Static task
static1
Behavioral task
behavioral1
Sample
155绿色软件站.url
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
155绿色软件站.url
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
RemoveWAT.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
RemoveWAT.exe
Resource
win10v2004-20240709-en
General
-
Target
60f62abfbc93764f048e35d148156c47_JaffaCakes118
-
Size
3.8MB
-
MD5
60f62abfbc93764f048e35d148156c47
-
SHA1
523ad3f316ebb4a64a86e824584829da1596fc2d
-
SHA256
150dd7fe82736d4cffa915adb29fb65245ce9d6bc97edc66b57cc5a42300a62b
-
SHA512
d3d21d0d9b24db5b341227b7edfba8fe0846cc38a21c106872396c0540f9c6c420b71b156393599c03a829357f16ab65f64f5ee9b396024afa5303a7f47ca211
-
SSDEEP
98304:P/tnjCstDbdhfJBLO8j6+lgOvWYvcrsA9qDOE9cyF56XlF6CnSJdmB:tjCstfvBBLrlg2W2cGDZCH66SXmB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/RemoveWAT.exe
Files
-
60f62abfbc93764f048e35d148156c47_JaffaCakes118.rar
-
155绿色软件站.url.url
-
RemoveWAT.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 101KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ