Static task
static1
Behavioral task
behavioral1
Sample
cvery_1136007340.exe
Resource
win7-20240704-en
General
-
Target
bc47f8d99355bce069dcc3f248a2c8c6_JaffaCakes118
-
Size
5.3MB
-
MD5
bc47f8d99355bce069dcc3f248a2c8c6
-
SHA1
c1a57cde89f26b207c433f446e8a6132441985de
-
SHA256
be9d024bd70bb0e3c55badc13f7420e103d528e66df513bd93f456be6a3b147c
-
SHA512
cd9c70960626acc679abe40c28dfdf38c6d21b7242e289a3e2c7482e8f03a89ef8576357d26755e92c509a4261488c617160c1b5b4a93d0871963ebe238af871
-
SSDEEP
98304:dvT3RuHVNH9Of3VAPJqC10iYJ60BkUdt9WR5gyw4Ag+HpaFMF6uL7r1tv8cs3TxW:Vs1ZGKYCOlBPk5A4AQcXnv8cs3TnrY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/cvery_1136007340.exe
Files
-
bc47f8d99355bce069dcc3f248a2c8c6_JaffaCakes118.rar
-
cvery_1136007340.exe.exe windows:4 windows x86 arch:x86
ce2ee33d767dde30824243b85bdac10e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
UuidCreate
RpcStringFreeA
UuidToStringA
kernel32
ReadFile
SetFilePointer
GetLastError
CreateFileA
FlushFileBuffers
InterlockedIncrement
InterlockedDecrement
lstrlenA
CloseHandle
WriteFile
GetTempPathA
RemoveDirectoryA
FindClose
FindNextFileA
DeleteFileA
FindFirstFileA
GetPrivateProfileStringA
GetPrivateProfileIntA
IsBadCodePtr
IsBadReadPtr
CreateDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
lstrcmpiA
GetCurrentThreadId
GetCommandLineA
lstrcpyA
lstrlenW
MultiByteToWideChar
GetShortPathNameA
GetModuleHandleA
GetModuleFileNameA
WideCharToMultiByte
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcpynA
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
SetHandleCount
DebugBreak
SetStdHandle
SetUnhandledExceptionFilter
OutputDebugStringA
CreateProcessA
lstrcatA
RtlUnwind
GetACP
VirtualFree
HeapCreate
GetVersionExA
GetEnvironmentVariableA
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetOEMCP
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetFileType
GetStdHandle
GetCPInfo
HeapReAlloc
HeapAlloc
HeapSize
RaiseException
VirtualAlloc
IsBadWritePtr
HeapFree
GetStartupInfoA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
user32
CharNextA
LoadStringA
CharLowerA
wvsprintfA
advapi32
RegCloseKey
RegOpenKeyExA
RegDeleteValueA
RegEnumValueA
RegQueryInfoKeyA
RegEnumKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
ole32
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoInitialize
CoUninitialize
oleaut32
RegisterTypeLi
LoadTypeLi
SysAllocString
VarUI4FromStr
SysFreeString
Sections
.text Size: 60KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
下载说明.htm.html .js polyglot