Behavioral task
behavioral1
Sample
PHP_MySQL.exe
Resource
win7-20240729-en
General
-
Target
ab6b5a627a2107e0ae47322ec6b431a5_JaffaCakes118
-
Size
8.4MB
-
MD5
ab6b5a627a2107e0ae47322ec6b431a5
-
SHA1
d917778467dbda0e85affc5418064bc14d1991c2
-
SHA256
955a09e20bdd4813afa8d8e2f3819125fff617fe1e54e04b4baccd1fa1e682b2
-
SHA512
72d3e71cdd77cfd378faee04a68a16a8a468abb8a3dac00443798790a06aca1fc8d2ad1fcf0c974a6f45e1a7c81c7ad78a983a0cc4fc6826ece45be2629e5a77
-
SSDEEP
196608:TGZlPxKrJqYYXRKn6JpTS+nHIOkQDcHaOsgjQbqMC8/33DI:ulPxKFEX4n6JhZKR8bb/zI
Malware Config
Signatures
-
resource yara_rule static1/unpack001/PHP_MySQL.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/PHP_MySQL.exe
Files
-
ab6b5a627a2107e0ae47322ec6b431a5_JaffaCakes118.rar
-
PHP_MySQL.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 524KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 278KB - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
下载说明.htm.html .js polyglot