Behavioral task
behavioral1
Sample
xhfaxscan.exe
Resource
win7-20240704-en
General
-
Target
aeec0df737aabe83daae58b6b7ef6d68_JaffaCakes118
-
Size
280KB
-
MD5
aeec0df737aabe83daae58b6b7ef6d68
-
SHA1
974f48d9199d67c8f346b51f2bb7fc4a8e1c28a8
-
SHA256
bf6695f0cdbd96b2e64ac1ffc53e57e6351e137966b0dac5cb89afae12cdc953
-
SHA512
24d671f0a45a8ae1759e0cc7103af1affc7ca598fd16a1781545a95916d4e69daaf5873d9000f657e01b759c216367296e751658b06af67771592ccff32e406a
-
SSDEEP
6144:E9496Rqu9EMqRW6qjP5z+BlJ0wHoL1VENSP4dpMqgf1CjoGZzBNz+:E9496UZW6q75iBlxcGNDdpMqgMhba
Malware Config
Signatures
-
resource yara_rule static1/unpack001/xhfaxscan.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/xhfaxscan.exe
Files
-
aeec0df737aabe83daae58b6b7ef6d68_JaffaCakes118.rar
-
xhfaxscan.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 444KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 277KB - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
下载说明.htm.html .js polyglot
-
使用说明.txt
-
关键词范例列表.txt