d4a938bed4ce6af1f67a2b4bfa017bc1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d4a938bed4ce6af1f67a2b4bfa017bc1_JaffaCakes118
Size

64KB
MD5

d4a938bed4ce6af1f67a2b4bfa017bc1
SHA1

5958f68796a123757821200563d8aa911baa0ee5
SHA256

4cf5b9bd05b36c22e598fbc5e3e7fdfd9354a77625cad2d3088eaa7b2e30165c
SHA512

cf97702009d854adea7774ccb0cbe814727aa250855924c66a72ce7c199cba86df9b6e5da8cb69066c752af232e1fbc58b314c2dee78bd14ebf968ad9a9042be
SSDEEP

1536:0vBoDGcjkql8cq1vmlHrjv/uAm2f+RYUU7+poj6ZyXFIf4om2HQhWKahmB:0vBqGcjQd+lHHXR/cojuc+AohsShu

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

resource	yara_rule
static1/unpack001/hymmCNGR/hyllk.exe	aspack_v212_v242

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/hymmCNGR/hyllk.exe
unpack001/hymmCNGR/hymm1.exe

Files

d4a938bed4ce6af1f67a2b4bfa017bc1_JaffaCakes118
.rar
hymmCNGR/hyllk.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 27KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
hymmCNGR/hymm1.exe
.exe windows:4 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 24KB - Virtual size: 680KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
hymmCNGR/必看说明.htm
hymmCNGR/河源下载站.url
.url