Static task
static1
Behavioral task
behavioral1
Sample
TBL互转XML工具.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
TBL互转XML工具.exe
Resource
win10v2004-20241007-en
General
-
Target
26592227587c0549535ad31086dac77b_JaffaCakes118
-
Size
1.1MB
-
MD5
26592227587c0549535ad31086dac77b
-
SHA1
6a750091365a54f4019e3f118d4b9c33c20cbc58
-
SHA256
9a970162e1388b6b64bcdf6e985d2a27a06ae7e4b2b63da9324ea45686634260
-
SHA512
0784473c6344a4bf2b608570d6f68222463bd40c4f1523b6a1b96c68dc9435726fca55743929e80bafb304bac8202bc61a00054980d263d6b9e7ab82c3c57628
-
SSDEEP
24576:q0zyi7uOT8lQdYY8dHq1hQhAdgIL/XN1hjuQ+wDF2:HIldKMhA+IL/XN1Z3+M2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/TBL互转XML工具.exe
Files
-
26592227587c0549535ad31086dac77b_JaffaCakes118.zip
-
TBL互转XML工具.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
nsp0 Size: - Virtual size: 292KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nsp1 Size: 151KB - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE