Behavioral task
behavioral1
Sample
CcitSetup.exe
Resource
win7-20240708-en
General
-
Target
820de08b51904c7d18a6b865aec007d8_JaffaCakes118
-
Size
2.0MB
-
MD5
820de08b51904c7d18a6b865aec007d8
-
SHA1
f4fce4b10b1e2383c21f3bb72d9ddbb6b5cd77fb
-
SHA256
4c5d8239fa74437f60bf1c4660abcb78ca5b73e62c0fb5435ca15393f0a177a3
-
SHA512
559de7bc019c6ba8f0387687613f16a0a9fe59599b1589c7330cd646b0421a4f54fafc943175a373ae31006e0058ff67506733eaf5a7eb7ab696b3989229a962
-
SSDEEP
49152:RG6/hVZeGNysljmj/YXaqSfEpcQL6BktWCdsabSazZ4JQjh6Sbx:Rd/hVxyEj+YXaqSf+L2QldZOazqJQ960
Malware Config
Signatures
-
resource yara_rule static1/unpack001/CcitSetup.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/CcitSetup.exe unpack002/out.upx
Files
-
820de08b51904c7d18a6b865aec007d8_JaffaCakes118.rar
-
CcitSetup.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 84KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 42KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 71KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
下载说明.htm.html .js polyglot