Overview

overview

3

Static

static

3

回天一�...71.dll

windows7-x64

3

回天一�...71.dll

windows10-2004-x64

3

回天一�...es.dll

windows7-x64

3

回天一�...es.dll

windows10-2004-x64

3

回天一�...z2.dll

windows7-x64

1

回天一�...z2.dll

windows10-2004-x64

1

回天一�...dk.dll

windows7-x64

1

回天一�...dk.dll

windows10-2004-x64

1

StringIO.pyc

windows7-x64

3

StringIO.pyc

windows10-2004-x64

3

UserDict.pyc

windows7-x64

3

UserDict.pyc

windows10-2004-x64

3

__future__.pyc

windows7-x64

3

__future__.pyc

windows10-2004-x64

3

_ctypes.pyc

windows7-x64

3

_ctypes.pyc

windows10-2004-x64

_strptime.pyc

windows7-x64

3

_strptime.pyc

windows10-2004-x64

3

atexit.pyc

windows7-x64

3

atexit.pyc

windows10-2004-x64

3

base64.pyc

windows7-x64

3

base64.pyc

windows10-2004-x64

3

bz2.pyc

windows7-x64

3

bz2.pyc

windows10-2004-x64

3

calendar.pyc

windows7-x64

3

calendar.pyc

windows10-2004-x64

3

codecs.pyc

windows7-x64

3

codecs.pyc

windows10-2004-x64

3

copy.pyc

windows7-x64

3

copy.pyc

windows10-2004-x64

3

copy_reg.pyc

windows7-x64

3

copy_reg.pyc

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    4b52806956f5387ddd33dfa622295530_JaffaCakes118

  • Size

    4.4MB

  • MD5

    4b52806956f5387ddd33dfa622295530

  • SHA1

    c6d8f3c027dd37f003876d6319a5f67ac1b4d8f3

  • SHA256

    e00408abcb133cac407a60fb9ae5450756029fc3e543690c60f1113c28f2289c

  • SHA512

    43e8adda812025d2b74c0580859de83072dead2ff8fa43079e241328b7252f77564d01db0e4d5bc83a4db65a3f1bca9939f501a5f8f1bd7858d3a0bdceae2fb2

  • SSDEEP

    98304:KS6t/22Sc2x6qSNsSFbp+OX1HSH7GtO6A0eNXLC8X4y8hvI2wDCe:VWu27Hbp+OX1HSbGxUXO8EJLm7

Score
3/10

Malware Config

Signatures

  • Unsigned PE 22 IoCs

    Checks for missing Authenticode signature.

Files

  • 4b52806956f5387ddd33dfa622295530_JaffaCakes118
    .rar
  • 回天一键还原/MSVCR71.dll
    .dll windows:4 windows x86 arch:x86

    7acc8c379c768a1ecd81ec502ff5f33e


    Headers

    Imports

    Exports

    Sections

  • 回天一键还原/_ctypes.pyd
    .dll windows:4 windows x86 arch:x86

    3e7f6ec4f253624c579f2632d6bfe264


    Headers

    Imports

    Exports

    Sections

  • 回天一键还原/bz2.pyd
    .dll windows:4 windows x86 arch:x86

    9dc1e60865a09b987249307fe051b644


    Headers

    Imports

    Exports

    Sections

  • 回天一键还原/cngho_sdk.dll
    .dll windows:4 windows x86 arch:x86

    042f7a35c02ae465c434c52e081ff90e


    Headers

    Imports

    Exports

    Sections

  • 回天一键还原/library.zip
    .zip
  • StringIO.pyc
  • UserDict.pyc
  • __future__.pyc
  • _ctypes.pyc
  • _strptime.pyc
  • atexit.pyc
  • base64.pyc
  • bz2.pyc
  • calendar.pyc
  • codecs.pyc
  • copy.pyc
  • copy_reg.pyc
  • ctypes/__init__.pyc
  • ctypes/_endian.pyc
  • dummy_thread.pyc
  • encodings/__init__.pyc
  • encodings/aliases.pyc
  • encodings/ascii.pyc
  • encodings/base64_codec.pyc
  • encodings/big5.pyc
  • encodings/big5hkscs.pyc
  • encodings/bz2_codec.pyc
  • encodings/charmap.pyc
  • encodings/cp037.pyc
  • encodings/cp1006.pyc
  • encodings/cp1026.pyc
  • encodings/cp1140.pyc
  • encodings/cp1250.pyc
  • encodings/cp1251.pyc
  • encodings/cp1252.pyc
  • encodings/cp1253.pyc
  • encodings/cp1254.pyc
  • encodings/cp1255.pyc
  • encodings/cp1256.pyc
  • encodings/cp1257.pyc
  • encodings/cp1258.pyc
  • encodings/cp424.pyc
  • encodings/cp437.pyc
  • encodings/cp500.pyc
  • encodings/cp737.pyc
  • encodings/cp775.pyc
  • encodings/cp850.pyc
  • encodings/cp852.pyc
  • encodings/cp855.pyc
  • encodings/cp856.pyc
  • encodings/cp857.pyc
  • encodings/cp860.pyc
  • encodings/cp861.pyc
  • encodings/cp862.pyc
  • encodings/cp863.pyc
  • encodings/cp864.pyc
  • encodings/cp865.pyc
  • encodings/cp866.pyc
  • encodings/cp869.pyc
  • encodings/cp874.pyc
  • encodings/cp875.pyc
  • encodings/cp932.pyc
  • encodings/cp949.pyc
  • encodings/cp950.pyc
  • encodings/euc_jis_2004.pyc
  • encodings/euc_jisx0213.pyc
  • encodings/euc_jp.pyc
  • encodings/euc_kr.pyc
  • encodings/gb18030.pyc
  • encodings/gb2312.pyc
  • encodings/gbk.pyc
  • encodings/hex_codec.pyc
  • encodings/hp_roman8.pyc
  • encodings/hz.pyc
  • encodings/idna.pyc
  • encodings/iso2022_jp.pyc
  • encodings/iso2022_jp_1.pyc
  • encodings/iso2022_jp_2.pyc
  • encodings/iso2022_jp_2004.pyc
  • encodings/iso2022_jp_3.pyc
  • encodings/iso2022_jp_ext.pyc
  • encodings/iso2022_kr.pyc
  • encodings/iso8859_1.pyc
  • encodings/iso8859_10.pyc
  • encodings/iso8859_11.pyc
  • encodings/iso8859_13.pyc
  • encodings/iso8859_14.pyc
  • encodings/iso8859_15.pyc
  • encodings/iso8859_16.pyc
  • encodings/iso8859_2.pyc
  • encodings/iso8859_3.pyc
  • encodings/iso8859_4.pyc
  • encodings/iso8859_5.pyc
  • encodings/iso8859_6.pyc
  • encodings/iso8859_7.pyc
  • encodings/iso8859_8.pyc
  • encodings/iso8859_9.pyc
  • encodings/johab.pyc
  • encodings/koi8_r.pyc
  • encodings/koi8_u.pyc
  • encodings/latin_1.pyc
  • encodings/mac_arabic.pyc
  • encodings/mac_centeuro.pyc
  • encodings/mac_croatian.pyc
  • encodings/mac_cyrillic.pyc
  • encodings/mac_farsi.pyc
  • encodings/mac_greek.pyc
  • encodings/mac_iceland.pyc
  • encodings/mac_latin2.pyc
  • encodings/mac_roman.pyc
  • encodings/mac_romanian.pyc
  • encodings/mac_turkish.pyc
  • encodings/mbcs.pyc
  • encodings/palmos.pyc
  • encodings/ptcp154.pyc
  • encodings/punycode.pyc
  • encodings/quopri_codec.pyc
  • encodings/raw_unicode_escape.pyc
  • encodings/rot_13.pyc
  • encodings/shift_jis.pyc
  • encodings/shift_jis_2004.pyc
  • encodings/shift_jisx0213.pyc
  • encodings/string_escape.pyc
  • encodings/tis_620.pyc
  • encodings/undefined.pyc
  • encodings/unicode_escape.pyc
  • encodings/unicode_internal.pyc
  • encodings/utf_16.pyc
  • encodings/utf_16_be.pyc
  • encodings/utf_16_le.pyc
  • encodings/utf_7.pyc
  • encodings/utf_8.pyc
  • encodings/utf_8_sig.pyc
  • encodings/uu_codec.pyc
  • encodings/zlib_codec.pyc
  • getopt.pyc
  • gettext.pyc
  • linecache.pyc
  • locale.pyc
  • macpath.pyc
  • new.pyc
  • ntpath.pyc
  • optparse.pyc
  • os.pyc
  • os2emxpath.pyc
  • popen2.pyc
  • posixpath.pyc
  • quopri.pyc
  • re.pyc
  • repr.pyc
  • sre.pyc
  • sre_compile.pyc
  • sre_constants.pyc
  • sre_parse.pyc
  • stat.pyc
  • string.pyc
  • stringprep.pyc
  • struct.pyc
  • textwrap.pyc
  • token.pyc
  • tokenize.pyc
  • traceback.pyc
  • types.pyc
  • unicodedata.pyc
  • warnings.pyc
  • win32api.pyc
  • wx/__init__.pyc
  • wx/__version__.pyc
  • wx/_controls.pyc
  • wx/_controls_.pyc
  • wx/_core.pyc
  • wx/_core_.pyc
  • wx/_gdi.pyc
  • wx/_gdi_.pyc
  • wx/_misc.pyc
  • wx/_misc_.pyc
  • wx/_windows.pyc
  • wx/_windows_.pyc
  • 回天一键还原/mainui.exe
    .exe windows:4 windows x86 arch:x86

    982de54d12c39d089abdb53c89386075


    Headers

    Imports

    Sections

  • 回天一键还原/mainui.ico
  • 回天一键还原/nsis_sdk.dll
    .dll windows:4 windows x86 arch:x86

    11a7247f7579bafa4f098eb16886b7f5


    Headers

    Imports

    Exports

    Sections

  • 回天一键还原/python25.dll
    .dll windows:4 windows x86 arch:x86

    c95ffe1c5c0fb3e98b1b03977ef3bab5


    Headers

    Imports

    Exports

    Sections

  • 回天一键还原/pywintypes25.dll
    .dll windows:4 windows x86 arch:x86

    5e4abd3fb0b53d4161e4bcd410632411


    Headers

    Imports

    Exports

    Sections

  • 回天一键还原/unicodedata.pyd
    .dll windows:4 windows x86 arch:x86

    9ba4f8f04306eb180330a8ad0c78458f


    Headers

    Imports

    Exports

    Sections

  • 回天一键还原/w9xpopen.exe
    .exe windows:4 windows x86 arch:x86

    3fa43cf6494afaa362b5996b590f5baa


    Headers

    Imports

    Sections

  • 回天一键还原/win32api.pyd
    .dll windows:4 windows x86 arch:x86

    0eaf1db02871d7c0fb0c4d9a16780841


    Headers

    Imports

    Exports

    Sections

  • 回天一键还原/wx._controls_.pyd
    .dll windows:4 windows x86 arch:x86

    3e13914ec6e5f54deb9af491c68a9fc2


    Headers

    Imports

    Exports

    Sections

  • 回天一键还原/wx._core_.pyd
    .dll windows:4 windows x86 arch:x86

    6a83900307c52ef7e1d5e062d8214eea


    Headers

    Imports

    Exports

    Sections

  • 回天一键还原/wx._gdi_.pyd
    .dll windows:4 windows x86 arch:x86

    1205cd34ffc0aa4ff75ac0889bd57b19


    Headers

    Imports

    Exports

    Sections

  • 回天一键还原/wx._misc_.pyd
    .dll windows:4 windows x86 arch:x86

    3919309683d503756aa5368a9b78379e


    Headers

    Imports

    Exports

    Sections

  • 回天一键还原/wx._windows_.pyd
    .dll windows:4 windows x86 arch:x86

    d10e6760ab369deebd7813ea2455a389


    Headers

    Imports

    Exports

    Sections

  • 回天一键还原/wxbase28h_net_vc.dll
    .dll windows:4 windows x86 arch:x86

    5a2dcf0e925b7aa5ef30741236b4182a


    Headers

    Imports

    Exports

    Sections

  • 回天一键还原/wxbase28h_vc.dll
    .dll windows:4 windows x86 arch:x86

    6d2e412cc8f0e5f6b5118bd7a5e756a2


    Headers

    Imports

    Exports

    Sections

  • 回天一键还原/wxmsw28h_adv_vc.dll
    .dll windows:4 windows x86 arch:x86

    024a3f0de25b84667a530da48004a37e


    Headers

    Imports

    Exports

    Sections

  • 回天一键还原/wxmsw28h_core_vc.dll
    .dll windows:4 windows x86 arch:x86

    4e405c1f51d86296c8aacf4315a4fd7d


    Headers

    Imports

    Exports

    Sections

  • 回天一键还原/wxmsw28h_html_vc.dll
    .dll windows:4 windows x86 arch:x86

    7d729c658b232599be1e3488354cc344


    Headers

    Imports

    Exports

    Sections

  • 回天一键还原/下载说明.txt
  • 回天一键还原/数码资源网.url
    .url
  • 如无法运行请将此补丁复制至C盘windows下的system32/MSVCP71.DLL
    .dll windows:4 windows x86 arch:x86

    5e2398adb60a70c7ab04e7cba75a7983


    Headers

    Imports

    Exports

    Sections