Behavioral task
behavioral1
Sample
卸载助手.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
卸载助手.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
安装说明.url
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
安装说明.url
Resource
win10v2004-20240802-en
General
-
Target
c78c6ad4dc837d94ef68eed70846dd3f_JaffaCakes118
-
Size
217KB
-
MD5
c78c6ad4dc837d94ef68eed70846dd3f
-
SHA1
3ca2edb813fa12fb1b7268624ca50c8a76800acc
-
SHA256
2b95ff6dceff76d85bb62be9b425497b466f7eba634940b1c43436dae7118d6f
-
SHA512
dec4b0c76f6f493d93f9b283c51cc40067dcfd9a071168687a20381a199e8fba3f4bd3aa120c5aa1aca4ff1c0382944305cf15bad5cc14e2bd603f8ed0719847
-
SSDEEP
6144:IBueQWi/95RC7e//QwP3aD7zKvZgOzVhXI+H6WTKW92J9oowZVJY:IbQB5ka//QwPKDHKvKOI/WTxO9nwZVJY
Malware Config
Signatures
-
resource yara_rule static1/unpack001/卸载助手.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/卸载助手.exe unpack002/out.upx
Files
-
c78c6ad4dc837d94ef68eed70846dd3f_JaffaCakes118.rar
-
卸载助手.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 348KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 192KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 349KB - Virtual size: 348KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
安装说明.url.url