�b-�{]����'�M�F��t~��:e4��W^-�!}�����liwh$s8�쟽G#U���-^��l�0�Pd��o�S6��^>3B��Uݓ'FD^kWC7y�]�$���U ����&NكIl�i��qވ���\bo�l�N1�w�l@3(/�QY_ٹЩ8q%B�$*O��/ �no���mTL�N�Ѝ5{69�����ʠ$Nr:���H���i�r���`���Z����~F&p l��Y#U����t ��8(/9dAU�jo+�~�}�x�S}F*\ #Og'�=)Y�� {��Ƥ�$`�aR>�����jSŘH%�7M�����~⒪�Ź����)�*=gл��1a��߳��g����V| oY"*]R �'�����ti�7 �7I#MO*���)\�ضb|cۙn�L pZ�%y���*�eK����$`wt�Ќib[�E�<96�Ցuȿ���FP������������ܳ��;?V0⅙��l0H�vK�CQ�Aܘ#�<G��� ����|I�K�M}�'*�������㠊j�Q;2�d6���I�l��� 9�=�J8��(���Q���_��U���BjcG�B����ԟ/9��~]j��:����[K~`��T����G\��-4�裄��g�5�������T-��=`}f�d^�p��Y�:���'c�D�2�tK|���f*Y!wKRJ-�|��\���}����"�yW�*6�� ��;X-�xj%�B�9�C �zn'��41���0`2:��3�5_��"Dd���� Q~)JJ�s���To���� �i�ꋖM�1��[�����-$�?���* 65R�����l�7$��|���3e%��,]�(A��U{�4�C�ӧM[±j�G�la-G�����Ekd_�k�s\��%��qm~z�G����ܺ��O>�[�( g~WW`�1��â���zuFX�R����%������y����Qη�*^@��囈��y�,�g���j�����Ev^|f$&��`Ni�"��8��Ae�r/NM�~�XI�X�u�}�m�bH�$� g��v�,��f�G��w�@�����w?�ЋX��0۸��n|q|������Y���R����������P�U�-�Av��VJ�&B4Y��\�����}c:�Y��p?@�Y)Y��wS!1����j5YݐAv<��5gi��;�`Ȳ�P��c����K�lC�����T���:̖�ZVW�#�^���$��>�{��">��d�@0,��}��&eA��G1���mD:�1w��0yc�O~���L��Y�ENNZQ�~o�I0�?�%��'%gI��}7�"~���jt������8O��q̴�V�1Ȥ+=HfC]|����!��<������Ĕ?�>�yt>�k�=���e�K5�gHszk�N��V.��p���c]��G�#{�a��90�����+5���&�ȾJh��/� ��e��-`*z���c������1����,����L���)jQ�v匄Nۢ^h4��)���\�1$D<�u��A�T� ����12#J�۷�Z�B��|k}���j�#~���lG�6���4�� n�~K52P�����d���ˏo(�&d�¹�^Sj�eL���H87����@��g�f�Y��`�c==� <�a���x'��������y�Cᚮ��$�1��|Z��@%�#0�����������|W@����"}=}KX;�Sh��L��-�1�&}�5��[;6V�sv�(�-�e��M ����m���4����ֿ���Mq�Pu��^�&,�\���7��DL3^|�'b���;VP������܊�4� .�-�W]dd<����p@,���,!�y���!�-�O���;���N����0��8��}QyX'�w�Oq��-f�1�G�i?}���!�J��}�OW5?�j��!��Ѐl ��h��*�쬻75{�Pz��=ZXʒ]Y��C�e�%e���0z0䫡Pӄ�0ݖ���6����/��p�uJ�fB��h�x�ŋ�0��:=M�J]RqC�W S*��KV�FH��t�����`����A������ k|�������l�n���>��gr0(����6�<Z��RG�P��=�������<�J�Vj�rDž�wg)��$�lr����Q�����!�%&T_7�BrN�B}�9Q���؍d�t��V"�-xQ�u�1����z��̼%ڰ�!�Ƒ�Ai8���|`��$��U�`�06���� <sY� %7����e¸������j������Rl�+�E�H�k���cz :+}WZ9Ǖ��>ދ u|���Ԙ��,��v͚X���ڄ��=�m�"#��b��+��4d��+��v�j`����J�Lj�l�!�<酪��>��a����j�-���v�j����o�3K)$��w9iò�u!���Ax�9��㨠E��]:�,�/��,��v�[�cW&�V�q:D-;6��w �A��ͪ}R���m�T6��O#܅� ���Z��9fAg��ݨ�>R6�ːL+���h�R���>���bК��Z��O]�)W�̾���'�HL��9����8Auu��Y��v�ם{���<�J訌v㝱7���'u�y��m#C�t��dQ��'�X���.���w� h�s���9e��f����x�ǟ:�y�5آ�Ǝ���5� �ΰ ���#>���O���Ⱦ�v%��T4�L���Uկ9l��\��"d��6���|%��P � y)�'mTI��C����@kS�e�1���.CNy$(�a���Ғ�����f�ޱ�#a�D���Ҽ������4c���Wra����`=Q���t�h� ~�߆Aj^fh�y�5���/ ���d������4D��3��Ë �G���:����E}c�J��G���y��L�b�5�U��ؕ��K4������}u��W��]D��QL��Vwc;0���cB�qS������Y�ݱ��[�"#���T���B�~j ��c�i���f�D
Static task
static1
Behavioral task
behavioral1
Sample
河源下载站 - 打造齐全的绿色软件家园 - 绿色软件下载.url
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
河源下载站 - 打造齐全的绿色软件家园 - 绿色软件下载.url
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
飘零定位..exe
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
飘零定位..exe
Resource
win10v2004-20240508-en
General
-
Target
25d922f8a7c9a069e42aa61ecd9eea6d_JaffaCakes118
-
Size
1.2MB
-
MD5
25d922f8a7c9a069e42aa61ecd9eea6d
-
SHA1
c78b9300913646cb31225cd078e2cc75b673418f
-
SHA256
9656ba6196ef93498b2799b4ce0f84551acfb23c23a5a18ff95cdc0fd3465ad2
-
SHA512
86c02d7e2662142cac309669cb145bb67866aca9abef94ae7edce1cc01a1d9bbff6cccf203b577f1ba904a42837e254b08373aed1f1a7d7c3d767c4034cf02b4
-
SSDEEP
24576:W+DpwG8X9WNwTypuOgG0Lz+gml9wmPwSM3Gx3fouBx9nGa:W+wG8XYRURzDml9wm7voyxl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/飘零定位..exe
Files
-
25d922f8a7c9a069e42aa61ecd9eea6d_JaffaCakes118.rar
-
河源下载站 - 打造齐全的绿色软件家园 - 绿色软件下载.url.url
-
飘零定位..exe.exe windows:5 windows x86 arch:x86
d31a2033d6315eada9e8a7e7b770ee60
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
GetACP
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadCursorA
gdi32
CreateCompatibleDC
winmm
midiStreamStop
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
OleInitialize
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
ws2_32
recvfrom
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 411KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kuo0 Size: - Virtual size: 1007KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kuo1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ