Overview
overview
6Static
static
3cvery.com/...ll.msi
windows7-x64
6cvery.com/...ll.msi
windows10-2004-x64
6cvery.com/...ll.dll
windows7-x64
3cvery.com/...ll.dll
windows10-2004-x64
1cvery.com/...en.exe
windows7-x64
3cvery.com/...en.exe
windows10-2004-x64
3cvery.com/...��.url
windows7-x64
1cvery.com/...��.url
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
cvery.com/Aspose.Spell.msi
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cvery.com/Aspose.Spell.msi
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
cvery.com/Crack/Aspose.Spell.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
cvery.com/Crack/Aspose.Spell.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
cvery.com/Crack/Keygen.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
cvery.com/Crack/Keygen.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
cvery.com/非常世纪资源网.url
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
cvery.com/非常世纪资源网.url
Resource
win10v2004-20240802-en
General
-
Target
ddcd1de78444ad1385a019b3b1388f9c_JaffaCakes118
-
Size
967KB
-
MD5
ddcd1de78444ad1385a019b3b1388f9c
-
SHA1
e41f1263bee6e1fd03ec942689038854c9222265
-
SHA256
0997f2e0f9d8fd68122048e623b64153382cedde77f84f374a8583b740fd3fa1
-
SHA512
db760c7ec98fdf81b29eaf8fd5fdcf21a1463712ed482d1dd681e0fb0c7c2e9bb141d54d627462809b3bdd5d793d110f8c4ecf8eecbeaba70f9b06b57d4a20c6
-
SSDEEP
12288:usAtVZ6Uq281W0NyLSuz60LyK1PC4tr8etKyDjwSgMWz6X+fpQ9PF7/2C3LVHhsN:zAbqpZsuuvy14tRphWzE0eBF3L8
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/cvery.com/Crack/Aspose.Spell.dll unpack001/cvery.com/Crack/Keygen.exe
Files
-
ddcd1de78444ad1385a019b3b1388f9c_JaffaCakes118.rar
-
cvery.com/Aspose.Spell.msi.msi
-
cvery.com/Crack/Aspose.Spell.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.textxc Size: 104KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 82B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 1012B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
cvery.com/Crack/Keygen.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.textxc Size: 156KB - Virtual size: 153KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 82B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
cvery.com/下载说明.htm.html .js polyglot
-
cvery.com/非常世纪资源网.url.url