3c2c57b0cbc27e0256df12082f899c00_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3c2c57b0cbc27e0256df12082f899c00_JaffaCakes118
Size

401KB
MD5

3c2c57b0cbc27e0256df12082f899c00
SHA1

c650002003aef0836e1015a9b04ce5793d9b0c76
SHA256

f15fe81e5969af8e27115867c18a0a0bed957ecc7872859660abab2d124195b0
SHA512

cd9e5cf827cdfb477dbb1161dc49895a4561c33404e5edc83d374b8bfab7cbb9bda8762851eb3685b1608f14464cc834d446c3ace237a8a822aef31c53c9e5e8
SSDEEP

6144:2uO8Hx+anLt3XEv/BZ0g4BPq19FIDWx0pCkZSkV/Pmw8oC8bCerOK/DPZKsY:g8Hx+aLxu/BOg4S5IDWqLZfJmShB7csY

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/黑豆新浪微博批量注册工具 v1.0/hdsnwb.exe	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/黑豆新浪微博批量注册工具 v1.0/hdsnwb.exe
unpack002/out.upx

Files

3c2c57b0cbc27e0256df12082f899c00_JaffaCakes118
.rar
黑豆新浪微博批量注册工具 v1.0/hdsnwb.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 780KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 402KB - Virtual size: 404KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 612KB - Virtual size: 608KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 212KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 321KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
黑豆新浪微博批量注册工具 v1.0/使用必读.url
黑豆新浪微博批量注册工具 v1.0/绿色先锋下载.url
.url