Behavioral task
behavioral1
Sample
TOOL.exe
Resource
win7-20240903-en
General
-
Target
d2cc5712e9e3873c1a9ecad68127e1c6_JaffaCakes118
-
Size
500KB
-
MD5
d2cc5712e9e3873c1a9ecad68127e1c6
-
SHA1
dfd5f219f219608b5feb3d855bf6667797ac3fc8
-
SHA256
b7622f0fb56fc4ec09af6230a630507da2297fe92b652e800d3ee6466eb570c8
-
SHA512
a28b9cd569f020ba8ed96f74de26288693ae410028c523afd2fa1409a582b5efb223f61de06f33cc6d31c4f8cc8430ff75a71a8e89965ba5998e78118ce1d7e5
-
SSDEEP
12288:Ymanm3StrdBQB0BmkWnn+7NreF/nx4Hy9YbgYrr1gba0U:dRqJSBQmJnn0Hy9TYX1r5
Malware Config
Signatures
-
resource yara_rule static1/unpack001/TOOL.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/TOOL.exe
Files
-
d2cc5712e9e3873c1a9ecad68127e1c6_JaffaCakes118.rar
-
TOOL.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 924KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 496KB - Virtual size: 496KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
下载说明.htm.html .js polyglot