Overview

overview

8

Static

static

7

nizhanilin...��.url

windows7-x64

1

nizhanilin...��.url

windows10-2004-x64

1

nizhanilin...��.url

windows7-x64

1

nizhanilin...��.url

windows10-2004-x64

1

nizhanilin...��.bat

windows7-x64

1

nizhanilin...��.bat

windows10-2004-x64

1

nizhanilin...��.dll

windows7-x64

8

nizhanilin...��.dll

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    86f9cec2b2e63140fc9aa58801b35f51_JaffaCakes118

  • Size

    2.3MB

  • MD5

    86f9cec2b2e63140fc9aa58801b35f51

  • SHA1

    ec9a8497edf1428a0556feb2cdf70fff8134ed5e

  • SHA256

    f903c4f8ccb86ef355e586e9f34e5291b60fd4b40e6bfbf3de42a967cc2738dc

  • SHA512

    68590c5ea0fd5f5660bea703e0d4268e65fb777201f5693ee6c775c5a6cf965f0bdd9d3404c7375f22234b932691b49e98174ad844d7ad820729e2e42d574b89

  • SSDEEP

    49152:HsCyuG8AVG7lRrlQfOKPu16dZdys30pkQ9Hgy+8ewy:HsCqQ7TlU01TsEBFgyDK

Score
7/10
vmprotect

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 86f9cec2b2e63140fc9aa58801b35f51_JaffaCakes118
    .rar
  • nizhanilin/下载银行-提供免费绿色软件下载.url
    .url
  • nizhanilin/下载银行.txt
  • nizhanilin/逆战麒麟_26.6pvp+pve/1.jpg
    .jpg
  • nizhanilin/逆战麒麟_26.6pvp+pve/2.png
    .png
  • nizhanilin/逆战麒麟_26.6pvp+pve/3.png
    .png
  • nizhanilin/逆战麒麟_26.6pvp+pve/使用教程与介绍.url
    .url
  • nizhanilin/逆战麒麟_26.6pvp+pve/启动辅助.bat
  • nizhanilin/逆战麒麟_26.6pvp+pve/开启方法/1.解压到当前文件.jpg
    .jpg
  • nizhanilin/逆战麒麟_26.6pvp+pve/开启方法/2.运行.jpg
    .jpg
  • nizhanilin/逆战麒麟_26.6pvp+pve/注册教程图.png
    .png
  • nizhanilin/逆战麒麟_26.6pvp+pve/麒麟.dll
    .dll windows:4 windows x86 arch:x86

    7fad9dbe27ebd05adaa55fb7e48317cf


    Headers

    Imports

    Exports

    Sections

  • nizhanilin/逆战麒麟_26.6pvp+pve/麒麟使用说明-必看.txt