Static task
static1
Behavioral task
behavioral1
Sample
Readme-说明.htm
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Readme-说明.htm
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
rmclock.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
rmclock.exe
Resource
win10v2004-20241007-en
General
-
Target
3ae2d3a0190e9eb2a0952cfc7aa2237c_JaffaCakes118
-
Size
349KB
-
MD5
3ae2d3a0190e9eb2a0952cfc7aa2237c
-
SHA1
a5494994f0e7ad0591ebdcabad6ea06ab81f58c8
-
SHA256
6bfc8b0914092b01fb3378c7a830b3667e1aabfe9134e8f954cf724d92cc8820
-
SHA512
9953e9d2622485770cefeb4ef8555fc082d0d5f8ebb95c637956a1845db516c78fb53a7d402a73e66640f844ac0dc56cd60df857b1f9bf18f612c1d94c685cf0
-
SSDEEP
6144:gqXJz06rFi/4qHfGemFqqx5ZTKBUyC/2ceNt1vrAawJt2K1JbPE3l1k26ZHk:ZB06whHAqqruUyC/2cw1eOK1eHk2n
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/rmclock.exe
Files
-
3ae2d3a0190e9eb2a0952cfc7aa2237c_JaffaCakes118.rar
-
Readme-说明.htm.html
-
rmclock.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 54KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 10KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 111KB - Virtual size: 260KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�H�٢� Size: 224KB - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
rmclock_tweaks.reg
-
rmclock_wipeout.reg
-
该软件介绍说明及注意事项.txt