a380b931561c5ee9d04d874d58d5d065_JaffaCakes118
- SHA256 69706777a58ceda09c965baba5b223874f6b4e42b55f65c0a792de951d60db2b
Behavioral task
behavioral1
Sample
3H3GAME-SpintiresTr.+5.hulovexu1314/jedata.dll
Resource
win7-20240419-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
3H3GAME-SpintiresTr.+5.hulovexu1314/jedata.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
3H3GAME-SpintiresTr.+5.hulovexu1314/《旋转轮胎(Spintires)》Trainer.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
3H3GAME-SpintiresTr.+5.hulovexu1314/《旋转轮胎(Spintires)》Trainer.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
3H3GAME-SpintiresTr.+5.hulovexu1314/当游网-单机游戏门户站.url
Resource
win7-20240611-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
3H3GAME-SpintiresTr.+5.hulovexu1314/当游网-单机游戏门户站.url
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target a380b931561c5ee9d04d874d58d5d065_JaffaCakes118
- Size 507KB
- Sample240613-cm4e1avaqk
- SHA256 69706777a58ceda09c965baba5b223874f6b4e42b55f65c0a792de951d60db2b
- MD5 a380b931561c5ee9d04d874d58d5d065
- SHA1 5da8c22619a34b7e2d0b7ff500f75ff28b91780c
- SHA512 1f4f24c6ce957e6326347f08d14264fe5cd11768579ab86ee82cf20e20d04c42485b65eae0cb9316bb6ea76c60db686927dc046c13de373b07a76b20141ecd8a
- SSDEEP 12288:rET/XHlJd+OvIRFcl1pVIElByTLrYXTEPL/:QpJTvIRFcf1oIXK
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule static1/unpack001/3H3GAME-SpintiresTr.+5.hulovexu1314/jedata.dll acprotect -
resource yara_rule static1/unpack001/3H3GAME-SpintiresTr.+5.hulovexu1314/jedata.dll upx static1/unpack001/3H3GAME-SpintiresTr.+5.hulovexu1314/《旋转轮胎(Spintires)》Trainer.exe upx - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/3H3GAME-SpintiresTr.+5.hulovexu1314/jedata.dll unpack001/3H3GAME-SpintiresTr.+5.hulovexu1314/《旋转轮胎(Spintires)》Trainer.exe unpack003/out.upx
File Explorer
-
a380b931561c5ee9d04d874d58d5d065_JaffaCakes118.rar 507KB
-
3H3GAME-SpintiresTr.+5.hulovexu1314/jedata.dll.dll 86KB
-
3H3GAME-SpintiresTr.+5.hulovexu1314/《旋转轮胎(Spintires)》Trainer.exe.exe 430KB
-
out.upx.exe 820KB
-
3H3GAME-SpintiresTr.+5.hulovexu1314/使用说明.txt1KB
-
3H3GAME-SpintiresTr.+5.hulovexu1314/当游网-单机游戏门户站.URL175B
-
3H3GAME-SpintiresTr.+5.hulovexu1314/皮肤.she6KB
3H3GAME-SpintiresTr.+5.hulovexu1314/jedata.dll
- SHA256 e15d9e1b772fed3db19e67b8d54533d1a2d46a37f8b12702a5892c6b886e9db1
- MD5 114054313070472cd1a6d7d28f7c5002
- SHA1 9a044986e6101df1a126035da7326a50c3fe9a23
- SHA512 a2ff8481e89698dae4a1c83404105093472e384d7a3debbd7014e010543e08efc8ebb3f67c8a4ce09029e6b2a8fb7779bb402aae7c9987e61389cd8a72c73522
- SSDEEP 1536:0OYdF5pkapU0uz96DjsVgsIm65HPdOMpFQEMqUktZcNqLODRv7zFpl91nouy8jg:0HDp7pRuKjsir5HZFQGrsUwF7hplPouG
- MD5 SHA1 SHA512 SSDEEP
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
245488
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
SkinH_AdjustAero
SkinH_AdjustHSV
SkinH_Attach
SkinH_AttachEx
SkinH_AttachExt
SkinH_AttachRes
SkinH_AttachResEx
SkinH_Detach
SkinH_DetachEx
SkinH_GetColor
SkinH_LockUpdate
SkinH_Map
SkinH_NineBlt
SkinH_SetAero
SkinH_SetBackColor
SkinH_SetFont
SkinH_SetFontEx
SkinH_SetForeColor
SkinH_SetMenuAlpha
SkinH_SetTitleMenuBar
SkinH_SetWindowAlpha
SkinH_SetWindowMovable
SkinH_VerifySign
Name
UPX0
Size
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
83KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=14, version=7299,
count=4, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=6, productName=Unmarked objects (old),
count=11, id=19, version=8034,
count=196, id=1, productName=Unmarked objects,
count=67, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=3, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
3H3GAME-SpintiresTr.+5.hulovexu1314/《旋转轮胎(Spintires)》Trainer.exe
- SHA256 768302af165d817005e3f4f692392d4077217dadd1a465e35b4a90372b9bafe9
- MD5 307ff4d4d6e2067133e36b274b8e9d87
- SHA1 d88843351586cda412bc312669bb6ceefdb67d5d
- SHA512 2543777dd3a41b2948e1212165851b768f5a09a33754db857c32be05016b6ee763b55552b4d54235e1c1938cfd8f8da8fea8557c16b13bb83ee20a90ed5d8451
- SSDEEP 6144:GU71BBd6/4/vK4x9oUgVTaIQVNHnP0q6vFO6vuPZn9T/3y5UQAIQKaL7aQY89Qke:bfbcwV5nMptO62J9T65yRalSv2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
964832
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
524KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
415KB
Virtual Size
416KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
14KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=3, id=12, version=7291,
count=44, id=19, version=8022,
count=44, id=14, version=7299,
count=185, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=97, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=633, id=1, productName=Unmarked objects,
count=25, id=19, version=8034,
count=19, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=83, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=32, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
out.upx
- SHA256 d85394db255d0fba78ee98a35ee4c94e9cba9fe192ec7c78626295b72fff9c05
- MD5 a2879a068c3eab05a0a2d9af6ddf29f9
- SHA1 78f28f76520e327cb202914d7bf06e618d9bb5ba
- SHA512 d7eef18c99d5e94c7728423cb687de2ac6a789167d0870b1724902b8655804e7c292a3e145825450ded51cdad14e78b4c402b309a447b22621125b0200bea73e
- SSDEEP 12288:TExhXdmBAPmGz5ZRuAbV7tGSV/fi5YR5nWFpPoS+G3:TCABAOGXRuAbV7tvV/aVbAG3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
378093
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
492KB
Virtual Size
489KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
208KB
Virtual Size
204KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
80KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
36KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=12, version=7291,
count=44, id=19, version=8022,
count=44, id=14, version=7299,
count=185, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=97, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=633, id=1, productName=Unmarked objects,
count=25, id=19, version=8034,
count=19, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=83, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=32, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
3H3GAME-SpintiresTr.+5.hulovexu1314/使用说明.txt
- SHA256 2cc14a732144e07b2897955c669a0ef18be0ecd457fc331cbbcd1acab477a32e
- MD5 66d17c5b66d672cef6cc7537603fc55f
- SHA1 312c68116d347109e99f555f588eb2b8b26ab4df
- SHA512 e3c22be48f81a28e7ff80fd91ab6c44818a0173d1aaada4959a221a29d4493d70115186ce660a0822c0ff4af71c166f24cb2ca0c7df24b1ca9bd65cc7ca089c7
- MD5 SHA1 SHA512
3H3GAME-SpintiresTr.+5.hulovexu1314/当游网-单机游戏门户站.URL
- SHA256 1ef373aa75228ded62347eacb4968bfd9474c72aa435fb65c69cddbddd8c321b
- MD5 bccc162375cf6c7b4e35b0cf641306f2
- SHA1 7afe1e15b060af4526d2f30ec9b16976d5300af3
- SHA512 5b1b9c5f52dba92b06654189280c6d27108cffb9254b81a349bb5eeab717c800c497100df58182cc3e5782e83e572a4e4db06f8bee243af2668a861f6c45136e
- MD5 SHA1 SHA512
3H3GAME-SpintiresTr.+5.hulovexu1314/皮肤.she
- SHA256 699312590f11763a6c8ffab469c9702a849d8fe3ba69b77720e0cbb3802b9ee3
- MD5 d1e5a42fc42cb8c779c7f12b58f3464e
- SHA1 06b72e4b49c346822e76e7491170f19ec5f10e5e
- SHA512 51f786f5d1e6fd24e2a9209030ea65ef04c784bbb0a5fcc53347ec7322627f1549d557744080bee39fb1e8e4f065d1e703576985d4e80fe20d9c8cc5fb61f7fc
- SSDEEP 192:yFoQ1b47F2iyUBUJQD7IO4Cd7y8vPO4Xh6ncQ:HQZ9UBSQD7Iod+C6ncQ
- MD5 SHA1 SHA512 SSDEEP