Behavioral task
behavioral1
Sample
《苍翼默示录:蔚蓝光辉》游戏附加工具+3/游戏大全.url
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
《苍翼默示录:蔚蓝光辉》游戏附加工具+3/游戏大全.url
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
《苍翼默示录:蔚蓝光辉》游戏附加工具+3/苍翼默示录 分辨率调节器.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
《苍翼默示录:蔚蓝光辉》游戏附加工具+3/苍翼默示录 分辨率调节器.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
《苍翼默示录:蔚蓝光辉》游戏附加工具+3/苍翼默示录 窗口化补丁.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
《苍翼默示录:蔚蓝光辉》游戏附加工具+3/苍翼默示录 窗口化补丁.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
《苍翼默示录:蔚蓝光辉》游戏附加工具+3/苍翼默示录.exe
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
《苍翼默示录:蔚蓝光辉》游戏附加工具+3/苍翼默示录.exe
Resource
win10v2004-20240426-en
General
-
Target
44c6bd46b35f9425785e83c0ececdec4_JaffaCakes118
-
Size
938KB
-
MD5
44c6bd46b35f9425785e83c0ececdec4
-
SHA1
0d6d090429de546d392f500d4a9ff4977413635f
-
SHA256
09fc391bf7ef87fcad31e84c78ad9070311dc582bc6b55d49319c74c140e9980
-
SHA512
5ddf48d343534589d4e5473e0ca6ea4b95d9641b980e4fdccc7872615f5bd592db622c5a138a8d8cda19e3c0d3272acba62419019dbd4a57b749f07174f87aca
-
SSDEEP
24576:sap7qd9rl6R3WrdIvB9cL12qXmhCp1braxFUgI:sI7qN6RGGv2sSmhCp1y41
Malware Config
Signatures
-
resource yara_rule static1/unpack001/《苍翼默示录:蔚蓝光辉》游戏附加工具+3/苍翼默示录.EXE upx -
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/《苍翼默示录:蔚蓝光辉》游戏附加工具+3/苍翼默示录 分辨率调节器.exe unpack001/《苍翼默示录:蔚蓝光辉》游戏附加工具+3/苍翼默示录 窗口化补丁.exe unpack001/《苍翼默示录:蔚蓝光辉》游戏附加工具+3/苍翼默示录.EXE
Files
-
44c6bd46b35f9425785e83c0ececdec4_JaffaCakes118.rar
-
《苍翼默示录:蔚蓝光辉》游戏附加工具+3/游戏大全.url.url
-
《苍翼默示录:蔚蓝光辉》游戏附加工具+3/游戏说明.txt
-
《苍翼默示录:蔚蓝光辉》游戏附加工具+3/苍翼默示录 分辨率调节器.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
text Size: - Virtual size: 556KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
data Size: 532KB - Virtual size: 536KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 86KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
《苍翼默示录:蔚蓝光辉》游戏附加工具+3/苍翼默示录 窗口化补丁.exe.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
text Size: - Virtual size: 124KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
data Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 83KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
《苍翼默示录:蔚蓝光辉》游戏附加工具+3/苍翼默示录.EXE.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 532KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 253KB - Virtual size: 256KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 86KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE