Behavioral task
behavioral1
Sample
svhitsa.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
svhitsa.exe
Resource
win10v2004-20241007-en
General
-
Target
b4b8368d6d524f70a91dcdab4db707f0_JaffaCakes118
-
Size
5KB
-
MD5
b4b8368d6d524f70a91dcdab4db707f0
-
SHA1
15734e26de0723d7caba733f47c22c5c713cac72
-
SHA256
d014fe2e7f352ab44ad2a92dfeaec304e3d0aea22dab6c86c185dd96dbe20b0f
-
SHA512
3738d0b8370f04cf514a1a41fe21c489309f61c65816a705fdf2d684d05528329763c48208a829e1c98b1dccb8ed85b4754dd66611245ccb0e331672d5a65a80
-
SSDEEP
96:VIZVrD7N6Ox/lqwMr5cICP86pzoxl0vAY2NRCEgtrZrg/SGr4YVO8afqspzA1A:aZy6/lDmGICk6p8xuV2SEMrZMBssO8iF
Malware Config
Signatures
-
Detected Xorist Ransomware 1 IoCs
resource yara_rule static1/unpack002/out.upx family_xorist -
Xorist family
-
resource yara_rule static1/unpack001/svhitsa.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/svhitsa.exe unpack002/out.upx
Files
-
b4b8368d6d524f70a91dcdab4db707f0_JaffaCakes118.7z
-
svhitsa.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 988B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE