Overview
overview
3Static
static
3XMLFox_en/...ML.dll
windows7-x64
1XMLFox_en/...ML.dll
windows10-2004-x64
1XMLFox_en/...ML.dll
windows7-x64
1XMLFox_en/...ML.dll
windows10-2004-x64
1XMLFox_en/...ML.dll
windows7-x64
1XMLFox_en/...ML.dll
windows10-2004-x64
1XMLFox_en/...md.exe
windows7-x64
1XMLFox_en/...md.exe
windows10-2004-x64
1XMLFox_en/...ML.dll
windows7-x64
1XMLFox_en/...ML.dll
windows10-2004-x64
1XMLFox_en/...ce.exe
windows7-x64
1XMLFox_en/...ce.exe
windows10-2004-x64
1XMLFox_en/...lp.chm
windows7-x64
1XMLFox_en/...lp.chm
windows10-2004-x64
1XMLFox_en/...��.url
windows7-x64
1XMLFox_en/...��.url
windows10-2004-x64
1XMLFox_en/...ET.url
windows7-x64
1XMLFox_en/...ET.url
windows10-2004-x64
1XMLFox_en/帮助.url
windows7-x64
1XMLFox_en/帮助.url
windows10-2004-x64
1XMLFox_en/...�2.url
windows7-x64
1XMLFox_en/...�2.url
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
XMLFox_en/XMLFox Professional/AccessXML.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
XMLFox_en/XMLFox Professional/AccessXML.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
XMLFox_en/XMLFox Professional/Command-line/AccessXML.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
XMLFox_en/XMLFox Professional/Command-line/AccessXML.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
XMLFox_en/XMLFox Professional/Command-line/SystemXML.dll
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
XMLFox_en/XMLFox Professional/Command-line/SystemXML.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
XMLFox_en/XMLFox Professional/Command-line/XMLFoxCmd.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
XMLFox_en/XMLFox Professional/Command-line/XMLFoxCmd.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
XMLFox_en/XMLFox Professional/SystemXML.dll
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
XMLFox_en/XMLFox Professional/SystemXML.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
XMLFox_en/XMLFox Professional/XMLFoxAdvance.exe
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
XMLFox_en/XMLFox Professional/XMLFoxAdvance.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
XMLFox_en/XMLFox Professional/XMLFoxAdvanceHelp.chm
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
XMLFox_en/XMLFox Professional/XMLFoxAdvanceHelp.chm
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
XMLFox_en/XMLFox Professional/傲看软件园┆绿色软件下载基地.url
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
XMLFox_en/XMLFox Professional/傲看软件园┆绿色软件下载基地.url
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
XMLFox_en/XMLFox Professional/如程序无法运行请点击下载.NET.url
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
XMLFox_en/XMLFox Professional/如程序无法运行请点击下载.NET.url
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
XMLFox_en/帮助.url
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
XMLFox_en/帮助.url
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
XMLFox_en/说明文件2.url
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
XMLFox_en/说明文件2.url
Resource
win10v2004-20240426-en
General
-
Target
5ef09ca3d85130733e155199e865e137_JaffaCakes118
-
Size
1.4MB
-
MD5
5ef09ca3d85130733e155199e865e137
-
SHA1
d18293b6891aa34d0d0669881baf78a3e83ed5e6
-
SHA256
09ee2d90afa9bc501fcc9c5446ddfba5e7507fd452a4527dbda078f0958d9749
-
SHA512
e34ee22b27314c4bbd6a7a727bec15fe3a2e37c86d57f1b45432ed2e93111b47a106402b02faca3d65bf35be76f76dffd01642916f94dec14004576f54f096d1
-
SSDEEP
24576:FHoMwCYyQx2G2SldvAiRTVko8aui5DGrz+P4hbjZxd1omiv657EgoKfZ6G3ZTtAY:NoMkb4RSX46BkfaunzYqjZxd2mU0gg1x
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/XMLFox_en/XMLFox Professional/Command-line/XMLFoxCmd.exe unpack001/XMLFox_en/XMLFox Professional/XMLFoxAdvance.exe
Files
-
5ef09ca3d85130733e155199e865e137_JaffaCakes118.rar
-
XMLFox_en/XMLFox Professional/AccessXML.dll
-
XMLFox_en/XMLFox Professional/Command-line/AccessXML.dll
-
XMLFox_en/XMLFox Professional/Command-line/SystemXML.dll
-
XMLFox_en/XMLFox Professional/Command-line/XMLFoxCmd.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 268KB - Virtual size: 265KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
XMLFox_en/XMLFox Professional/OKHAN说明文件.txt
-
XMLFox_en/XMLFox Professional/ReadMe.txt
-
XMLFox_en/XMLFox Professional/SystemXML.dll
-
XMLFox_en/XMLFox Professional/XMLFox32.ico
-
XMLFox_en/XMLFox Professional/XMLFoxAdvance.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
XMLFox_en/XMLFox Professional/XMLFoxAdvanceHelp.chm.chm
-
XMLFox_en/XMLFox Professional/傲看软件园┆绿色软件下载基地.URL.url
-
XMLFox_en/XMLFox Professional/如程序无法运行请点击下载.NET.url
-
XMLFox_en/★记注傲看软件下载站★.reg
-
XMLFox_en/帮助.url
-
XMLFox_en/说明文件2.url