C:\Users\Administrator\Desktop\Client\Temp\yskQFHAcsH\src\obj\Debug\BinaryArr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
538375308232021.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
538375308232021.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Container ETAbest offer 8796___pdf.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Container ETAbest offer 8796___pdf.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
微信图片_20181017153614.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
微信图片_20181017153614.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_701893f05fb7f11f4f0bbbc6b7f4c540e4c8d5e5d5cd98d42db973fb89eaed0a
-
Size
2.1MB
-
MD5
4702a1f882fe8a673d76ebd14b1822ab
-
SHA1
44f28a56afd251d62676665469b8da86d0b94694
-
SHA256
701893f05fb7f11f4f0bbbc6b7f4c540e4c8d5e5d5cd98d42db973fb89eaed0a
-
SHA512
bf22cfc8b8f8643cb591e6c2ada0134265f01b0eb880fc4f80ff69a98269da571aed46e9e71bbfdeeb438b5bee647bb820583bca964fb92378cbe489295cd9ce
-
SSDEEP
49152:h2YfqQHRPrfGKAI8OPRrjK6ZFy1A/fYwRoBzER:smHTfGzSPxO6Ztf1gzER
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/538375308232021.bat unpack001/Container ETAbest offer 8796___pdf.exe unpack001/微信图片_20181017153614.bat
Files
-
JaffaCakes118_701893f05fb7f11f4f0bbbc6b7f4c540e4c8d5e5d5cd98d42db973fb89eaed0a.rar
-
538375308232021.bat.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 850KB - Virtual size: 850KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Container ETAbest offer 8796___pdf.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 749KB - Virtual size: 748KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 291KB - Virtual size: 290KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
微信图片_20181017153614.bat.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 903KB - Virtual size: 902KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ