Behavioral task
behavioral1
Sample
tv/网络电视直播软件 .exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
tv/网络电视直播软件 .exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
tv/飘荡软件.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
tv/飘荡软件.url
Resource
win10v2004-20240508-en
General
-
Target
908523e9102b5d2874c705d341fcd3e2_JaffaCakes118
-
Size
1.1MB
-
MD5
908523e9102b5d2874c705d341fcd3e2
-
SHA1
5c3d071a4e07a407890a94809a8b669ec26e1fbf
-
SHA256
d7a849757d947e85acfc26b3ce449a7877b0ee0e95e4f64a2ea57931d1b49243
-
SHA512
1971275e05658a882bb2683d76aa257bc31318d9e84dc47802ec941ccc2689871a93bab5a5f11fa469d6022bb4c6d2a145578773a0c2fcc113a9ea95f5886516
-
SSDEEP
24576:Y71Cye0EGMjAXx6BEoydptRviz2eLL92Mjx/ZfYEzSIDko:KCyelJjABVoydpIjLL9FjxRf/DF
Malware Config
Signatures
-
resource yara_rule static1/unpack001/tv/网络电视直播软件 .exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/tv/网络电视直播软件 .exe
Files
-
908523e9102b5d2874c705d341fcd3e2_JaffaCakes118.rar
-
tv/报毒说明.txt
-
tv/网络电视直播软件 .exe.exe windows:5 windows x86 arch:x86
1799cf32e31ab11759416609886a92fe
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcessVersion
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SendMessageA
gdi32
StartPage
winmm
midiOutReset
winspool.drv
OpenPrinterA
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
CoGetClassObject
oleaut32
SafeArrayGetLBound
comctl32
ord17
oledlg
ord8
ws2_32
WSAAsyncSelect
comdlg32
GetOpenFileNameA
Sections
.text Size: - Virtual size: 442KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 800KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
tv/软件使用说明.txt
-
tv/飘荡软件.url.url