Overview
overview
7Static
static
7155绿色�...��.url
windows7-x64
1155绿色�...��.url
windows10-2004-x64
1PGPCommand...32.msi
windows7-x64
6PGPCommand...32.msi
windows10-2004-x64
6PGPCommand...64.msi
windows7-x64
6PGPCommand...64.msi
windows10-2004-x64
6PGP_KeyGen.exe
windows7-x64
7PGP_KeyGen.exe
windows10-2004-x64
7Behavioral task
behavioral1
Sample
155绿色软件站.url
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
155绿色软件站.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
PGPCommandLine-10.1.0.52--Win32.msi
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
PGPCommandLine-10.1.0.52--Win32.msi
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
PGPCommandLine-10.1.0.52--Win64.msi
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
PGPCommandLine-10.1.0.52--Win64.msi
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
PGP_KeyGen.exe
Resource
win7-20240903-en
General
-
Target
ebad2b34bc0df445d48785cfafc79c88_JaffaCakes118
-
Size
10.4MB
-
MD5
ebad2b34bc0df445d48785cfafc79c88
-
SHA1
42b3f36c767676739d1e084de2cbb3f7f4c67d92
-
SHA256
542fd51df7cabbd3168d266f280bbc63878661a530260e3e19054b48fedeeb3b
-
SHA512
c818a8b4067591ab920fffff6483618ef578cecd062839dc3d7b34cbbaef005ffe6e267480fd1685e57a684509d369337425a8b49f72d2bf8d48531d92a74d65
-
SSDEEP
196608:aExIGY+M/SDjmxsHNKCtRe2S5OaUvCCJD7qOf8WCaNL9ND2tk7SaU/kU5nm:Rx5M/vxsNeBO7vhdUaRUkyR5nm
Malware Config
Signatures
-
resource yara_rule static1/unpack001/PGP_KeyGen.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/PGP_KeyGen.exe
Files
-
ebad2b34bc0df445d48785cfafc79c88_JaffaCakes118.rar
-
155绿色软件站.url.url
-
PGPCommandLine-10.1.0.52--Win32.msi.msi
-
PGPCommandLine-10.1.0.52--Win64.msi.msi
-
PGP_KeyGen.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 140KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 199KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE