Ia���?-����4O{�eZ��qR���E�8�Bg�(�?�3�J���|BvG�4��������*�ۙ�V����Zx � ���4��ɪ��f��uA�@M��a��{>�)�#��e�%*��.<�\��ˉ�C�^/�I˂������E���OR�o����zyw�ю X| �*�9~i�]zLON �P��OL8���_���K�+��`�܅I �1Ж�:�h<�QG��$K�0�����DK$Qv�0u���F��֪�����N�<�Ѩ՝����u����C�Ő���S��Q��P�w�V5��n�7�f���B`H�6��V{2��_��x�Q�����M$lQ ��'���uN@f���?�����>����z����X��<�1�x��G��s/������t7C 鋮&<q,�\���(��pG\X5?ah�l��B㢾��ꝱ:�JT�������+X�~m��� ���V��M\O1��Th,������Y���~2�e�qc��b����1ڵ@w���.�zU���-b�<�D��$3�������V�G�����S���3�<y���XJ�� ��D4K�g�Ћz��ϡ�u<��s���ǒ�g���B�����=��<D���iZx��*K���+�2;�gJ�";i��5Z�z�-���_�{)�����/.G��U9��y��T��@E�ze�7Ӊ� �ȥ>Hy�0���>�=V�qZ���][�=���O�"7���|�XȁG1,J�kW��f��:��X�\��\�3� I���4���m�,�B�pP7?�՝��gŖ��-Jb�->*� 8�F���^�-�/e;n@������1��&C���,}Ebt���x�U�S���G�h������Xd'b��F���Ό�G��j��#D����&P��Q����OzW�Pm��h {s��rG�;�D���g��S4Om���;XëԽ�Q�Q#�'� �*���v��w��y�}�=s�|�ؗ�pf=�v�:��2q�]��#]x�ڶ,|��P�u �'g&�My��98`T0��*~`4���Mp'��l��W�U�N���U�(�c��T7$�O��p#��u�����|�A|�nb|���S�A�O���fX�y��4��P� ���*b�?��Jw�5���N���x� e/�ޕ��eI��A�WidřպE�mJ����z�}��E��'�Y/��L�ٜ����rK�����z,��]�o/�W}5r`�:�����3./�0بh�`�!&Q�jte�d~�~�>��IE�J�������jK��IYJ�R�7X1��B>O�~#�M���Rw~e�Ew�T�켚��*s���J��Bc[���A��Ʋ��@����`�������'�)�/�Ern�wI�l.idKH{<V�ԣ�K�"���B��îĂ�,������������{_}�j���˭�� 0"C<2-���W��9���Y�jıJm�����M�B���|��@���#e��{Ѵ�)\���*����Q�"Tr}н�zV�ډ:"��ª=X�E]� ;j��Zh|���eOW����E����[]��Ҩ�}U�S������TIҭӶ���?ZB@X~�|�1����)�k��J�d�$h*?^<�-�!Ǯ�ꌹQ� � �y!�P{�,T?���+U�|@X�c*K�I���{nhh��E���uT*�KV���M�rn@E�������4;��-cȃ�/e��Z� �/�&�]z7��j����!D��^�WQ�'!!w�x�� �N�b��ӫZ��7!�b����8ޕqY6�~��؍�H�24M6�����E:.3��Z*� ���D�Gq|�~n�܋������n[X�Z9&)&�n��� �.ץ�W*��ȕQ����YK�ul��!������iKȭ�}�t'&vS��}?,��BU��d<�\���cII���Tg*3�W����-�Y(q��<Ŗ~j�_�p������N T��$2�1�� J `^=�r��XGI��Xey Q�v�c1F�|��R����'2�w|IX#������H��% R�����=���е���.���ۻ�ϥ�T�f���ʭ�����<lݦ�"eͩ�����x%m{�8��Ui-A�a1��h2�nas�^1S�����d���&��r�!m ����,;��$.�ٛ��ܮ���TBĵC���\} ����e/�*Fh� ��t���2�+#��s/�d��-�m����?+6�n}�4<�$x�It����s� �i�{���X�E��L7t�a����D~�E�G���K��©ͪ�P��Bf��ӡ��0��~&gJ�Ő�q�ב�G����O���%'�?CV�m�LF.(KB���DM�1�����~�f|��,��`�ɝ��yq�ir���<��0��K� �3����E�"L����p�A�Լ[�)y�S@�5̵��.�S��!��=*�]kT>��9w->'�N.[[*#�sF� �7&��Bj&,�ڲ����n`�Y�NNx����k�����3��%9�Bn���(�H�֘ \��T��c�&���� ��T�1�MlS��OS+���?S ��P +���dmFo�7+�%z�pL��1�����]��q_G��,.��<}(G�Hۏʑ��sd ������T{r�v*� ṧ �ɨ��W�_g ���@뼦yD��ڳ�{0;\�� � �<u̠�D��E�Ϸ��|y!,]lG�N Y�&���=�P�S�'A> � S��k�͞��o�Ÿ�yhf(5��Q6L���88��Gրy��aδu��K,h6�?��і �a�,4"$goh�y���<O����iKC��V�|�"�Е�N��`|.��ƭjץKB3�V��J�[�������E�T�����*�P5Ӣp��JHA%�r$K�*�������e�J�,*?o! cOƢ����@�/�x�k�b����ʕ;��3�L ���S���y�لeYk��̹>�cp{/RE��_�oM�vwF~F��R�q( �1qR)�kŷ�}}�j��?E���{���
Static task
static1
Behavioral task
behavioral1
Sample
判断自己的电脑里面是否有病毒( 20121104).exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
判断自己的电脑里面是否有病毒( 20121104).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
网络安全攻防培训.url
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
网络安全攻防培训.url
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
黑吧安全网主站.url
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
黑吧安全网主站.url
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
黑吧安全网论坛.url
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
黑吧安全网论坛.url
Resource
win10v2004-20240508-en
General
-
Target
918d03c4c394a692e95d651ef299eb81_JaffaCakes118
-
Size
7.1MB
-
MD5
918d03c4c394a692e95d651ef299eb81
-
SHA1
304e5cc6609b0a0f77c2dcd67e9a06b2a615856c
-
SHA256
d30a3152176e319ac5af25bab3f78abcdd32194d37b2b0c5e6239b0311883cae
-
SHA512
3bf86b6144e13a6a5c9a6d817bae289e6f3ddc9988695402bd7b8c6c1dc14704ca8fa6044e924f995d1f5d35162bc635b360d6a927f6c5800e1f53aee0f9b46a
-
SSDEEP
196608:WKazFpbOkUWuQ6YleW36PjPvnxe9pwBpgK95Ufjq4:9a3bSYleWK7PvBTxUfjq4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/判断自己的电脑里面是否有病毒( 20121104).exe
Files
-
918d03c4c394a692e95d651ef299eb81_JaffaCakes118.rar
-
★记注黑吧安全网★.reg
-
会员服务.txt
-
判断自己的电脑里面是否有病毒( 20121104).exe.exe windows:4 windows x86 arch:x86
0376760989f580d55cad0a1487d90675
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SafeArrayCreate
advapi32
RegCreateKeyExA
user32
MapWindowPoints
MessageBoxA
kernel32
CreateThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
SaveDC
version
GetFileVersionInfoA
ole32
CreateStreamOnHGlobal
comctl32
ImageList_DrawEx
wininet
InternetGetConnectedState
shell32
ShellExecuteA
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 685KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 545KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 23KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 15KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 392KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 376B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
原创视频教程作品奖励规定 .txt
-
网络安全攻防培训.url.url
-
黑吧安全网严正声明.txt
-
黑吧安全网主站.url.url
-
黑吧安全网论坛.url.url