Behavioral task
behavioral1
Sample
LockFolder.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
LockFolder.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
Readme-说明.html
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
Readme-说明.html
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
新云软件.url
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
新云软件.url
Resource
win10v2004-20240704-en
General
-
Target
4b43ed73769e40ec37bc70728ecd68b4_JaffaCakes118
-
Size
744KB
-
MD5
4b43ed73769e40ec37bc70728ecd68b4
-
SHA1
2e86d345af0f9a21fcf78c3164fe2ec8becd1368
-
SHA256
075fed318a4ffc438c683cc90b815a2de0b87505b34ed5659e7892c80b677919
-
SHA512
b1227735dbb61ac56d2a54d74a4c325942bb81eb024bad7cab46538c251d5e563a05a04e555b0e9e7af44ec500f9ac297993d28d6c82ede72fd6a474bcc48197
-
SSDEEP
12288:sv+j0UlfKR9AUxwCj55JLlcP2g7cp6V5Ir7Q+85omQu7dueBUnPTzz4ZJu2:svbyfO9A/A5ZSPvU6tOhu7hB6Oz
Malware Config
Signatures
-
resource yara_rule static1/unpack001/LockFolder.exe themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/LockFolder.exe
Files
-
4b43ed73769e40ec37bc70728ecd68b4_JaffaCakes118.rar
-
LockFolder.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 100KB - Virtual size: 372KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Themida Size: 664KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Readme-说明.html.html
-
新云软件.url.url