��{a�Q��\���+(��Y�L��FHS����FW��w6��rt��ޠY��<������������r�_X��pE�vLd���D�������Ca�>L(H�3^��9�0�>j��4�<���� �k �������վ5��;��2 ���Z�T��8�ݖ��﹪�����q-�<�I(�3Ěf�,pe�Ʒ��E(#�L�z��A�4#�|��y�_c0���F�3�JE�lWwV��v����]T3�n���{y�0>��}�Ep@��#R�UO�����WKĨ��_WD7�����s^�O�����a�E�8q��b��s&rC��ix���C ������M�.H9��v�Kz���3:n�!�Ɨ�æ(�"C�� ��jǺ'���!���{���bYC����5����/� of��_;����?�0x���F���������E���x��8���#v�7r����Pֽ�|����+c�:�ރW-@֑��� �P��z'塙C��m��g��(�F�I^8��NߞÄ˅O'���͜P[��'r��$�s�Z����#�b��*��� F�����lY�v6L�_W?�ļ^��|s�L�"y����:�~���m:�W����Փ3#B���+�t�R��G�KZ��>��Nm+"evC�y�h��ƾ�#�+���g���ƌ�Y_q�S�e�E��e�L��ؓ��.q"A%*�k��7h��<���;v�j)�x��ˉ��F9�U-�ȴ�vɚմ���Ii8"�<���i�f��N�r��f&���1���D���j �)ZZ��6$6��G�M3�i�h9�/龜�?��P`eM0��JO�֠������k<iJ��\7=�~�<�7��_ŧ�v�����A�v%5���?8`�^�#۳kP�������A�(慩�|%��We@-���qpo���)Z���Ci�ND�=�R{�JQ���S��W�Q�M��W��s��@��'���E�1X�Z��� ��ճ��"��͛i��'����g3=�(��s��rư�6 �:{y�e�����Q�:㩃&�� O3�I�왡s�����@ .�������Y"����E�/L�g����C�=��ǚߐ��{�tp�����v�����j��j \����/5�0z4c�ܵA�bNPү�D)�.�<���q���ذ�vX��$-�[�&���4���L,iHΒ�S}B �W�N�(�"��� T+GEwA�Js��݆�Q7����tg�Z�w���L�cJ�+�%�CB��?wO{L�=x�"W�5w��>�d�Ĕ/��pY�X�a�OxB̔f�z�DVm8��vu�b}��0� c��ƿ@�i�2�r�&�u��v��<�C��'�ZU���*������:�_Wf�<�L���4���ԁy��r�/y] ҄BjS�!w�����׆%J�(}�6uL"e�ty��T��~R|5�w�����ㄮ�������N%6,�7��h��GIP�����YR]'5�0��|=zr��]�r�����*���H��0��Y ,M.6\�:��e�h2M�v�x�] ��5;^����}��+~[�0�c^h�����7 qo𫏌l�ຨ7ϋ�]η#�!l/���H��Z�dod��/�p �u��N�|�-�iv���Az =@4�4�����S��w��鱖 !����5�� ��K($����T�' �aF$���Ɲ�[3� 3�` ]�tOb�u�6�O.H/���3_��&>h��-����v�{A�.�8�#�dmLe��R`�A�`�v�&�'���+��J���__٘��f�һ������6��E��W���Ŏ�� }��=C0�M���r���ǖ��W���K�dÇ+V+(xș��+�,> �e�rX���~�A�X.�)D�8�eǞ]����ޓރe:��vN�=:<�v�c�t|SWq�(� S-�f� $��� 0�J/ �I��;��3�-�:j2��C���ĉ��M�ai:��p'# d"X��Q�θ�C�Ii��}L�h��`w+�M2XG��1�q�2���/b˒��Z���E]��Ӓ�����۟a#?QH�㯰?*��=��b^&N��dz�h�;Х��/v�ՆޕCۍn����h=��E����I%��'b��(�-MJ��!O���.Z>�n�V�M�8H���tKl�˶�./F�S��Q��7�}G���C9h?���K�v�/6 NC4��A�x����;�O��*�$�%���Y���TgV��B�!����(^<u�Wa��l�<-&L����l |��N�. �a��њ � �j�I�=� � lK�XҶ� =�;V3ᒡõG.a@�< �!�5�>n��ʪn��6m��:I5@�j��s�F ��l�mS��ۛ�b`،)���y���n]�?����}��o�d�Xpt>��C n�(����9u[�k3!��sW�ѡn���*����6�;��K��� NG����� -�q��u��I��d~��]�<>��e�GU�_-��xT�Yv��l�=k��Y^�o������SkAƴ�w3U��C;�˒D�tU�tlY/�������+j�X���WȝA"f�����X �e̢�+���sϫ���\���=u!��Cbx9�������% ����plU�?fM������'J��n���s/q)g;� ��([j8�S]D�k�����������ϡ����lҘ����n~�9��T�r?�_�P����[{�U���л˓�V�0x3 ��g��Ďy�&5F�:PH0�����%>Ԥ��h�\��]�a�D���ȃt"Ώܯsf�����d�ͬ0�w[���*\0���L�&��w��}3h,�����K�R�ovc>�aH�4G��H�}D|E�?�uw�K��I�6j�ބ�;3�R�0^r�a�!j��ْ5l̞9�8&}ՆG��N7����K<��M�<ɻru�z�`Np�T|x�P��+5K��!�%������R�&(��Z^�g9u$�U=Ax��YG�W��C���Uz�$S� ��
Static task
static1
Behavioral task
behavioral1
Sample
京东抽奖.vmp.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
京东抽奖.vmp.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
使用说明.docx
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
使用说明.docx
Resource
win10v2004-20240508-en
General
-
Target
a8b2f976a5cc8222b9188838a61dfea5_JaffaCakes118
-
Size
2.2MB
-
MD5
a8b2f976a5cc8222b9188838a61dfea5
-
SHA1
27ee67a90872f52d326fea4bf625926a33853c81
-
SHA256
319e55d747cacbeab2143384122a9e8a6ef04f237f29cf9b79e57f3b36b8c061
-
SHA512
034f321815993cd0982b1b17ff03d6586d8451be71c06aefef09eeb683cc9ef3df0fa2a373f21742d24192abadf8ffc1321a0290b33ccc7caed0e0eb93f1aa86
-
SSDEEP
49152:zxC3qEzUUbkJSilDG/kih2sZ4ficlbi9Cij/pt64maWbaOIlbYUsGf:znEPAJSil0dHclbiPt6Z5uOIN6Gf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/京东抽奖.vmp.exe
Files
-
a8b2f976a5cc8222b9188838a61dfea5_JaffaCakes118.rar
-
京东抽奖.vmp.exe.exe windows:5 windows x86 arch:x86
79fa28da1b9691e7f6689841f326b111
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
IsBadReadPtr
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadStringA
gdi32
SetPolyFillMode
winmm
waveOutGetNumDevs
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueA
shell32
ShellExecuteA
ole32
OleInitialize
oleaut32
VariantChangeType
comctl32
ImageList_Destroy
ws2_32
accept
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 553KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 877KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 170KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.klil0 Size: - Virtual size: 835KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.klil1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
使用说明.docx.docx office2007
-
抽奖地址.txt