Overview
overview
7Static
static
7ztfsc/中�...��.exe
windows7-x64
7ztfsc/中�...��.exe
windows10-2004-x64
7ztfsc/中�...��.url
windows7-x64
1ztfsc/中�...��.url
windows10-2004-x64
1ztfsc/说�...�1.url
windows7-x64
1ztfsc/说�...�1.url
windows10-2004-x64
1ztfsc/说�...�2.url
windows7-x64
1ztfsc/说�...�2.url
windows10-2004-x64
1Behavioral task
behavioral1
Sample
ztfsc/中天文件恢复反删除工具包/中天文件恢复反删除工具包.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ztfsc/中天文件恢复反删除工具包/中天文件恢复反删除工具包.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
ztfsc/中天文件恢复反删除工具包/帮助.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
ztfsc/中天文件恢复反删除工具包/帮助.url
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
ztfsc/说明文件1.url
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
ztfsc/说明文件1.url
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
ztfsc/说明文件2.url
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
ztfsc/说明文件2.url
Resource
win10v2004-20240508-en
General
-
Target
9c08c271bd49beb431ff553f102094be_JaffaCakes118
-
Size
3.0MB
-
MD5
9c08c271bd49beb431ff553f102094be
-
SHA1
adc478d3b014bd8363d500437f4f7a7fd6768c18
-
SHA256
e9802addc97cffd252fed2a763915a197375a7ad53192cf7e1a82041cdff11a4
-
SHA512
8ce7cba640c4741ea9e400c5c4be5c86915e3e3bb75aa3874f135301967fc6b1ff0d2c310775e93a9bc6bb218e4674b6319ed7c63629402d6cd75e954c147507
-
SSDEEP
49152:O1sZeatokSFZEphguJ/F2xcPMbaNvquSrwZcopbK41lwFamv1/5QCJrMyEHH9ulL:OWrtTOqphJ/fNyuNIOwtpJrMyEdU
Malware Config
Signatures
-
resource yara_rule static1/unpack001/ztfsc/中天文件恢复反删除工具包/中天文件恢复反删除工具包.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/ztfsc/中天文件恢复反删除工具包/中天文件恢复反删除工具包.exe unpack002/out.upx
Files
-
9c08c271bd49beb431ff553f102094be_JaffaCakes118.rar
-
ztfsc/★记注傲看软件下载站★.reg
-
ztfsc/中天文件恢复反删除工具包/OKHAN说明文件.txt
-
ztfsc/中天文件恢复反删除工具包/中天文件恢复反删除工具包.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 112KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 54KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 72KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
ztfsc/中天文件恢复反删除工具包/帮助.url
-
ztfsc/说明文件1.url
-
ztfsc/说明文件2.url