Behavioral task
behavioral1
Sample
CF辉月辅助.exe
Resource
win7-20240705-en
General
-
Target
8dc5a61a2729e228ead30b9562b9eb5b_JaffaCakes118
-
Size
2.6MB
-
MD5
8dc5a61a2729e228ead30b9562b9eb5b
-
SHA1
d194ea3248c4bf618677cd4fd7aa11d289620d39
-
SHA256
146aa540691fb40d2c90b942c2a9f7bd5798720957fbe6fb03e589ad1ace497d
-
SHA512
da6690fe4f9a68f9cb01cf8a43fa2e5a7ed44aa5136297d889788852994f2ff9385fa2f679d3580e58b96d4f92e080e89be3f9486b623eef71ae6de2fb1fbcf3
-
SSDEEP
49152:FWpljyBlrOdBoDRDIi86THA/aGQs4NWWT8XQLE:ghelr4JIHps2W1D
Malware Config
Signatures
-
resource yara_rule static1/unpack001/CF辉月辅助.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/CF辉月辅助.exe
Files
-
8dc5a61a2729e228ead30b9562b9eb5b_JaffaCakes118.rar
-
CF辉月辅助.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE