Behavioral task
behavioral1
Sample
keygen.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
keygen.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
vm0506.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
vm0506.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
非常世纪资源网.url
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
非常世纪资源网.url
Resource
win10v2004-20240802-en
General
-
Target
eac4a94ca94c23a9cbcd68b1a17f8f7e_JaffaCakes118
-
Size
2.2MB
-
MD5
eac4a94ca94c23a9cbcd68b1a17f8f7e
-
SHA1
8b728e1e57270bae9c44b90db59476cfcd708810
-
SHA256
dc6dd9ec307e895deed204301acbf94f9a185c0e29f1866a3afe3480a9c256e8
-
SHA512
d68f3fc0fc94e430cb2ea5bcd876216d7245888d1b97c9c550e85dcfde10db21d88f24c6087c25db10e1d1de4dc80ecb1c847b9995e6206687b495ea5acb611e
-
SSDEEP
49152:UcWqTCEMIFt1ALMgevxy+IkbENvCN+0dheBeJQpCfSpRWQsThq5YXCVLH3xrdIf1:UvCtCLMrA+RbENzI+esbaThvC9HRdw
Malware Config
Signatures
-
resource yara_rule static1/unpack001/keygen.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/keygen.exe unpack001/vm0506.exe
Files
-
eac4a94ca94c23a9cbcd68b1a17f8f7e_JaffaCakes118.rar
-
keygen.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 464KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 81KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
vm0506.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 78KB - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 5KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.seau Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
下载说明.htm.html .js polyglot
-
安装说明.txt
-
非常世纪资源网.url.url