Behavioral task
behavioral1
Sample
随时随地GIF/随时随地GIF.exe
Resource
win7-20240704-en
General
-
Target
2e89cedc7dd17533d54e895d8c21548b_JaffaCakes118
-
Size
134KB
-
MD5
2e89cedc7dd17533d54e895d8c21548b
-
SHA1
d4c88e884c0069130424ac5e7748a4defb8cb76a
-
SHA256
382088f0c7ffd2e5169338c22ed6494600f7a8aa583fc63948a95b91420a75da
-
SHA512
e7cace7b25957179ab78c66728fac09e61fcf93e0988d18f945a81dadd728cac2be17188bcec3a4d09eda79e13d826e39c8d397fa28c8f4fce43436f7478bf12
-
SSDEEP
3072:03NqNZbyTLWsmnB5lrYMRGswc7ur8khHVAgI+o1ABVsKaKTKh7mR:ioQ27XwseidAESKkR
Malware Config
Signatures
-
resource yara_rule static1/unpack001/随时随地GIF/随时随地GIF.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/随时随地GIF/随时随地GIF.exe
Files
-
2e89cedc7dd17533d54e895d8c21548b_JaffaCakes118.rar
-
随时随地GIF/22.txt
-
随时随地GIF/23.txt
-
随时随地GIF/24.txt
-
随时随地GIF/irunin.bmp
-
随时随地GIF/irunin.dat
-
随时随地GIF/irunin.ini
-
随时随地GIF/irunin.lng
-
随时随地GIF/注册.rgs
-
随时随地GIF/随时随地GIF.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 176KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 114KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE