�7H��T���٢MF�_���Ⱦ����u�:=�����<��f%s"�������{Sv�һ��*�Npsw� Ս�*��h����̂�۲�VD���5� ���E����n��ñh�^���#�2*�B�%��<�6�ɨ�6��1Ð��[r�X�$/��Z}�20�O�+Ko.�^��뎈yn.�~���h"�}Auڣ���?�Z�3{t2�����U_�v~J?AL^F��Z!�;��ύ�[gC_k��l�Oѓ���������|�K�%��粹`c�7�� r��Q�L�5��`���ɔ�c�_�ez��� ?o�۳@��b2:�;�h�� Ϋ�3 ��g�OsH� �L�sNP¤��'6��#!�s^BlW�/bٌ�"��za6s%�1���Q���v�Cw"����b�\�j��Z4��>_�͛����jh^)"�M���'�W3����e5e��<s"�-�Q��ҶJ�}+nl'����XwϽ҂����>�D�1<���~i�K2���_�i/���;H@�1[���$4�"TC�j�fyg�J�5���^Ք��J=a&c[�be �f=��J���Ne��_�9ʍ"W 0&o�bh$�I��r�b�b~�O������P�����zu��4eԀ� St*b�Lt5�sp��G88��6��GzYΩ!�����kb�,�=t�Yl��i���3���Gp��ۭ�ʢ����8�+l'& ��9!�4��F���G@�TZ{:CB����_�'p*m��/���R4���xԪ���ご-4�Ŀ�اi˩ds3���Νz����Q��O��>��7���M5c+�^X���l�;m�+�ߐ[S9�L���هO���x��3�O�m4HB��R�;�'*[3-�iH�:�qU��#��������_6�_���7.u�9�#�*�*-c��������w;[K�5�����h�&�`θ�\��{�N����v��̾O5t`�� �؋Ps�&3�,o�����S���_c$2�t��vԄ����\�{p���~��B�"�y�|h�4��@~2��o�y��O=p@�N�ā�}�fO�v¦����`&��Qag/��7�KL{5n4CJ,���C�6;��>�0�H�c/�������߮R3��Lfv��)�N���ki;�kGH�#�C�������G��x�uuM��wĐ��yG>���sT�,�����5�Fa���n)[�l�� �����a�������������j���VT�b���WA�!���J�����z��{ߙ��n��u�Ӈ�J�)��s�W� ����A��%C��m��h0QtV�[8; ���/�(���$�X�����xB�8gH�v[��:gH�ص�Rs:4h���P�}�tΫo��៊.א,@���N�g��z���uc�$�K��^�]�tZ5���?��&�a���^�]���+*��5��w�6����F�=���xܠ��N����H��d��]�΅�8��bc�N��O`�b���-~�yT�W��<�9���H��V·�y�E�'S wɎ�+H4'��l`�3�(�z�/��U��e=���� �a��%�P ��AM殴�)�L݁��]\�'�p7������p�@N���,� ��l�#{ �5�zs����7m��D����}y�l�G֡����P��ߠ��Z��UER�� ��WU˺��o�ϖ���[���n���=���R�2Wf���@�0kV����Ko�6��.0q}������ E�� =y�o��Q.��0W�mB��L?#�T�Ki<n<E*X2�Q��3C=��KP����:�f��G��`(Һ,�p��x�'�t���=~L��Hb>��`�,����j��ϑ\����X��'l��l�[��Pge�l�v���U<�}���+�S58�k;�M~��!�d���� ���w�$�I�M�u�B�5' d<�c`C�w��V ��JL�,YY����$��}��Ho�PqT��CW~���(�'O%�;#^����ql�a�(+� ��2a��� ��N�1��h�*dSn�n� �,�kߤ�jc��%NHSCaO��:8�0�K����G�h�SHO~a���l�^7�k��_���G�`�Wv����.)'S��{(��:E�i[�U� k��ʼn���t4,�����ki��*�g�PAYL襚d�� ��� �q�*ׄ�`�;��aW!&��s��'�/�����T�1���.?I���Zbsc�� ��x&�ٞآ���K�/����Y���d ��+6����a�l�w�n������Ⱥ.�����؏aX���[+~��>�5�}�B���Y�)����E-������118 �O��+�0�.k���l|X��S�"���@�}I�=��%��.���`g���F� j�VM�z��0��Uo|#Mbnh{5��~�Z�u�����;�� 8���Y^�@��$YiO[��8��>�4��x����v�eY�0�V��NnaGcf==����2�_XZ���2���Z�p�/�� � �N��O�t�g]�hZ� ��D�E���; �S��X#z�*S�؉o�^�1!6H��D6�;nW������eNe��I�om��%U��z!"�i���.�5�-4O�V�6��ŵ�Ocj�V��X�[ڰ��;�V�Vs*��z���=<ٜЩ ����r�����c�)�[z;S�t�CK)t�N�2���S�r��I��s!�����k�6���XKDX3�M����r��B��g��y���&����y/�|��YU=��:#�V��T�E�|3k����R-�V�d��U8���Z跨֔��ݤ��9!^u�T�Pi�`��V_i�m�@sN��0�.��R� ��,a��V�ik�t�6����H�%�f����wLvw�����"��s���S�3".��[I�w^'��۠t��V[�d|�7,۲#i�]�S0��G���S�>�1�~o��qrz���H�BGu��SU&;r�V�0��a9�VΓK�@�~t���`ũi��\���T���{��7��q�+.��~M� �av� d6� ��^r��O| NS��R�X��o
Overview
overview
5Static
static
3斗破-大...el.dll
windows7-x64
5斗破-大...el.dll
windows10-2004-x64
5斗破-大...ao.dll
windows7-x64
1斗破-大...ao.dll
windows10-2004-x64
1斗破-大...ict.js
windows7-x64
3斗破-大...ict.js
windows10-2004-x64
3斗破-大...��.exe
windows7-x64
3斗破-大...��.exe
windows10-2004-x64
3斗破-大...��.bat
windows7-x64
1斗破-大...��.bat
windows10-2004-x64
1木木游�...om.url
windows7-x64
1木木游�...om.url
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
斗破-大斗师 3.6/Kernel.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
斗破-大斗师 3.6/Kernel.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
斗破-大斗师 3.6/hao.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
斗破-大斗师 3.6/hao.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
斗破-大斗师 3.6/lua/strict.js
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
斗破-大斗师 3.6/lua/strict.js
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
斗破-大斗师 3.6/斗破辅助.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
斗破-大斗师 3.6/斗破辅助.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
斗破-大斗师 3.6/注册答题控件.bat
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
斗破-大斗师 3.6/注册答题控件.bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
木木游戏网-www.mumu168.com.url
Resource
win7-20240419-en
Behavioral task
behavioral12
Sample
木木游戏网-www.mumu168.com.url
Resource
win10v2004-20240508-en
General
-
Target
a60209d4870fc9b2616337269018424c_JaffaCakes118
-
Size
7.9MB
-
MD5
a60209d4870fc9b2616337269018424c
-
SHA1
66f93f4acbebf8573759f3aaa5a360463ef7936f
-
SHA256
57dad5531de1e839615c34d574dbcd4caaec3ff9f7ecb060c79872826bc651f0
-
SHA512
cf638e341b9406168412d3707c452c1a57be6fb72d9c39e0cb875e2ed4a7a9e32e3910b1eedc53cff82c5f1de33def9a76077e6e50be7a5650e32277a0b4b881
-
SSDEEP
196608:6zOPhdzSBQjziyQZxNES7999GthO6ROvaTBsE+PQdnj5GJ7Je:6zOz7jtQfNESx9+zOvatb+Ydj567c
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/斗破-大斗师 3.6/Kernel.dll unpack001/斗破-大斗师 3.6/hao.dll unpack001/斗破-大斗师 3.6/斗破辅助.exe
Files
-
a60209d4870fc9b2616337269018424c_JaffaCakes118.rar
-
下载说明.txt
-
斗破-大斗师 3.6/Config.ini
-
斗破-大斗师 3.6/Datas.dat
-
斗破-大斗师 3.6/Kernel.dll.dll windows:5 windows x86 arch:x86
142593406d6650d191ecf9529f825efb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
FreeResource
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadMenuA
gdi32
LPtoDP
msimg32
GradientFill
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
advapi32
SetFileSecurityA
shell32
DragFinish
comctl32
InitCommonControlsEx
shlwapi
PathIsUNCA
oledlg
ord7
ole32
CoCreateInstance
oleaut32
SysAllocString
winmm
PlaySoundA
d3d9
Direct3DCreate9
version
GetFileVersionInfoSizeA
ws2_32
inet_addr
Exports
Exports
Sections
.textbss Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 527KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 213KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didat Size: - Virtual size: 793B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
斗破-大斗师 3.6/hao.dll.dll regsvr32 windows:4 windows x86 arch:x86
bca036691c89f77c4a52ccfaf4446e90
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvbvm60
ord693
ord698
MethCallEngine
ord516
ord626
ord629
ord553
ord593
ord300
ord594
ord301
ord595
ord303
ord598
ord306
ord520
ord307
ord309
ord632
ord526
EVENT_SINK_AddRef
ord528
ord529
ord560
ord561
ord562
DllFunctionCall
ord567
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord712
ord606
ord608
ord531
ord716
ord717
ProcCallEngine
ord644
ord645
ord570
ord573
ord576
ord685
ord101
ord102
ord103
ord104
ord610
ord105
ord616
ord617
ord619
ord542
ord545
ord546
ord581
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
斗破-大斗师 3.6/lua/LuaMain.lua
-
斗破-大斗师 3.6/lua/strict.lua.js
-
斗破-大斗师 3.6/lua/test.lua
-
斗破-大斗师 3.6/lua/回城.lua
-
斗破-大斗师 3.6/lua/宗派任务.lua
-
斗破-大斗师 3.6/lua/挂机.lua
-
斗破-大斗师 3.6/lua/自动炼丹.lua
-
斗破-大斗师 3.6/lua/采集.lua
-
斗破-大斗师 3.6/profile/default.ini
-
斗破-大斗师 3.6/warning.wav
-
斗破-大斗师 3.6/地图.ini
-
斗破-大斗师 3.6/斗破辅助.exe.exe windows:5 windows x86 arch:x86
d7809ff9771b9d4e62bf60fc3bc0f980
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EmptyClipboard
gdi32
SetBkMode
msimg32
TransparentBlt
comdlg32
GetFileTitleA
winspool.drv
GetJobA
advapi32
OpenSCManagerA
shell32
SHGetFileInfoA
comctl32
ImageList_AddMasked
shlwapi
PathFindFileNameA
oledlg
ord7
ole32
CoInitialize
oleaut32
VarBstrFromCy
gdiplus
GdipGetImageGraphicsContext
ws2_32
ioctlsocket
version
VerQueryValueA
imm32
ImmGetOpenStatus
winmm
PlaySoundA
Exports
Exports
w4�paj���y+ �)f���rK�����0��X�i������u������O�M�QhFF���R����W�Lm������s`�B&�Ds@���>/q����1[k�$���?�F�hr�-��\h��.zs3l��^<�̡7�j�?��W,�E���G+M�/r�0B��s���_�C�v3c��|zR -��,�N+&�c�0���+aG�ס���$���1�J�<��)k��r?(��O��/�Q�W\A�I'ϐ�H �JT�� �{0u#��[MF��W ������n�9��K�f�bv��+'���=v ��M��G� ���B��-�W��}6��������b�����%�*���5�9������ߡZ��Gj͈/u�R�*��3���-H�6����8�M�B���m�����L�Pꈗ��0�`����Q�1HB�X�ykn��-l�����s��k%��R�N �P��Y0�W��a!��gm+�(>8N����t�(�}(m��S�J�B�jߗ-��H���'��J(�mG��ú���>\o� � 1��]�w�j�J��Rm[���Ap\��ï��q�R�r�����mD��J6��݃5�-��ﯿU��=��J�O)*�� zi��zd#� ��q�b䈆4i#�������i>s��xUŀ�����-��y:�.���Z�A䁡*&@H8��d�� T���[���^kK�#+�h��c��,��xHh��`<���m�w�n���O� ���ҡ5���*x���� \?U`O��$��C���x�u�K�3Jna� Y2GMvꛀ��ǧ�[Ex!K<ˉ!=ߎ2� +�����T0��R@w��"7�G��@ ����8���y6�]P��T�B����,l.$����Fe_=��g�Y�~�|ޣ��ZUx�H'�`˜�v���/�u3]=�����0#C(�(LN�\ט i��,"����~x�5���������`X`��29�.w�ivi����'#��<��xA�A�'��'�=� ��ѕ.����ܜ�S�a�� 3u+�������6�u>�E���+?������p�����ұ= 6����c���j����WϢ& �j�)��:�58��q�����/�G1����^%Փ��X���r`%sNX@*)"wĞWA�Vm`�LhL�NAV�hp��ͥb�;[��0r�4�'�F�����m���� g��ϓ����~q�����F[��~��΅6�L��?�[�Iy� �B�v����*Ƨë�I���������� 5��D�&�f�����n�� b�_�� �lbN�y/l�Fa�RX\�l9;��6b\����K$AiR�p̝�V��2ƥ��*n���ߦA�+t3@1�x�4H_*}Nu��CH9���X������GB����^����`�-NT*#F�� D�"n�IX�>S�hmX~Ŀ�����LI��������'a�9���>���y-�x��s|�z�;�4�=�}͛tE��6�Q�.�m$غ�1�x��$ ���tx��@L�v�xY{�w�)��vm)�9vm��Y���BR�nK˳߳U���nBR���$�uL����yl5C?��5���i��2B�#���[��x�U�A���;x���ь��7v�2Y� �7j���4p��gUur��EC���s]D�@��'���X�Ҕ����:-�~�pΥ��@c�S���Êr�M)�Z�b��[v��4o�B�H�%<�ɪ^��Nj�8&����lbU$�${[O�������xX}�S[0o���ͮI}��O�j9<P2@�P��8��j�ي����}#��K�I�R���;s%`�>�v�` ��4(�s�x.s���Xׅ��77�)g�T���J��źN�+��W�YKb����uA���\��/j)�P���U�f�� B��Za(��J1�p����.�� [|%�Y�8���Τ�۶���}B8�p�-�}�%?�9��9��-�fOv��(����%��s���+�ym�?�i9#ϴA���Ϙ�{ʬ�S�;T៑�)�����m�M�y�,�u�_|H�XA�K�k\ɟAV��_�ej�Oq�u$��V����(�O�\�<�Ei���kŗ<�i���:�s�5D�o�4L��c��;1k���>7�D�.맿CHPz�� �<�g��Tsoe�HK3p�t�>�p�"��ɇ�v��{+BD;@[��F ��5���ͫOQX��6䷼��otr�zm��c�|�S�8<RI�������������'���R�R���<C��%���OF,٦��`k�|u�:_{KČ��y1X�ǁ��c�_��#K]|���g��-[���JTg�?g����G�&��B���C�ڄ\�XF@В�%���:3�W U:d����q���0%i�`L@��:��73(C�_�E�;'��?R&zz�������������ʘ�q�KJI�خ��~���F�pA����j�C��;�H��-�k�W�0��0�$��@�mL�u?�;��A*"����J-n�߷�o�Z�M͌D�ZP�9�),����G{�������m�f�~.�!ř�F������YF���|q)�!�����������Q����CoR������Y�ш�l���|sõ�:�T'.���?�ȃ�O=��x�:��}�u�����#;܊~P ѳ��~�V6�)�ë�,�(5*�5��0}�>�)��"���e���6 2?��y.��$T��í��� ���~�ۙ��΄/mg�_u���%��껺�}R�+��}SUM��fT$`L?y��[���J`8-C^>*���.ո������W������,Ր�O��%�[��s7 �]M�4G�M$�U��_��a���5��hɥ��8o�LJg�����/�F[��H�I���h����/g��h���8��{����@����p�n�=��&,5IJp�qC��d�!^7�R��.�Z���Z֫B���*�M��r$ׂOۮ��N���\G�o0 Z3ǎ�� q$"N�ϳ$�����K�
Sections
.textbss Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 4.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 692KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didat Size: - Virtual size: 793B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 368B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 82KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
斗破-大斗师 3.6/注册答题控件.bat
-
木木游戏网-www.mumu168.com.url.url