Behavioral task
behavioral1
Sample
155绿色软件站.url
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
155绿色软件站.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
djyinyuehe.exe
Resource
win7-20240704-en
General
-
Target
ab3649d805298094cbf8ac59d406b432_JaffaCakes118
-
Size
474KB
-
MD5
ab3649d805298094cbf8ac59d406b432
-
SHA1
9f30a4904d625d710b31ab38ad8b106149b74a0b
-
SHA256
99a30da4668f75c9d5198f893935f3ec57e9f04cd10a356247bd90fa177e3196
-
SHA512
8cd6c42b417a6f9c0e1542b0c09821b5fe7159e5bf6cc97ef3ce8e9bb80455bea6e4869e3ce10a71714c98344a4d4d86d7c5ce69900c13e98b1a418ad4ac0bfe
-
SSDEEP
6144:mmMAajjpJ2c5iA792H5mXAf95ntkkUtgBnn656sGw6Z+xVmQlC/W0IL:f6jj2cgIBkIKBnA6vw6uIQlC+1L
Malware Config
Signatures
-
resource yara_rule static1/unpack001/djyinyuehe.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/djyinyuehe.exe unpack002/out.upx
Files
-
ab3649d805298094cbf8ac59d406b432_JaffaCakes118.rar
-
155绿色软件站.url.url
-
djyinyuehe.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 884KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 480KB - Virtual size: 480KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 596KB - Virtual size: 595KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 212KB - Virtual size: 208KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 116KB - Virtual size: 469KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ