Overview
overview
7Static
static
7USB_nodriv....0.exe
windows7-x64
1USB_nodriv....0.exe
windows10-2004-x64
1USB_nodriv....0.exe
windows7-x64
7USB_nodriv....0.exe
windows10-2004-x64
7USB_nodriv....0.pdf
windows7-x64
1USB_nodriv....0.pdf
windows10-2004-x64
1USB_nodriv...��.url
windows7-x64
1USB_nodriv...��.url
windows10-2004-x64
1USB_nodriv...��.url
windows7-x64
1USB_nodriv...��.url
windows10-2004-x64
1Behavioral task
behavioral1
Sample
USB_nodrivers_pack/USB_nodrivers_pack/修复补丁V2.0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
USB_nodrivers_pack/USB_nodrivers_pack/修复补丁V2.0.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
USB_nodrivers_pack/USB_nodrivers_pack/修复补丁V3.0.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
USB_nodrivers_pack/USB_nodrivers_pack/修复补丁V3.0.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
USB_nodrivers_pack/USB_nodrivers_pack/修复补丁修复方法描述V2.0.pdf
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
USB_nodrivers_pack/USB_nodrivers_pack/修复补丁修复方法描述V2.0.pdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
USB_nodrivers_pack/USB_nodrivers_pack/更多软件下载.url
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
USB_nodrivers_pack/USB_nodrivers_pack/更多软件下载.url
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
USB_nodrivers_pack/USB_nodrivers_pack/飘荡软件.url
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
USB_nodrivers_pack/USB_nodrivers_pack/飘荡软件.url
Resource
win10v2004-20240508-en
General
-
Target
8fbee4f80111ee599a530bb777e7434e_JaffaCakes118
-
Size
315KB
-
MD5
8fbee4f80111ee599a530bb777e7434e
-
SHA1
704158c39858e4df403c72fe897762ddccce84ce
-
SHA256
e2219fabdf973c3c28c039a321f90d55ced874b47ac1f89ddf89e10b10f7b42d
-
SHA512
f9f9e0bb83e9da8780e66433b9c7804bf92d518d055da35790cc315f9d76cab99a7818da51d32cc8de5805829e1b70981624e977fffe70a6b38dc4edd0253495
-
SSDEEP
6144:uIvMQhKXPYAMt5L+Ad/xeuPgEbhBOjZ3FGVuQsQAwpTGiuThs:PMQq8N+Ad/P5O5kTGiuTS
Malware Config
Signatures
-
resource yara_rule static1/unpack001/USB_nodrivers_pack/USB_nodrivers_pack/修复补丁V3.0.EXE upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe -
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/USB_nodrivers_pack/USB_nodrivers_pack/修复补丁V2.0.exe unpack001/USB_nodrivers_pack/USB_nodrivers_pack/修复补丁V3.0.EXE unpack002/out.upx
Files
-
8fbee4f80111ee599a530bb777e7434e_JaffaCakes118.rar
-
USB_nodrivers_pack/USB_nodrivers_pack/修复补丁V2.0.exe.exe windows:4 windows x86 arch:x86
ac0e65683d10a7786abc0e8f32bdc45b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
advapi32
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
kernel32
GetStringTypeW
GetFileType
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
Sections
.text Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
USB_nodrivers_pack/USB_nodrivers_pack/修复补丁V3.0.EXE.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 368KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 218KB - Virtual size: 220KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 401KB - Virtual size: 401KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
USB_nodrivers_pack/USB_nodrivers_pack/修复补丁修复方法描述V2.0.pdf.pdf
-
USB_nodrivers_pack/USB_nodrivers_pack/更多软件下载.url
-
USB_nodrivers_pack/USB_nodrivers_pack/飘荡软件.url.url