Static task
static1
Behavioral task
behavioral1
Sample
biaodan.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
biaodan.exe
Resource
win10v2004-20240802-en
General
-
Target
df2907360ca33614070d2fbb53875efe_JaffaCakes118
-
Size
856KB
-
MD5
df2907360ca33614070d2fbb53875efe
-
SHA1
820cca984a64ad9d9fc8a6a7f49521c0509aac53
-
SHA256
b230d3965c634992c48b83ff0a22716a832043677e7a6c99f4c09e10ac3d56a8
-
SHA512
97db51a662a989a6b2cdbbe59bf0d6a2ceb9dadc9d95c91b111ba43b64eabab2c8f5ac55a88ac1e234cd952f26987678db5639aec32ad570bd6a2c34bb821f90
-
SSDEEP
12288:i7v/ZYr3fytCRzJgfQMALDLfiUXH60Pk3nalGGKFz:i7vCr368RzmQMAL3qU360Pk3naoGiz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/biaodan.exe
Files
-
df2907360ca33614070d2fbb53875efe_JaffaCakes118.ace
-
out.ace.ace
-
biaodan.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: - Virtual size: 21.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.FISHPEP Size: 596KB - Virtual size: 21.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE