Static task
static1
Behavioral task
behavioral1
Sample
使用必读.url
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
使用必读.url
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
查询任意QQ绑定手机号码(电脑版).exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
查询任意QQ绑定手机号码(电脑版).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
绿色先锋下载.url
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
绿色先锋下载.url
Resource
win10v2004-20240508-en
General
-
Target
97ba67888a4af670a1c4de1490de54d0_JaffaCakes118
-
Size
1.5MB
-
MD5
97ba67888a4af670a1c4de1490de54d0
-
SHA1
dbbce49e96210a9de7fad30b8dcc4dcf70904416
-
SHA256
e7293d5aaf3863f808a9e3cc603af47db5e93df31bc7fe526e411afdee30de0c
-
SHA512
eeaa3fb989441392e05c65166cfecda9875c142e5b660fdf947d608ec62af34a2b913bf397f4317f02e47fe26b592e59ec222f7cceff42be37a6e3507493be8e
-
SSDEEP
24576:mnuuov1+c4dtUadNDmyREcHpa/zP7Uggi4Y+24HmibYctgtmq2rmZyZeirHBZJfE:Duo74dtPdtpzJYjtgi4gziMo2mtxeirO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/查询任意QQ绑定手机号码(电脑版).exe
Files
-
97ba67888a4af670a1c4de1490de54d0_JaffaCakes118.rar
-
使用必读.url
-
查询任意QQ绑定手机号码(电脑版).exe.exe windows:4 windows x86 arch:x86
e4b5d88b6f6af00be0e3c8e4786c499c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSAAsyncSelect
kernel32
SetLastError
user32
SetFocus
gdi32
Escape
winspool.drv
DocumentPropertiesA
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
StgCreateDocfileOnILockBytes
oleaut32
LoadTypeLi
comctl32
ord17
oledlg
ord8
comdlg32
ChooseColorA
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Sections
.text Size: 556KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 1024KB - Virtual size: 1024KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
绿色先锋下载.url.url
-
软件效果图.png.png