Behavioral task
behavioral1
Sample
密码记录大师.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
密码记录大师.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20240802-en
General
-
Target
dd2dcfa4f568bbff6224ceb42ef0a8a0_JaffaCakes118
-
Size
1.0MB
-
MD5
dd2dcfa4f568bbff6224ceb42ef0a8a0
-
SHA1
bd9adeacdc204fc7bd84aeaf0294e02282cd8fe5
-
SHA256
bb7f270590702081ee53f4872ca5bdeda809966ed95d940d41f0be746ae5ca3a
-
SHA512
1686c366e931187bb60af537cac8043156897618145b4a6e8b9499dafd76fd59033c9f21d23bb8651e7d336b12efefb60c23d364771f5035ebf8a92b193f6f45
-
SSDEEP
24576:XWpG4h9j6q4dfCcwWZ/C+DQ2PsBUbBEpbpxLtBkOJnHWAH:XWpG46XfwWZ/zPUmBEpnJBLJ9H
Malware Config
Signatures
-
resource yara_rule static1/unpack001/密码记录大师.exe themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/密码记录大师.exe
Files
-
dd2dcfa4f568bbff6224ceb42ef0a8a0_JaffaCakes118.rar
-
密码记录大师.exe.exe windows:0 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 44KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Themida Size: 622KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
新云软件.url.url
-
说明.txt