Behavioral task
behavioral1
Sample
cadkiller/CAD病毒专杀.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
cadkiller/CAD病毒专杀.exe
Resource
win10v2004-20240709-en
General
-
Target
328de2b41506e39974e0ffbf727d6e4f_JaffaCakes118
-
Size
418KB
-
MD5
328de2b41506e39974e0ffbf727d6e4f
-
SHA1
37094dd40bb17bf96f8538da1506e9338465ef0a
-
SHA256
dad24fab7f21b260922341e88f7b65f7460e843e278ec5f03cf5478c3589ef1a
-
SHA512
1e5e4ca8d7edb809a637675defb2cb8aecfc88d1d3230dce1442e8831d4c3ac706f26fa39c2c443e1537ab60e2ff45ad98fbbf828c8a15b1a2d94e719b892c6f
-
SSDEEP
12288:/irLU+7ELfVuHlgj+vwF3dPeyed6B+kYqYKerI:KvX7ELf4HlU+63QcYvKerI
Malware Config
Signatures
-
resource yara_rule static1/unpack001/cadkiller/CAD病毒专杀.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/cadkiller/CAD病毒专杀.exe
Files
-
328de2b41506e39974e0ffbf727d6e4f_JaffaCakes118.rar
-
cadkiller/CAD病毒专杀.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 876KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 384KB - Virtual size: 384KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 103KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE