Static task
static1
Behavioral task
behavioral1
Sample
HA_XorIt102_CZ.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
HA_XorIt102_CZ.exe
Resource
win10v2004-20240709-en
General
-
Target
49e335ea674825738cfd733829672e41_JaffaCakes118
-
Size
188KB
-
MD5
49e335ea674825738cfd733829672e41
-
SHA1
9fbef88b3669d14016f2f9723fbf91a521a2cf41
-
SHA256
11c9a78fccb07e6fb2e3d349d900946401742d33a282fbda6ae4107d84fb12f0
-
SHA512
4640b53525beffd0b02b26d657f19bdc56d7c6579ef3179da53666ca39f566cf120b3e3ff47def6fc50bca7b8f26835ac55ba21a22a2a1bb9d92a29990311e43
-
SSDEEP
3072:D2Oxe9yCJZQxYdp3nCAPLyTyqkdqxxG3V6fh7osttf85r1ETxvMhjcxdiWQIirsB:D2Z7QxYzCATyTJ03V6fh/nfsaTxMhgec
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/HA_XorIt102_CZ.EXE
Files
-
49e335ea674825738cfd733829672e41_JaffaCakes118.rar
-
HA_XorIt102_CZ.EXE.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 66KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 41KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
下载说明.htm.html .js polyglot