5d18289059988300e5c2ba29ed6bd3b6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5d18289059988300e5c2ba29ed6bd3b6_JaffaCakes118
Size

709KB
MD5

5d18289059988300e5c2ba29ed6bd3b6
SHA1

954c22a1457fc2d0c418633c64188370c61bf92b
SHA256

877763ccf9f96cb11cd5afe87d734367911f21f97d3d069ddf0aadbd03b06499
SHA512

980176082a44ea912a4b2707e8a7ec5880b595fd058e29a5f1257c0629315646e7bd362881327c5b6bcc508dba8a1196b061e9b27f6371ae76470b95594e0593
SSDEEP

12288:/YsCptLAUqZgre7QaHqIrTGa39xyDA296REDFAUIanEV7gYwI4hr4dx5I1ed3oBI:7NKk1HqIrTGa39xyDAYZDF7cBw5hruWS

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/QQAutoLogin_2010.0902/QQAutoLogin.exe	upx
static1/unpack001/QQAutoLogin_2010.0902/SkinH_EL.dll	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/QQAutoLogin_2010.0902/QQAutoLogin.exe
unpack001/QQAutoLogin_2010.0902/SkinH_EL.dll

Files

5d18289059988300e5c2ba29ed6bd3b6_JaffaCakes118
.rar
QQAutoLogin_2010.0902/QQAutoLogin.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 589KB - Virtual size: 592KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
QQAutoLogin_2010.0902/SkinH_EL.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

SkinH_AdjustAero
SkinH_AdjustHSV
SkinH_Attach
SkinH_AttachEx
SkinH_AttachExt
SkinH_AttachRes
SkinH_AttachResEx
SkinH_Detach
SkinH_DetachEx
SkinH_GetColor
SkinH_LockUpdate
SkinH_Map
SkinH_NineBlt
SkinH_SetAero
SkinH_SetBackColor
SkinH_SetFont
SkinH_SetFontEx
SkinH_SetForeColor
SkinH_SetMenuAlpha
SkinH_SetTitleMenuBar
SkinH_SetWindowAlpha
SkinH_SetWindowMovable
SkinH_VerifySign

Sections

.text
Size: 156KB - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.UPX1
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
QQAutoLogin_2010.0902/skinh.she
QQAutoLogin_2010.0902/说明.txt

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 1.1MB

UPX1 Size: 589KB - Virtual size: 592KB

.rsrc Size: 23KB - Virtual size: 24KB

Headers

File Characteristics

Exports

Exports

Sections

.text Size: 156KB - Virtual size: 155KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 1KB

.UPX0 Size: 12KB - Virtual size: 10KB

.UPX1 Size: 8KB - Virtual size: 7KB

.reloc Size: 12KB - Virtual size: 8KB

UPX0
Size: - Virtual size: 1.1MB

UPX1
Size: 589KB - Virtual size: 592KB

.rsrc
Size: 23KB - Virtual size: 24KB

.text
Size: 156KB - Virtual size: 155KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 1KB

.UPX0
Size: 12KB - Virtual size: 10KB

.UPX1
Size: 8KB - Virtual size: 7KB

.reloc
Size: 12KB - Virtual size: 8KB