Static task
static1
Behavioral task
behavioral1
Sample
使用说明.url
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
使用说明.url
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
极速软件下载.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
极速软件下载.url
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
网页挂机辅助器 V1.1_se.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
网页挂机辅助器 V1.1_se.exe
Resource
win10v2004-20240419-en
General
-
Target
0e1ad029bc888839649f02028653a006_JaffaCakes118
-
Size
1.3MB
-
MD5
0e1ad029bc888839649f02028653a006
-
SHA1
2f1654852d20acc293c592a4d5a5aec5285ea4e3
-
SHA256
81368e04eea0e00b6400e85bbf820fd938f615c951c5eed0ef5c868a71755419
-
SHA512
ad6032cd970ae7b113fc11cead3432c6a0465244b711f3857ff0f23cb4973efd6a287a8b526a309d61e231b683dbda767cf0076e30f63fd9ecd355aa93a63f9b
-
SSDEEP
24576:qIaUqh8wX4mQSZZq8HPEjQWA7PWf1B/J/0kXV4mc6Oo:9aUK8mJvvWAL41BhMkF4mbOo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/网页挂机辅助器 V1.1_se.exe
Files
-
0e1ad029bc888839649f02028653a006_JaffaCakes118.rar
-
使用说明.url
-
极速软件下载.url.url
-
网页挂机辅助器 V1.1_se.exe.exe windows:4 windows x86 arch:x86
ef2232272ee6446b7245126e0feac2ec
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetEndOfFile
user32
SetClipboardData
gdi32
GetClipRgn
winmm
midiStreamRestart
winspool.drv
ClosePrinter
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
CreateILockBytesOnHGlobal
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
oledlg
ord8
ws2_32
recvfrom
comdlg32
GetOpenFileNameA
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Sections
.text Size: 544KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 984KB - Virtual size: 984KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ