Behavioral task
behavioral1
Sample
loldpsq/loldpsq/LOL对喷/LOL游戏对喷.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
loldpsq/loldpsq/LOL对喷/LOL游戏对喷.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
最新软件下载.url
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
最新软件下载.url
Resource
win10v2004-20240426-en
General
-
Target
7f9cd54b62be313b74479cc5cd691d5f_JaffaCakes118
-
Size
1.6MB
-
MD5
7f9cd54b62be313b74479cc5cd691d5f
-
SHA1
4821f02240e5ac6d6a6b935e2e3c0a7efdccfe4b
-
SHA256
255fdbc7c41984948ddbabd75834d89130ca41bf88f7914a43c487c075fa533b
-
SHA512
3acaa6cfafaaad536221c88301f67bc88d6c62f6ac1e16c96d3cb07a332f1c3547611b4c62c739dbf66fc0ac59f4303fd03ae3a2486bcffaf6a91103397f5c3b
-
SSDEEP
49152:e6iToGeh/gLMVxiL/TmcXiyLG0ywe91/T/0X3X:e6pNY6ijT1SyLJywe9t0Xn
Malware Config
Signatures
-
resource yara_rule static1/unpack001/loldpsq/loldpsq/LOL对喷/LOL游戏对喷.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/loldpsq/loldpsq/LOL对喷/LOL游戏对喷.exe
Files
-
7f9cd54b62be313b74479cc5cd691d5f_JaffaCakes118.zip
-
loldpsq/loldpsq/LOL对喷/LOL游戏对喷.exe.exe windows:5 windows x86 arch:x86
09d436a423317da1836539326d24c22f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
RtlUnwind
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetPropA
gdi32
GetViewportExtEx
winmm
midiStreamProperty
winspool.drv
ClosePrinter
advapi32
RegCreateKeyExA
shell32
DragFinish
ole32
OleUninitialize
oleaut32
RegisterTypeLi
comctl32
ImageList_Add
ws2_32
WSACleanup
comdlg32
ChooseColorA
Sections
.text Size: - Virtual size: 586KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 901KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 187KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 877KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
loldpsq/loldpsq/LOL对喷/在这里设置问候语句.txt
-
安装使用说明.txt
-
最新软件下载.url