Behavioral task
behavioral1
Sample
自由词典/帮助文件.rtf
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
自由词典/帮助文件.rtf
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
自由词典/自由词典.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
自由词典/自由词典.exe
Resource
win10v2004-20240802-en
General
-
Target
b2810f6b5166497e2c1be1f298be277d_JaffaCakes118
-
Size
5.1MB
-
MD5
b2810f6b5166497e2c1be1f298be277d
-
SHA1
6bbc335aa0d301ffd00c712593314c6e92920cff
-
SHA256
8438e056b91513cc66679d72c623c17d587ab0b4f5425b28ca1365b885aab7c2
-
SHA512
201bec49fdaa1f5d40f4271a033786df0cf0273457bbfb7674d856e44d89c5aa5bba30ee8ee602f5a900f0a32ec764cbd7253981273fb66d64ebd70c143eae44
-
SSDEEP
98304:3YcxzywcCND8wGW/cRBLJ4tnOJvuWjquxIH5rHPZz6Qo4r8ApS0:vxzyil8wGW/4BLSwJvvGHhBGQJ8mp
Malware Config
Signatures
-
resource yara_rule static1/unpack001/自由词典/自由词典.exe aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/自由词典/自由词典.exe
Files
-
b2810f6b5166497e2c1be1f298be277d_JaffaCakes118.rar
-
下载说明.htm.html .js polyglot
-
自由词典/下载说明.htm.html .js polyglot
-
自由词典/帮助文件.rtf.rtf
-
自由词典/精简汉英词典.txt
-
自由词典/精简英汉词典.txt
-
自由词典/自由词典.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 281KB - Virtual size: 724KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 6KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 129KB - Virtual size: 628KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE