114e82709e16d46049620b86a3e2118e_JaffaCakes118
- SHA256 2ebdfcb987b13f1f8de078e29d4f870a65281ea176f920e0c370bef08d815382
Overview
overview
3Static
static
3TF卡修�...��.exe
windows7-x64
1TF卡修�...��.exe
windows10-2004-x64
1TF卡修�...wg.exe
windows7-x64
1TF卡修�...wg.exe
windows10-2004-x64
1�...̨.url
windows7-x64
1�...̨.url
windows10-2004-x64
1�...��.url
windows7-x64
1�...��.url
windows10-2004-x64
1�...��.url
windows7-x64
1�...��.url
windows10-2004-x64
1�...��.url
windows7-x64
1�...��.url
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
TF卡修复工具 V1.0 官方版/tf卡修复工具.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
TF卡修复工具 V1.0 官方版/tf卡修复工具.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
TF卡修复工具 V1.0 官方版/wg.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
TF卡修复工具 V1.0 官方版/wg.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Ա-Աƽ̨.url
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Ա-Աƽ̨.url
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Ϸ.url
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Ϸ.url
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Ϸ.url
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Ϸ.url
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
.url
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
.url
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 114e82709e16d46049620b86a3e2118e_JaffaCakes118
- Size 932KB
- Sample240504-dggvgsee65
- SHA256 2ebdfcb987b13f1f8de078e29d4f870a65281ea176f920e0c370bef08d815382
- MD5 114e82709e16d46049620b86a3e2118e
- SHA1 aad0f8a2e92dc09990b919b72e652c508a1e76f7
- SHA512 53bdd3c8b066b41779c3532f915a579abd0aa0d24fe27aa1b1541722ad7e3284c121cb7abb43312c2d4cd8488e56aa7bbfb90ada0aa46459bcd422d05ba4d522
- SSDEEP 24576:2DxMsZsN29VEa+HQpi0SDnXBAH3znePuksPgjf:2DxRZspHbBsaPuTM
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/TF卡修复工具 V1.0 官方版/tf卡修复工具.exe unpack001/TF卡修复工具 V1.0 官方版/wg.dat
File Explorer
-
114e82709e16d46049620b86a3e2118e_JaffaCakes118.zip 932KB
-
TF卡修复工具 V1.0 官方版/config.dat6B
-
TF卡修复工具 V1.0 官方版/id.dat2B
-
TF卡修复工具 V1.0 官方版/tf卡修复工具.exe.exe 24KB
-
TF卡修复工具 V1.0 官方版/wg.dat.exe 983KB
-
ʹ˵.txt674B
-
Ա-Աƽ̨.url.url 302B
-
Ϸ.url.url 228B
-
Ϸ.url.url 224B
-
.url.url 166B
TF卡修复工具 V1.0 官方版/config.dat
- SHA256 7b35ee715003d495cc7894ec1da78e564e175c5c6cbffcbe6bdaa99c9f31c85e
- MD5 48e3638295c76ad04159fcbecb03cd40
- SHA1 d946ccdacef9f1f03f8fa5a5933e19d7cb70fa35
- SHA512 e47f40c440de34b4d4da9c9e5518adbd41a21080029a66541b7eab9b89891776d24a6c423e9d9cb2f5d4c50000d7ca38d9d5d421c0ab163d5e43db359c8bc468
- MD5 SHA1 SHA512
TF卡修复工具 V1.0 官方版/id.dat
- SHA256 8541c2d149faea7b7e534fcd56f5d352c7ed5a620d81394c002a17f07e18a567
- MD5 114d6a415b3d04db792ca7c0da0c7a55
- SHA1 e6c9da68beda1baa33e998a7f83f1323a3a5ecef
- SHA512 b2f252eb5522510b283258fcc0a95bffc01e2f9d2a94e77efc57ff7732aa6985b92b97c7b794185f0ac76780c3bffcbeb8add640b7cee9c11c53be9d205d7db8
- MD5 SHA1 SHA512
TF卡修复工具 V1.0 官方版/tf卡修复工具.exe
- IMPHASH 9b628b39a8fba084f05e273a9feee901
- SHA256 6cd950f736ba13cbc3276569b984d922451e7f0238663185dcb74698034e2a06
- MD5 96789a9b23f57699914216e9800a3087
- SHA1 e41abd0a07077e21f1d42af384dfa22d77ec2a66
- SHA512 f8b6928102afdf64082e0368524342343d2152c1c1d0d3fce390ae63d280cc80e564c46236cfc492f4545f1f608ed0acbd50c9e32f747026d2afa7e069309651
- SSDEEP 384:5wYkASm/Q1m6jfnvY5t12a0omN1h+YCsnvTqVWM:5XnWjPvY5tozzh+YNnvTqAM
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9439
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mfc42
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord2982
ord3147
ord3259
ord6059
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord825
ord815
ord2818
ord2621
ord1134
ord1199
ord1247
ord1576
ord3229
ord1168
ord860
ord939
ord535
ord5204
ord5808
ord540
ord5353
ord533
ord5194
ord798
ord6392
ord537
ord800
ord690
ord4465
ord389
msvcrt
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_onexit
__dllonexit
??1type_info@@UAE@XZ
fopen
fgets
strstr
fclose
_mbsrchr
strrchr
strcat
_mbschr
sprintf
_mbscmp
atol
strcpy
memset
strlen
memcpy
_setmbcp
__CxxFrameHandler
kernel32
GlobalAlloc
CloseHandle
WaitForSingleObject
CreateProcessA
DeleteFileA
CreateDirectoryA
GetCurrentThreadId
GetTempPathA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetModuleFileNameA
GetLastError
CreateEventA
GetModuleHandleA
GetStartupInfoA
RemoveDirectoryA
user32
PostMessageA
wsprintfA
MessageBoxA
ole32
CoInitialize
wsock32
ioctlsocket
iphlpapi
GetAdaptersInfo
wininet
InternetCrackUrlA
shlwapi
SHSetValueA
Name
.text
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=12, id=93, version=2179,
count=1, id=11, version=8047,
count=3, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=3, id=4, version=9782,
count=121, id=1, productName=Unmarked objects,
count=6, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
TF卡修复工具 V1.0 官方版/wg.dat
- IMPHASH a24e57cfb1e35030a9b4252bf1fa8b4b
- SHA256 9b64bdeaeacf9f46540aa4fbc8422d3eec2c412ba696a435fa45c2cdefd0f3a0
- MD5 bd3f9e17a919be6aae856ca11e61535d
- SHA1 7d4c55c1202c04fcf44b2110813662a700e6e462
- SHA512 202d9ea7a07a2cfce944b38941bb46056b88b2b551ae8b06638bf5f05843e5dda839c7ab9d4fdba65b0e3629ef4e316d14c565b66e6a559267d3b9e2b516cd55
- SSDEEP 12288:SvfyIIIzAClE7uDOch+h2ul/mJoe7sXV2PSdD7z500WzVc5ld3MqzpBSQYu76:esSzlEqF+hVcOFX4wfza0T5ld39LvYG6
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7581
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
lstrcmpiA
lstrcpyA
lstrlenA
_lclose
RemoveDirectoryA
DeleteFileA
GetModuleFileNameA
_lread
_llseek
_lopen
GetDiskFreeSpaceA
SetCurrentDirectoryA
CreateDirectoryA
GetFileAttributesA
lstrcatA
GetTempPathA
GetCurrentDirectoryA
_lwrite
_lcreat
CloseHandle
GetExitCodeProcess
CreateProcessA
ExitProcess
TerminateProcess
GetCurrentProcess
HeapFree
HeapAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
RtlUnwind
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
WriteFile
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
user32
TranslateMessage
DispatchMessageA
PeekMessageA
MsgWaitForMultipleObjects
wsprintfA
LoadCursorA
SetCursor
MessageBoxA
Name
.text
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=11, version=8047,
count=20, id=14, version=7299,
count=58, id=10, version=8047,
count=5, id=19, version=8034,
count=94, id=1, productName=Unmarked objects,
count=3, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
ʹ˵.txt
- SHA256 bcaa06655b67f26feb0b0fe6e9ee2c0010e7912b052f755ee644cb9d2d5be2bc
- MD5 6ba31597e0acdff7c53fdfac8bef41b3
- SHA1 ad3336a1127f960e8c474afa7aff0f26a583b3d1
- SHA512 19bb0a59b9f9f3c82b2ea788501ecafb217a8d1619478c9f7515d9f3084551f953fd2d15d2bce2cebbad398eb7799b8e39d6720ad3dd78620147fc6d4998b358
- MD5 SHA1 SHA512
Ա-Աƽ̨.url
- SHA256 fbaead7427b07b209cb8296068cf61eda704cc97d888c1b25783e681ae3070a3
- MD5 7734703db32e0951c459f1be7b00f077
- SHA1 ff2d30a9ec5c26619258a00f237d6c4e5be3df41
- SHA512 0d4fb3b56fceaf51c1526a396dbdbc761041bf5c5e6235cd662fd2f5690d031197c5102a78e4ff252c35d80df7bd84e17a5bfcf01f8f3433f5ef7b7e0ab445c4
- MD5 SHA1 SHA512
Ϸ.url
- SHA256 dfb9c9412d72cf819b051061732c355713d0c283f51ccaf165488c77fe081bb9
- MD5 e95c87f2bdf77e6e3299bbcc71ae8c4d
- SHA1 e269e293151c08553ffe618cde2bf3b5954e6c2f
- SHA512 698d871af5aab804274dbcc6e2d952618449b047d39fd1418a03c25be6b8510c28e684416ac0b2ff23e4e73b9b69ccaf1a941e13a29c06e9cf2742fcd7860fcf
- MD5 SHA1 SHA512
Ϸ.url
- SHA256 da168910bbb70dee659e5ff8084f1c1a04441e015810c7d11ad2141f736226a6
- MD5 ff1fa0b06d05b692d8351127181c865b
- SHA1 3a746adbee67fb7e4261e257dc40492b76f2f17e
- SHA512 a2f2ac176a04e22016ee4bad78ca2266aa392e52ba51f00d3c31eac05c6602b88b4fc2075cf65ed05e0d4538f1ef48eb43c44ffd9d04e47953ca1a985f2d3660
- MD5 SHA1 SHA512
.url
- SHA256 dd1605f5368d5723fbfb82323e83a9b0689f3255edb59f1bd35a3a36d792ce1a
- MD5 55fe5639dba8e4bf131858c26f64c601
- SHA1 1ae2632df820c052648cc9fde4d486902081b6b0
- SHA512 856c44167ef16d115c0dc486fa78e4e6a2d77234f4991bd8db496d34f6c3ef2a3ec50ea436a8ac91a4652d22ab5bb67a7552721782687afee82c7a2b041c5afe
- MD5 SHA1 SHA512