Overview
overview
3Static
static
3使用说明.url
windows7-x64
1使用说明.url
windows10-2004-x64
1极速软�...��.url
windows7-x64
1极速软�...��.url
windows10-2004-x64
1王中王�...lq.exe
windows7-x64
1王中王�...lq.exe
windows10-2004-x64
1王中王�...8).exe
windows7-x64
1王中王�...8).exe
windows10-2004-x64
1王中王�...��.exe
windows7-x64
1王中王�...��.exe
windows10-2004-x64
1王中王�...��.url
windows7-x64
1王中王�...��.url
windows10-2004-x64
1王中王�...��.url
windows7-x64
1王中王�...��.url
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
使用说明.url
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
使用说明.url
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
极速软件下载.url
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
极速软件下载.url
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
王中王輔助/dlq.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
王中王輔助/dlq.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
王中王輔助/【玩中玩保箱】/wBox(2.0.14.0528).exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
王中王輔助/【玩中玩保箱】/wBox(2.0.14.0528).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
王中王輔助/王 中 王.exe
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
王中王輔助/王 中 王.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
王中王輔助/王中王辅助24小时自动售卡平台.url
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
王中王輔助/王中王辅助24小时自动售卡平台.url
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
王中王輔助/王中王辅助官网.url
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
王中王輔助/王中王辅助官网.url
Resource
win10v2004-20240508-en
General
-
Target
8d2a790e8366eecda0c737a6ab5761f8_JaffaCakes118
-
Size
11.2MB
-
MD5
8d2a790e8366eecda0c737a6ab5761f8
-
SHA1
2afa7c97374f0542647826fcd1e766f5b321aaad
-
SHA256
2c403783f4c1a1a2acabd7590f394260f2fa7c36a4ab9034a5fcc00a8a80ddc7
-
SHA512
486584c2dc19b5be130288b034fbdae74f98a186d6a2e0ef42389f2d3a4bcda2575b0e815f376289e2701ae299ae91c5359ed8a7d000684a32f7558b3be9b2d7
-
SSDEEP
196608:HynxK4n6aJfjdobeVI+aU/HWhP1b9jkMvCoP6afdOPYePvTLLg7XHyt+BBBpOfsR:HynxK46aJfp4eEU/2hrgtoP6afdXEvvo
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/王中王輔助/dlq.exe unpack001/王中王輔助/【玩中玩保箱】/wBox(2.0.14.0528).exe unpack001/王中王輔助/王 中 王.exe
Files
-
8d2a790e8366eecda0c737a6ab5761f8_JaffaCakes118.rar
-
使用说明.url
-
极速软件下载.url.url
-
王中王輔助/dlq.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 21.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 77KB - Virtual size: 293KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 383KB - Virtual size: 384KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8.9MB - Virtual size: 8.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 8KB
IMAGE_SCN_MEM_READ
-
王中王輔助/【玩中玩保箱】/wBox(2.0.14.0528).exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 4KB - Virtual size: 1.3MB
IMAGE_SCN_MEM_READ
.data Size: 384KB - Virtual size: 384KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 20KB
IMAGE_SCN_MEM_READ
-
王中王輔助/王 中 王.exe.exe windows:4 windows x86 arch:x86
c75d7083643db8b4064854c01eb2e65c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateProcessA
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
GetPrivateProfileStringA
CopyFileA
WritePrivateProfileStringA
GetTickCount
CloseHandle
GetStartupInfoA
GetCommandLineA
GetVersion
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
GetProcAddress
RaiseException
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
LoadLibraryA
SetFilePointer
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
FlushFileBuffers
user32
GetMessageA
DispatchMessageA
wsprintfA
MessageBoxA
TranslateMessage
PeekMessageA
shlwapi
PathFileExistsA
Sections
.text Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
王中王輔助/王中王辅助24小时自动售卡平台.url.url
-
王中王輔助/王中王辅助官网.url.url
-
王中王輔助/码12.db
-
王中王輔助/脚本/▲完整流程(盟重-幻境七层).TXT
-
王中王輔助/脚本/▲循环脚本战斗.txt
-
王中王輔助/脚本/▲循环脚本战斗2.txt
-
王中王輔助/脚本/▲死亡(循环脚本挂机).txt
-
王中王輔助/脚本/▲盟重出售(矿区洞口挖矿).txt
-
王中王輔助/脚本/△一键使用盟重传送石.TXT
-
王中王輔助/脚本/△一键服务.TXT
-
王中王輔助/脚本/△服务(一键回收).TXT
-
王中王輔助/脚本/会员(一键全收).TXT
-
王中王輔助/脚本/使用修复神水.TXT
-
王中王輔助/脚本/使用元宝.txt
-
王中王輔助/脚本/使用回城卷.TXT
-
王中王輔助/脚本/带验证码的装备回收.TXT
-
王中王輔助/脚本/按键模拟_鼠标_商铺购买物品.TXT
-
王中王輔助/脚本/按键模拟_鼠标_小退上线.TXT
-
王中王輔助/脚本/按键模拟_鼠标模拟_商铺购买物品.TXT
-
王中王輔助/脚本/按键模拟_鼠标模拟_小退上线.TXT
-
王中王輔助/脚本/攻击模式切换.txt
-
王中王輔助/脚本/测试战斗过程1.TXT
-
王中王輔助/脚本/测试脚本.txt
-
王中王輔助/脚本/移动()指令样本.txt
-
王中王輔助/脚本/脚本战斗_闭关打宝.TXT
-
王中王輔助/脚本/购买元宝.txt
-
王中王輔助/脚本/购买疗伤药包.txt