Overview
overview
7Static
static
7三国小�...��.exe
windows7-x64
7三国小�...��.exe
windows10-2004-x64
7下载软�...��.url
windows7-x64
1下载软�...��.url
windows10-2004-x64
1使用说明.doc
windows7-x64
4使用说明.doc
windows10-2004-x64
1创世冰�...��.exe
windows7-x64
7创世冰�...��.exe
windows10-2004-x64
7功夫派�...��.exe
windows7-x64
7功夫派�...��.exe
windows10-2004-x64
7多功能�...��.exe
windows7-x64
7多功能�...��.exe
windows10-2004-x64
7封神太�...��.exe
windows7-x64
7封神太�...��.exe
windows10-2004-x64
7彩虹王�...��.exe
windows7-x64
7彩虹王�...��.exe
windows10-2004-x64
7造梦西�...��.exe
windows7-x64
7造梦西�...��.exe
windows10-2004-x64
7Behavioral task
behavioral1
Sample
三国小镇桌面版 ——小伟.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
三国小镇桌面版 ——小伟.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
下载软件_免费下载单机游戏_手机游戏下载大全_psp游戏_下载快播.url
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
下载软件_免费下载单机游戏_手机游戏下载大全_psp游戏_下载快播.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
使用说明.doc
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
使用说明.doc
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
创世冰魂桌面版——小伟.exe
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
创世冰魂桌面版——小伟.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
功夫派桌面版——小伟.exe
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
功夫派桌面版——小伟.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
多功能修改器综合版v1.1——小伟.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
多功能修改器综合版v1.1——小伟.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
封神太子2桌面版 ——小伟.exe
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
封神太子2桌面版 ——小伟.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
彩虹王国桌面版 ——小伟.exe
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
彩虹王国桌面版 ——小伟.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
造梦西游3桌面版——小伟.exe
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
造梦西游3桌面版——小伟.exe
Resource
win10v2004-20240226-en
General
-
Target
8e48842a3c213fe87580787cdbee7322_JaffaCakes118
-
Size
2.5MB
-
MD5
8e48842a3c213fe87580787cdbee7322
-
SHA1
ce7ed19c495f03ddbb53204d2893a0bb0247ea85
-
SHA256
d3c4ef6c545055f0e205bfe4cbc8dbddccb0d5ecdad4033530c50a2be967121c
-
SHA512
8cd74f0d43dbc8485d305c8832f5eae600dd9821bd882c0f4d1cae9ac846ca1aae00ff4c6f6c1fcdb46ee24aa27298127ef18fac22bf26acd72bf05bc0fd6ae3
-
SSDEEP
49152:zCAJ5oJmPgRImucO6xbBwzhPWlsOOEeRPmD7NnqnM4RSPZcChh:zlLomg+mzxCUsZHpUNqn1gcChh
Malware Config
Signatures
-
resource yara_rule static1/unpack001/三国小镇桌面版 ——小伟.exe upx static1/unpack001/创世冰魂桌面版——小伟.exe upx static1/unpack001/功夫派桌面版——小伟.exe upx static1/unpack001/多功能修改器综合版v1.1——小伟.exe upx static1/unpack001/封神太子2桌面版 ——小伟.exe upx static1/unpack001/彩虹王国桌面版 ——小伟.exe upx static1/unpack001/造梦西游3桌面版——小伟.exe upx -
Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack001/三国小镇桌面版 ——小伟.exe unpack001/创世冰魂桌面版——小伟.exe unpack001/功夫派桌面版——小伟.exe unpack001/多功能修改器综合版v1.1——小伟.exe unpack001/封神太子2桌面版 ——小伟.exe unpack001/彩虹王国桌面版 ——小伟.exe unpack001/造梦西游3桌面版——小伟.exe
Files
-
8e48842a3c213fe87580787cdbee7322_JaffaCakes118.rar
-
9号下载安装说明.txt
-
三国小镇桌面版 ——小伟.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 496KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 336KB - Virtual size: 336KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
下载软件_免费下载单机游戏_手机游戏下载大全_psp游戏_下载快播.url.url
-
使用说明.doc.doc windows office2003
-
创世冰魂桌面版——小伟.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 496KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 335KB - Virtual size: 336KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
功夫派桌面版——小伟.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 496KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 336KB - Virtual size: 336KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
多功能修改器综合版v1.1——小伟.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 482KB - Virtual size: 484KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
封神太子2桌面版 ——小伟.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 496KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 336KB - Virtual size: 336KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
彩虹王国桌面版 ——小伟.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 496KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 336KB - Virtual size: 336KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
造梦西游3桌面版——小伟.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 496KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 336KB - Virtual size: 336KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE