Behavioral task
behavioral1
Sample
cht-sthk.exe
Resource
win7-20240704-en
General
-
Target
743f5f56a61c114c022097a8f3f32678_JaffaCakes118
-
Size
79KB
-
MD5
743f5f56a61c114c022097a8f3f32678
-
SHA1
7774937508df5c401381693bd1f5b270243814ea
-
SHA256
f4c798a1d05427f2fcb216baaafe0190a44adca316e19277fef443f3222d9b61
-
SHA512
b9492de316e29e461d71254381b99262e055ea9e4b8b4576d27bf6b466c3e84b84f1bf09baf60a01c0904c59010bc9710993d38791db72415fac95dc8e07fd09
-
SSDEEP
1536:+OCYLL/0H+INLxjkVLrt8mMQpUAQ7gjMypcxBIPluN3Ss:+OCIL/0HvNVAVtNM+UAQ3UAItTs
Malware Config
Signatures
-
resource yara_rule static1/unpack001/cht-sthk.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/cht-sthk.exe unpack002/out.upx
Files
-
743f5f56a61c114c022097a8f3f32678_JaffaCakes118.rar
-
cht-sthk.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 156KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 81KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 219KB - Virtual size: 219KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
cht-sthk.nfo