_����'����Oy[�t9��c�]���P�>:�t� �s�O��V)À*�b�O��U7Ɉ���#�-q�$���y�[�؏ (�C�0WٓhKZ; �e?q�{��ڐg�IX��������:�:q[<��2�ڈk�T����3���mpzZ)�-L����8���p��nX{S{��t�@WKt7�OZ�LM�٦����������k_��gv�4�Y#Е������U�g.��(�Ck�Q\Tk^�|d�L�A4�99�u-K���q���cP��bg�'F�(�P�M8�ÐB�D�2��;�W�?�T�ӗD~ţ�23� /��z} e�Tݿ���V����ӗ�3�F~��@q=��e�E��t4F0F��W�SCijp�ޥq�uȷ,�3]u��4�G����ښ{�'T4�s�����x`�-B2�� L�Hh�C�,K���E����o���:=��B���IS濯ߢ*��}.��@�=�V����>U�]���-��!���������)�m�k �}��0%����i�_���a�0r��ɺ� �Ii0���U>�%g�]8eI�" ]�҈$J�f��(Oո�\��k�Ə]�/iT56d��1��jߐSZ�(5g�����6=��+�kVi���Vh��:��c�n��u�4 �ѣ�B� �"l�mR��s�4�˻k}�H%��-bK����Rz|I��V��,-�:7=�n�8�3�۔)5��E�@yP�9����u���[Z!�4J^P X�Ұ��2%E�8��0ਨ��PV*afL]%���V��ئ8�]g0���N��o�QZ4�ݣ'���� ��`A��A����b��{�Vj\t�z�"T�mfqW���Xw{I��SM�6C�]�I��mjK矶�J>��Q�َ��!��˚�k�v��k`�K((eW�헺�اʴ]T�� ��ޘ[�>�@�����Rl�# 5i�BPe��8���d������p?��ݩ���Tq����6�fA��,���K&����4Ux�l�ܟ���0� ;D��E6��\ۯ�~��gq��ȕ����nc�ϔEJ���=K�]�lH��z蕹��}X �����n?BFy���'�ޒ�����=��WE�{���Jn�>�e��� +��ɇI�kp*gf;g*���ژ���Чk����Q�}/�~u�q�o�z�*��"��}m���n`�2� ��dI��ɛ%7#r�-sE)k=�$p.��{VU���h�9J�o�Ĝ{e8BH_����������a���+�ˢS����:.��`sv��9��76�Q;I�!�RF�-�E�>��i��bw1�Q�m�h�H:��+��RI����֣$DBF�,��s�������TWo� "�K$d/zIM%ّ��$%�*`@�]LK�� ��=��v[�eO,����y��}-\��nQ��?* t_��F4hv��7������(��|�D�:������8���%5����5�$Bs.�+�����1 ~�8����1)�����7��Ro�h������1������8Qή]�՝L�-w��ƽeh��ў�@P�K]���A�GZ��"�:3�vh�]ƙ���Iȯ�� ���1lk�CM������G�E6�;WR��I����g���q���b�<�B�3\�tg�m7�:��t�&R-�)I ��dτ:�y�V��b�� )T/bGa�����H)Z�?�t����k�¥60(� ���ϳ=�"&���� b��3)�k�;�%YuO.d��g&�䯷6ts-��)�5�R� ��͛���,��63���֨+ꯍ$!�� Og�V��?�E��J���(�I׃S<�K$ ���hl�+'���`1�Z;)���{��ѕ���8�Ys3'���*���A/|a�W� A�GN@�-i}s|8��W������N��� ��*<1��*<��:� V���4`P)�Ē��Q���X�S�����t�NI;�an�P<:�W�{�=͉�`Ar�Tvp�);֪���w�&��ʼn�u_��V�<�Mb$Jە�\�[�1?�h�}�/�ښ�� -W�s:�o�C�]��=_ �vh����U��E�9�!��I���v���C��#��u�.Ng���`op�����/�Blh�x�'*=�ZD��!� ������hO��v� *Ǽ��~,ic?��GUo%$�Eؿ2<Xg���L��]%���趒Ⴗml5�G�M��V���WGj^���3�0�eN�)\^���lY-�g!��DZБx���}�������Iʢ�#��-d�j���'�bs�`+�8�� _��e�߱t�x��_��*]\,���x�|c�N�U@� _��)�ɍX�1aj�L;�����G��v�i�����H�0����#a�b=�[���l�gt7" `[�zۑ�����������v���/��q�U�H-s�w��tWd��ϢA���H�t��ͪ�1gɾNg����i�W�<���%�>&���p��:^�a+���MD����V����x�2 ��/�6����=SP�R�'��������C|̍x!�,�zĖ����+m���sW�!��D��D"�y_����%x�f��8q.J&� ���f��b�� b��q����k����� �Q������o����쬙��y��^�4}-�bX� �MEϩ�"J��S^��G������Р�<����;#���W�"#8�m��]�l� �"'AD���gt)�*KV$ur���f��J�ۺ!��Uت��[�L<�c�^ o���_�'W�²1�R�EMP�i\�[��!�Go�Rc7����dm�V�*_H����`�P��Z;\�t{l�������<7��^����;�C���ť(�����~�y�\R����!��B��?pΣFP�A%�����ɳ]o����F�Tu�r#~<��딜]���`z��*�M�Y���<V̽8f����M(�{1L��w�gsǖ�x;�t���.���,�pU�l���������Y�B�r2x�x���v����c}�Ht��E"��n� ef*�|@��uq;�����S�pd�V
Behavioral task
behavioral1
Sample
IP批量测速.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
IP批量测速.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
使用说明.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
使用说明.url
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
极速软件下载.url
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
极速软件下载.url
Resource
win10v2004-20240426-en
General
-
Target
42a82d4fa03d2a6a64b7cdf3778e48d2_JaffaCakes118
-
Size
1.2MB
-
MD5
42a82d4fa03d2a6a64b7cdf3778e48d2
-
SHA1
6f6659de7e5dfdbf5dacb10b3be2c1a1a7966c12
-
SHA256
452e0fa9151386ed91abd2dd04e907373de0360e74facf63bb043ddc3f6ed9de
-
SHA512
ea9ebdf63865044355020868bdac0c0d67c928bef0ff4d5d0ca77ccaffa9803910067356fbe15af205029237afa5497749d47eb39862386401745a82b218d493
-
SSDEEP
24576:KUcfqoZsVVmL1oXsRaKErYNgucAJWGLGjvSqje2468UHOrx2:lwiV4L1oCgucAJ1LKSn1688
Malware Config
Signatures
-
resource yara_rule static1/unpack001/IP批量测速.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/IP批量测速.exe
Files
-
42a82d4fa03d2a6a64b7cdf3778e48d2_JaffaCakes118.rar
-
IP批量测速.exe.exe windows:5 windows x86 arch:x86
039c44fd20fd837066ab2cadd99c2814
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindResourceExA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadStringA
gdi32
SelectObject
winmm
midiStreamProperty
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
CoCreateInstance
oleaut32
VariantChangeType
comctl32
ord17
ws2_32
WSAStartup
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 474KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 181KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 801KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
使用说明.url
-
极速软件下载.url.url