eeb04e18280b5027f1c299f3b1780961_JaffaCakes118
- SHA256 02cb95700440b100604ece78649b2ef41b2b7ea8ff68afbb02a01148a3f7c106
Password
infected
Overview
overview
10Static
static
35F9F8AC1F7...D_.doc
windows7-x64
45F9F8AC1F7...D_.doc
windows10-2004-x64
16B97B3CD2F...et.exe
windows7-x64
16B97B3CD2F...et.exe
windows10-2004-x64
3901FA02FFD...ar.dll
windows7-x64
3901FA02FFD...ar.dll
windows10-2004-x64
3C116CD0832..._2.exe
windows7-x64
10C116CD0832..._2.exe
windows10-2004-x64
10PlugX_3C74...20.dll
windows7-x64
10PlugX_3C74...20.dll
windows10-2004-x64
10originalfi...ae.rtf
windows7-x64
4originalfi...ae.rtf
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5F9F8AC1F749B0637ECA6EF15910BF21_~WINWORD_.doc
Resource
win7-20241023-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
5F9F8AC1F749B0637ECA6EF15910BF21_~WINWORD_.doc
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
6B97B3CD2FCFB4B74985143230441463_Gadget.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
6B97B3CD2FCFB4B74985143230441463_Gadget.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
901FA02FFD43DE5B2D7C8C6B8C2F6A43_SideBar.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
901FA02FFD43DE5B2D7C8C6B8C2F6A43_SideBar.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
C116CD083284CC599C024C3479CA9B70_2.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral8
Sample
C116CD083284CC599C024C3479CA9B70_2.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral9
Sample
PlugX_3C74A85C2CF883BD9D4B9F8B9746030F_DW20.dll
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral10
Sample
PlugX_3C74A85C2CF883BD9D4B9F8B9746030F_DW20.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral11
Sample
originalfile/PlugX_RTF_dropper_42fba80f105aa53dfbf50aeba2d73cae.rtf
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral12
Sample
originalfile/PlugX_RTF_dropper_42fba80f105aa53dfbf50aeba2d73cae.rtf
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target eeb04e18280b5027f1c299f3b1780961_JaffaCakes118
- Size 708KB
- Sample241230-yk1f8awkfk
- SHA256 02cb95700440b100604ece78649b2ef41b2b7ea8ff68afbb02a01148a3f7c106
- MD5 eeb04e18280b5027f1c299f3b1780961
- SHA1 4361de0fb7aa2a1f15acd4396a7e1e3a34ff4fc2
- SHA512 14ad36c1de37272156ed8ab8939c516aca2ab884a206cc372c79253298157d2152df79623ac6f79deee6948665ff7f7376a6776ccee4c8c065fef5eeff858e35
- SSDEEP 12288:Iaryqj09i0K3hqGRkyRZ2QSuB38ERqtxS9g2GZb0RJs89F+/dClI3PavIiCVU:vNPOGPLPx8E0xSK2mb0n9F+8lIYIdK
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/901FA02FFD43DE5B2D7C8C6B8C2F6A43_SideBar.dll_ unpack001/C116CD083284CC599C024C3479CA9B70_2.tmp_ unpack001/PlugX_3C74A85C2CF883BD9D4B9F8B9746030F_DW20.dll_
File Explorer
-
eeb04e18280b5027f1c299f3b1780961_JaffaCakes118.zip 708KB
-
3BC9E9B78AC6DEE1A44436859849BBBF_NvSmart.hlp_336B
-
5F9F8AC1F749B0637ECA6EF15910BF21_~WINWORD_.doc 507KB
-
6B97B3CD2FCFB4B74985143230441463_Gadget.exe_.exe 25KB
-
901FA02FFD43DE5B2D7C8C6B8C2F6A43_SideBar.dll_.dll 41KB
-
97C11E7D6B1926CD4BE13804B36239AC_SideBar.dll.doc_121KB
-
C116CD083284CC599C024C3479CA9B70_2.tmp_.exe 225KB
-
FC88BEEB7425AEFA5E8936E06849F484_~$INWORD_162B
-
PlugX_3C74A85C2CF883BD9D4B9F8B9746030F_DW20.dll_.dll 228KB
-
originalfile/PlugX_RTF_dropper_42fba80f105aa53dfbf50aeba2d73cae.rtf 507KB
3BC9E9B78AC6DEE1A44436859849BBBF_NvSmart.hlp_
- SHA256 bc69193b3ad89620c480fcfc1cea2c62d82eba217e666d33d2d020428740d526
- MD5 3bc9e9b78ac6dee1a44436859849bbbf
- SHA1 64bef5334770f0a5ea444c07c0a8c9631d6f589d
- SHA512 5230fb293a5778466382c6cbc922837c67143bde6c1565f6c00da416254b23da5d17c00dbc8d746a41cef23f4f1f09996541e6735c749070aeb415494252f2a3
- MD5 SHA1 SHA512
5F9F8AC1F749B0637ECA6EF15910BF21_~WINWORD_
- SHA256 593e4acae0c1e2a708cf986adfd0f4e59ec356c1031a97a65a87404943da94ff
- MD5 5f9f8ac1f749b0637eca6ef15910bf21
- SHA1 dae74fc73f98b3b9b6fd094ae512b71e499e3eb5
- SHA512 6b54f42a83797f332146a9c46a2ec48bc1f00bdfde6f2ff4254ec337a7f6e46d4105ee6f9bf487929323df97f3d633ce2ccbb15866d46482fc1aeaebe14b9d08
- SSDEEP 96:TAy6k2M3jwlgNqvoMhx4FAcx4AmGLGQSrWWWuHMIkJMbRVPkMJbxjz8MwKz:srM3jwK8vIfxDqQSfhkJmPkMxw
- MD5 SHA1 SHA512 SSDEEP
6B97B3CD2FCFB4B74985143230441463_Gadget.exe_
- IMPHASH ba47a0478b3cdd3b7d2c2438b409a2ca
- SHA256 5c859ca16583d660449fb044677c128a9cdedd603d9598d4670235c52e359bf9
- MD5 6b97b3cd2fcfb4b74985143230441463
- SHA1 8985c2394ed9a58c36f907962b0724fe66c204a6
- SHA512 736631b2ca37426c3915f496d5c3abdac23ffa91bd90fd8b215be2ad8735403ff9d58d1effe6791fa34a72141a5218f19808c0c4ece4100a525adbdeea4c1715
- SSDEEP 192:HULB0P1oynsSW42fyu335/wJirNmL/8Qpkqs1Iu55+ebCfN54U6Gn:0Fa1GwK3mirILu1vPbCzvn
- MD5 SHA1 SHA512 SSDEEP
Password
infected
PE Signature issue
Digest
58:d5:54:1d:d0:f8:28:1a:46:06:eb:ef:1f:71:3e:52:19:fb:3f:21
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN
Chains
Jul 16, 2012
Subject
CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US
Serial Number
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 1, 2012 - Dec 31, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Serial Number
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
May 21, 2009 - May 20, 2019
Subject
CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN
Serial Number
5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Issuer
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 26, 2010 - Jan 25, 2013
Minor OS version
0
Major OS version
4
Entry point
4148
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleHandleA
GetStartupInfoA
msvcrt
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_XcptFilter
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_exit
_adjust_fdiv
Name
.text
Size
4KB
Virtual Size
460B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
530B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
92B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=11, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=14, version=7299,
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=3, id=93, version=2179,
count=20, id=1, productName=Unmarked objects,
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
901FA02FFD43DE5B2D7C8C6B8C2F6A43_SideBar.dll_
- IMPHASH bb448859beafb6b8d042ede3358ffd0b
- SHA256 3144079c68ba00cebfd05239a2f5bd406096ec02e13e8571ca24313df7a5b679
- MD5 901fa02ffd43de5b2d7c8c6b8c2f6a43
- SHA1 8bb71adf1c418061510c40240852c3cd61fb214c
- SHA512 6500b1a0e1a5995226bfcdaf1a33867bd9ccd5b84552db73f46dc1ee44461dbb29de6d16e8bf0da0c56d15ea60a4f44f105d005de139924ecb46d274cce90bab
- SSDEEP 768:fQ+il+psGX0QEohGEVZ/E2G7k14rQMRkoIQ:fxiYVjE4VZ/ZWRkoI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
5
Entry point
5086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
Sleep
ReadFile
GetModuleFileNameW
CreateFileW
GetLastError
VirtualAlloc
GetModuleHandleA
lstrcatW
VirtualProtect
CloseHandle
GetSystemTime
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapFree
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
HeapReAlloc
WriteFile
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
HeapSize
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=25, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=72, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=81, id=1, productName=Unmarked objects,
count=3, id=138, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
97C11E7D6B1926CD4BE13804B36239AC_SideBar.dll.doc_
- SHA256 a13161d957ef1bf6362cbc488a82ffca8f6f52f48143f1110616b9c540e5997a
- MD5 97c11e7d6b1926cd4be13804b36239ac
- SHA1 b388b86a782ae14fee2a31bc7626a816c3eabc5a
- SHA512 8ee3c39651b8d5790750436d04178e0d124c6573f1f773265349683635047a8f1adc34195f1a58001e96c57da3d3504a86026d3165a832117f10e9ebb233a121
- SSDEEP 3072:HLIKbEN2HSKjZNPH4cGHk51Kk+u5arueqFl8sLT:HkKgN8/RH4hHk5gUUYFl8o
- MD5 SHA1 SHA512 SSDEEP
C116CD083284CC599C024C3479CA9B70_2.tmp_
- IMPHASH 400757684d81dfa07d0c4dc56a3b115b
- SHA256 90a5c1c5dc2278063478fbc8f2ac072ccf0489d7b3f81a6ed35b7d712b4b7b84
- MD5 c116cd083284cc599c024c3479ca9b70
- SHA1 bf831962162a0446454e3e32d764cc0e5daafde0
- SHA512 d89ac7d971e46ee67f6857a71d3712205d28170320386a83d9cdbda97d270626cf2a0e91e0b866d368c65eb3e47766c20c07a2baeb51feb3fe7b8d98d848e560
- SSDEEP 3072:hb2V38tdLIKbEN2HSKjZNPH4cGHk51Kk+u5arueqFl8sLbxDZxWRko5V:hbvkKgN8/RH4hHk5gUUYFl8UmT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
5278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CreateFileW
GetLastError
WriteFile
CloseHandle
CreateProcessW
WaitForSingleObject
GetCurrentProcessId
CreateMutexW
GetTempPathW
ExitProcess
Sleep
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
GetProcAddress
GetModuleHandleA
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
user32
wsprintfW
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
191KB
Virtual Size
202KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=16, id=125, productName=VS2005 build 50727, version=50727,
count=24, id=110, productName=VS2005 build 50727, version=50727,
count=75, id=109, productName=VS2005 build 50727, version=50727,
count=5, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=85, id=1, productName=Unmarked objects,
count=2, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
FC88BEEB7425AEFA5E8936E06849F484_~$INWORD_
- SHA256 1affee2a7a8d587184faaf2e3a21754b6bbaccbf357c0aa61c8586b19f2b284f
- MD5 fc88beeb7425aefa5e8936e06849f484
- SHA1 3df841579c383f0fb02b30ba4958add6d43216a9
- SHA512 d01f99363cb0c88caa739cb17626020009f92de82c642f5244c221c0352d20f35c304893dc2b3f0f2cdf59eb89a54411dc47766d5ef1bbdc5a0ab00ad4f3e293
- MD5 SHA1 SHA512
PlugX_3C74A85C2CF883BD9D4B9F8B9746030F_DW20.dll_
- IMPHASH 805dd25d70365d5930886e246ee8d13a
- SHA256 66bca3f92841b7bffae4d27c3ddb5adbf8084ad40ee0edda1edc1d25f5e1b967
- MD5 3c74a85c2cf883bd9d4b9f8b9746030f
- SHA1 40541a03e910b21df681bec69cfe59678ebba86c
- SHA512 15ab0c68e1dc8f5dc87231942f008228fe658ce221efe0ba90dfbfedea7e9cf401cac37098674a1d7cd489c97d061b847f09b86c24453575e2d46d4d9326e29c
- SSDEEP 3072:Y3Bb2V38tdLIKbEN2HSKjZNPH4cGHk51Kk+u5arueqFl8sLbxDZxWRko5V:YRbvkKgN8/RH4hHk5gUUYFl8UmT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
CreateFileA
DeleteFileA
ExitProcess
FreeLibrary
GetModuleFileNameA
GetTempFileNameA
GetTempPathA
ReadFile
SetFilePointer
WinExec
WriteFile
DoWork
Name
.text
Size
512B
Virtual Size
424B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
419B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=18, version=8444,
count=16, id=19, version=8078,
originalfile/PlugX_RTF_dropper_42fba80f105aa53dfbf50aeba2d73cae
- SHA256 ac7d02465d0b1992809e16aaae2cd779470a99e0860c4d8a2785d97ce988667b
- MD5 42fba80f105aa53dfbf50aeba2d73cae
- SHA1 a49b135a66afba5713936d4758ca5d40f19b9e71
- SHA512 b42b529585da21bae4d36fb1e9b5f2471e77d87505db91f8859068816d355fdd8b4aaaa922512a8a39259b247b9aeaeba92cfb0ab5140122f83dd163b8ed00cf
- SSDEEP 6144:h5LReC+jODUJ6aCujPjtNbShm6YNYa2Zg3:h5o3jOU6aCCtw8p
- MD5 SHA1 SHA512 SSDEEP