windows office2003
单机版试用/Templates/BuyOrderS.xls
.xls windows office2003
单机版试用/Templates/PriceRep.xls
.xls windows office2003
单机版试用/Templates/SaleO.xls
.xls windows office2003
单机版试用/Templates/SalePre.xls
.xls windows office2003
单机版试用/Templates/SaleS.xls
.xls windows office2003
单机版试用/Templates/bargain.xls
.xls windows office2003
单机版试用/Templates/chairtalk.xls
.xls windows office2003
单机版试用/Templates/client.xls
.xls windows office2003
单机版试用/Templates/communion.xls
.xls windows office2003
单机版试用/Templates/compete.xls
.xls windows office2003
单机版试用/Templates/deptask.xls
.xls windows office2003
单机版试用/Templates/knowledge.xls
.xls windows office2003
单机版试用/Templates/leave.xls
.xls windows office2003
单机版试用/Templates/linkman.xls
.xls windows office2003
单机版试用/Templates/meeting.xls
.xls windows office2003
单机版试用/Templates/needmoney.xls
.xls windows office2003
单机版试用/Templates/needrei.xls
.xls windows office2003
单机版试用/Templates/notes.xls
.xls windows office2003
单机版试用/Templates/outside.xls
.xls windows office2003
单机版试用/Templates/product.xls
.xls windows office2003
单机版试用/Templates/project.xls
.xls windows office2003
单机版试用/Templates/servicelog.xls
.xls windows office2003
单机版试用/Templates/tasl.xls
.xls windows office2003
单机版试用/Templates/worklog.xls
.xls windows office2003
单机版试用/下载说明.htm
.html .js polyglot
帮助文档/B-S版相关文档/StarSuit帮助手册.chm
.chm
帮助文档/下载说明.htm
.html .js polyglot
帮助文档/安装帮助.chm
.chm
帮助文档/帮助手册.chm
.chm
帮助文档/系统安装指南前.doc
.doc windows office2003
数据库连接设置.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 147KB - Virtual size: 352KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
演示数据库文件/StarOCRM_Data.MDF
演示数据库文件/StarOCRM_Log.LDF
演示数据库文件/下载说明.htm
.html .js polyglot

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

CODE Size: 423KB - Virtual size: 423KB

DATA Size: 21KB - Virtual size: 20KB

BSS Size: - Virtual size: 3KB

.idata Size: 9KB - Virtual size: 8KB

.tls Size: - Virtual size: 16B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 32KB - Virtual size: 31KB

.rsrc Size: 71KB - Virtual size: 71KB

Headers

File Characteristics

Sections

CODE Size: 2.3MB - Virtual size: 7.2MB

DATA Size: 20KB - Virtual size: 52KB

BSS Size: - Virtual size: 16KB

.idata Size: 5KB - Virtual size: 16KB

.tls Size: - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.reloc Size: - Virtual size: 584KB

.rsrc Size: 738KB - Virtual size: 4.3MB

.aspack Size: 12KB - Virtual size: 12KB

.adata Size: - Virtual size: 4KB

Headers

File Characteristics

Sections

CODE Size: 423KB - Virtual size: 423KB

DATA Size: 21KB - Virtual size: 20KB

BSS Size: - Virtual size: 3KB

.idata Size: 9KB - Virtual size: 8KB

.tls Size: - Virtual size: 16B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 32KB - Virtual size: 31KB

.rsrc Size: 71KB - Virtual size: 71KB

Headers

File Characteristics

Sections

CODE Size: 2.3MB - Virtual size: 7.1MB

DATA Size: 20KB - Virtual size: 52KB

BSS Size: - Virtual size: 16KB

.idata Size: 5KB - Virtual size: 16KB

.tls Size: - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.reloc Size: - Virtual size: 580KB

.rsrc Size: 719KB - Virtual size: 3.9MB

.aspack Size: 12KB - Virtual size: 12KB

.adata Size: - Virtual size: 4KB

Headers

File Characteristics

Sections

CODE Size: 147KB - Virtual size: 352KB

DATA Size: 2KB - Virtual size: 8KB

BSS Size: - Virtual size: 4KB

.idata Size: 3KB - Virtual size: 12KB

.tls Size: - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.reloc Size: - Virtual size: 28KB

.rsrc Size: 16KB - Virtual size: 68KB

.aspack Size: 13KB - Virtual size: 16KB

.adata Size: - Virtual size: 4KB

CODE
Size: 423KB - Virtual size: 423KB

DATA
Size: 21KB - Virtual size: 20KB

BSS
Size: - Virtual size: 3KB

.idata
Size: 9KB - Virtual size: 8KB

.tls
Size: - Virtual size: 16B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 32KB - Virtual size: 31KB

.rsrc
Size: 71KB - Virtual size: 71KB

CODE
Size: 2.3MB - Virtual size: 7.2MB

DATA
Size: 20KB - Virtual size: 52KB

BSS
Size: - Virtual size: 16KB

.idata
Size: 5KB - Virtual size: 16KB

.tls
Size: - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.reloc
Size: - Virtual size: 584KB

.rsrc
Size: 738KB - Virtual size: 4.3MB

.aspack
Size: 12KB - Virtual size: 12KB

.adata
Size: - Virtual size: 4KB

CODE
Size: 423KB - Virtual size: 423KB

DATA
Size: 21KB - Virtual size: 20KB

BSS
Size: - Virtual size: 3KB

.idata
Size: 9KB - Virtual size: 8KB

.tls
Size: - Virtual size: 16B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 32KB - Virtual size: 31KB

.rsrc
Size: 71KB - Virtual size: 71KB

CODE
Size: 2.3MB - Virtual size: 7.1MB

DATA
Size: 20KB - Virtual size: 52KB

BSS
Size: - Virtual size: 16KB

.idata
Size: 5KB - Virtual size: 16KB

.tls
Size: - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.reloc
Size: - Virtual size: 580KB

.rsrc
Size: 719KB - Virtual size: 3.9MB

.aspack
Size: 12KB - Virtual size: 12KB

.adata
Size: - Virtual size: 4KB

CODE
Size: 147KB - Virtual size: 352KB

DATA
Size: 2KB - Virtual size: 8KB

BSS
Size: - Virtual size: 4KB

.idata
Size: 3KB - Virtual size: 12KB

.tls
Size: - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.reloc
Size: - Virtual size: 28KB

.rsrc
Size: 16KB - Virtual size: 68KB

.aspack
Size: 13KB - Virtual size: 16KB

.adata
Size: - Virtual size: 4KB