Behavioral task
behavioral1
Sample
155绿色软件站.url
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
155绿色软件站.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
晓月小红伞综合工具箱6.6.exe
Resource
win7-20240708-en
General
-
Target
fba4d947f087141bd138df6f357760eb_JaffaCakes118
-
Size
1.2MB
-
MD5
fba4d947f087141bd138df6f357760eb
-
SHA1
29baf936c1e4d05b973047cf711c05c5bd678d8e
-
SHA256
ba2451606e90a6f8df9da18a2106cf5c7a579523f58c5807ef0070663bf723ad
-
SHA512
1255d2aaa6c4cfe65eaaf3478da7499d2327b3d88cd0cbab597f30f4f289cc72f28e92143d5aa9d40b18617d7f6964a7ac3697873a691611c7c654515fe5c502
-
SSDEEP
24576:tXw0QKlY2uB3OsBK2MIdGRp12J6onheFZSEtjGUYKdJSGYsFGFBP3IycPWiu1:vY2uBeUfdGRpmQ9tPd8bB30Wx1
Malware Config
Signatures
-
resource yara_rule static1/unpack001/晓月小红伞综合工具箱6.6.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/晓月小红伞综合工具箱6.6.exe unpack002/out.upx
Files
-
fba4d947f087141bd138df6f357760eb_JaffaCakes118.rar
-
155绿色软件站.url.url
-
晓月小红伞综合工具箱6.6.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 364KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 50KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ