Static task
static1
Behavioral task
behavioral1
Sample
yyzCSGOts/CSGO预言者单板透视小刀娱乐网专版/CSGO预言单板透视小刀娱乐网专版6.27.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
yyzCSGOts/CSGO预言者单板透视小刀娱乐网专版/CSGO预言单板透视小刀娱乐网专版6.27.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
yyzCSGOts/下载说明.htm
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
yyzCSGOts/下载说明.htm
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
yyzCSGOts/使用帮助(河东软件园).url
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
yyzCSGOts/使用帮助(河东软件园).url
Resource
win10v2004-20240611-en
General
-
Target
a0fc06b15a4d17675bef776303d257a2_JaffaCakes118
-
Size
213KB
-
MD5
a0fc06b15a4d17675bef776303d257a2
-
SHA1
c72fc21447b7fdd4279da46fe20a470d2ed8d624
-
SHA256
cb35b167f9f49faa2074b4ea6f25a6805abfeee00eb2db6cf1bffaa782674561
-
SHA512
49bb6c2808d7059d4b852b6ffce91c6055bcf201d5bbf6c948529004302ef35afdac9f6ba2f4a6a250c0e8bc745a798aab6805e091f9217fa07b93ba3d789fac
-
SSDEEP
3072:frcvjCI03Rhm/J8euvWZ6nibBpqGCgdbPjDtgsvb9OtzUO093SFP+FZO46:fQMhox8eu0dlpDCxsvbxqAZ2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/yyzCSGOts/CSGO预言者单板透视小刀娱乐网专版/CSGO预言单板透视小刀娱乐网专版6.27.exe
Files
-
a0fc06b15a4d17675bef776303d257a2_JaffaCakes118.rar
-
yyzCSGOts/CSGO预言者单板透视小刀娱乐网专版/CSGO预言单板透视小刀娱乐网专版6.27.exe.exe windows:6 windows x86 arch:x86
c8bf3bad143145bacedc100017c4dc05
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateToolhelp32Snapshot
Module32First
Module32Next
CloseHandle
ReadProcessMemory
SetConsoleTextAttribute
GetStdHandle
Sleep
OpenProcess
WriteProcessMemory
HeapSize
ReadConsoleW
WriteConsoleW
SetStdHandle
FormatMessageW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RaiseException
RtlUnwind
GetLastError
FreeLibrary
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
HeapAlloc
HeapReAlloc
HeapFree
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
WriteFile
GetCommandLineA
GetCommandLineW
GetACP
GetCurrentThread
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
SetConsoleCtrlHandler
GetTimeZoneInformation
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
OutputDebugStringA
OutputDebugStringW
CreateThread
CreateFileW
user32
GetWindowThreadProcessId
FindWindowA
GetAsyncKeyState
Sections
.text Size: 450KB - Virtual size: 449KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 89KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
yyzCSGOts/CSGO预言者单板透视小刀娱乐网专版/使用说明.txt
-
yyzCSGOts/下载说明.htm.html
-
yyzCSGOts/使用帮助(河东软件园).url.url
-
yyzCSGOts/使用说明 (2).txt
-
yyzCSGOts/使用说明.txt