d:\dk\rwm\objfre_wxp_x86\i386\rwm.pdb
Static task
static1
Behavioral task
behavioral1
Sample
qqfcxgjqrwqbfz_gr/superec.ProcessMemory.sys
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
qqfcxgjqrwqbfz_gr/superec.ProcessMemory.sys
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
qqfcxgjqrwqbfz_gr/性感剧情强喷.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
qqfcxgjqrwqbfz_gr/性感剧情强喷.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
访问零度软件园获取更多资源.url
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
访问零度软件园获取更多资源.url
Resource
win10v2004-20240426-en
General
-
Target
0b5f3a94bc74347d3a518cad0571c71d_JaffaCakes118
-
Size
1.1MB
-
MD5
0b5f3a94bc74347d3a518cad0571c71d
-
SHA1
d1698958f6b364d123ba7fccb3142c87b1e3d455
-
SHA256
63fe9ea686fc912f1aa350e61cb5e92dddf9946fb2a7a0e221d8e93a41041c4a
-
SHA512
a850b578178d6dac4631b6269b2c351d6198028935cdfbc1d22e538696d16920a58e676bd8ed51b66b4ceebb7a447fd10bf39eabde7d0e169dc77884a48adaa8
-
SSDEEP
24576:GmT5crw/iB0BDsFQs3D0TkMjzoU7j8Dql+xBM/NmmKSALkRL6Jrbw1kTg:GmT5x/i1FQsz09zv7Ku+813/ALkRL6Bk
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/qqfcxgjqrwqbfz_gr/superec.ProcessMemory.sys unpack001/qqfcxgjqrwqbfz_gr/性感剧情强喷.exe
Files
-
0b5f3a94bc74347d3a518cad0571c71d_JaffaCakes118.rar
-
qqfcxgjqrwqbfz_gr/superec.ProcessMemory.sys.sys windows:5 windows x86 arch:x86
790a705bb6e01a5ec06e60aeca34cb54
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
DbgPrint
ExFreePoolWithTag
KeUnstackDetachProcess
ProbeForRead
KeStackAttachProcess
ExAllocatePoolWithTag
PsLookupProcessByProcessId
_except_handler3
ProbeForWrite
MmIsAddressValid
IoDeleteDevice
IoDeleteSymbolicLink
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
KeTickCount
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 640B - Virtual size: 554B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
qqfcxgjqrwqbfz_gr/性感剧情强喷.exe.exe windows:4 windows x86 arch:x86
207028e56c9e7ea17cfa0fd4ad3b6915
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSAAsyncSelect
kernel32
MultiByteToWideChar
user32
IsIconic
gdi32
GetTextMetricsA
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
VariantChangeType
comctl32
ord17
comdlg32
ChooseColorA
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Sections
.text Size: 372KB - Virtual size: 880KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 984KB - Virtual size: 984KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
访问零度软件园获取更多资源.url
-
重要说明@www.05sun.com.txt