Static task
static1
Behavioral task
behavioral1
Sample
4516694/为卿狂.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4516694/为卿狂.exe
Resource
win10v2004-20240709-en
General
-
Target
694dc1ed40f88313c50d2661de19eda9_JaffaCakes118
-
Size
699KB
-
MD5
694dc1ed40f88313c50d2661de19eda9
-
SHA1
fd8eb1913284f7d2e69bb68cd652f79d428b9e20
-
SHA256
21482616f97db2fc5875813995eb8909101cc24cd61e88ebeae6a7d4efdb3dfe
-
SHA512
f62fcca521183e2b5e1acb1a3abfceaf4df3c06e6fa4a4517d97f6d46961f88d4a79b6bc12d3807ae35d60a77c20fd28839698ed322d9e72d7d292c4e961c117
-
SSDEEP
12288:0MTMxkNDpgCjE5A11/AqHMHpX1ogRlea/6aUtTNXSwIhGub8eV:0IpY5A11LHMDPL/6a8NCwYx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/4516694/为卿狂.exe
Files
-
694dc1ed40f88313c50d2661de19eda9_JaffaCakes118.rar
-
4516694/Fmbbgl1.Rpt
-
4516694/Project2.cfg
-
4516694/Project2.dof
-
4516694/Project2.dpr
-
4516694/Project2.res
-
4516694/Project2.~dpr
-
4516694/Uchpass.dcu
-
4516694/Uchpass.ddp
-
4516694/Uchpass.dfm
-
4516694/Uchpass.pas
-
4516694/Uchpass.~ddp
-
4516694/Uchpass.~dfm
-
4516694/Uchpass.~pas
-
4516694/Ulogin.dcu
-
4516694/Ulogin.ddp
-
4516694/Ulogin.dfm
-
4516694/Ulogin.pas
-
4516694/Ulogin.~ddp
-
4516694/Ulogin.~dfm
-
4516694/Ulogin.~pas
-
4516694/Umain.dcu
-
4516694/Umain.ddp
-
4516694/Umain.dfm
-
4516694/Umain.pas
-
4516694/Umain.~ddp
-
4516694/Umain.~dfm
-
4516694/Umain.~pas
-
4516694/Unit1.dcu
-
4516694/Usearch.dcu
-
4516694/Usearch.ddp
-
4516694/Usearch.dfm
-
4516694/Usearch.pas
-
4516694/Usearch.~ddp
-
4516694/Usearch.~dfm
-
4516694/Usearch.~pas
-
4516694/data/data.mdb
-
4516694/data/p.lyr
-
4516694/下载说明.htm.html .js polyglot
-
4516694/为卿狂.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 652KB - Virtual size: 652KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ