Static task
static1
Behavioral task
behavioral1
Sample
crsky_setup_ver_20120426.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
crsky_setup_ver_20120426.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
第九软件网.url
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
第九软件网.url
Resource
win10v2004-20240802-en
General
-
Target
04ec142111c0cd9b81a60378ff57bd02_JaffaCakes118
-
Size
321KB
-
MD5
04ec142111c0cd9b81a60378ff57bd02
-
SHA1
a03619ccce5659f7bb1f0f2f889b3c8af3a97e79
-
SHA256
cb2d0a27892508cd7ae89a72d1b0a2b4625fd06226fb53c974374141ba5bd19e
-
SHA512
7936799219f6ac29e78dc194f5e0cc2e1a8e1d71316d53930e79920bea84657523679fb556ec5eed6625525c2abac3515fb506160540400046c543f7acedaade
-
SSDEEP
6144:m9yIdmFUI2yCPBWqxgJGAdyfijg/orcps1LZqJWWE+w:mrP7asAd1jggrcQtcWQw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/crsky_setup_ver_20120426.exe
Files
-
04ec142111c0cd9b81a60378ff57bd02_JaffaCakes118.rar
-
crsky_setup_ver_20120426.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.crsky Size: 317KB - Virtual size: 320KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 928KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
d9soft注释.txt
-
第九软件网.url