Behavioral task
behavioral1
Sample
4639600/CsPost.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4639600/CsPost.exe
Resource
win10v2004-20240802-en
General
-
Target
ab2ca670dfa6ecfc1e5a5be0bd9cd0be_JaffaCakes118
-
Size
156KB
-
MD5
ab2ca670dfa6ecfc1e5a5be0bd9cd0be
-
SHA1
8dfa1f36ce0272820e4cebf443631b75d9d374e6
-
SHA256
e67577b236e85bf80fa572e58a05109dbf40e886bbd0210cf7536a33091014bd
-
SHA512
ff589b118fa8749e6c9275121e80339b52cbd59d6dc82176b58216106e311d992e0746335609eb417c681c04c05939e3b25eb6b73ee1f41150b1d0fa0f4688a8
-
SSDEEP
3072:Kv8xwVfT0FNbgCO9jBirs/j0Cy3PKdBM1g+cQ2IdCWb+vqzyktJ:K0udT0FNb2bs3PIBAg+7CWbzb
Malware Config
Signatures
-
resource yara_rule static1/unpack001/4639600/CsPost.exe aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/4639600/CsPost.exe
Files
-
ab2ca670dfa6ecfc1e5a5be0bd9cd0be_JaffaCakes118.rar
-
4639600/+.bmp
-
4639600/CsPost.cfg
-
4639600/CsPost.dof
-
4639600/CsPost.dpr
-
4639600/CsPost.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 133KB - Virtual size: 312KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
4639600/CsPost.res
-
4639600/Icon.ico
-
4639600/MainForm.dcu
-
4639600/MainForm.ddp
-
4639600/MainForm.dfm
-
4639600/MainForm.pas
-
4639600/下载说明.htm.html .js polyglot