Overview
overview
3Static
static
3flash521/a...in.vbs
windows7-x64
1flash521/a...in.vbs
windows10-2004-x64
1flash521/a...et.vbs
windows7-x64
1flash521/a...et.vbs
windows10-2004-x64
1flash521/a...ck.asp
windows7-x64
3flash521/a...ck.asp
windows10-2004-x64
3flash521/a...ck.vbs
windows7-x64
1flash521/a...ck.vbs
windows10-2004-x64
1flash521/a...in.vbs
windows7-x64
1flash521/a...in.vbs
windows10-2004-x64
1flash521/a...nn.vbs
windows7-x64
1flash521/a...nn.vbs
windows10-2004-x64
1flash521/a...st.vbs
windows7-x64
1flash521/a...st.vbs
windows10-2004-x64
1flash521/a...dd.asp
windows7-x64
3flash521/a...dd.asp
windows10-2004-x64
3flash521/a...it.vbs
windows7-x64
1flash521/a...it.vbs
windows10-2004-x64
1flash521/a...re.vbs
windows7-x64
1flash521/a...re.vbs
windows10-2004-x64
1flash521/a...ve.vbs
windows7-x64
1flash521/a...ve.vbs
windows10-2004-x64
1flash521/a...In.vbs
windows7-x64
1flash521/a...In.vbs
windows10-2004-x64
1flash521/a...ex.asp
windows7-x64
3flash521/a...ex.asp
windows10-2004-x64
3flash521/a...gin.js
windows7-x64
3flash521/a...gin.js
windows10-2004-x64
3flash521/a...ut.asp
windows7-x64
3flash521/a...ut.asp
windows10-2004-x64
3flash521/a...d5.vbs
windows7-x64
1flash521/a...d5.vbs
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
flash521/admin1/admin.vbs
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
flash521/admin1/admin.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
flash521/admin1/adminset.vbs
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
flash521/admin1/adminset.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
flash521/admin1/aspcheck.asp
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
flash521/admin1/aspcheck.asp
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
flash521/admin1/check.vbs
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
flash521/admin1/check.vbs
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
flash521/admin1/chkadmin.vbs
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
flash521/admin1/chkadmin.vbs
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
flash521/admin1/conn.vbs
Resource
win7-20240419-en
Behavioral task
behavioral12
Sample
flash521/admin1/conn.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
flash521/admin1/guest.vbs
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
flash521/admin1/guest.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
flash521/admin1/guest_add.asp
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
flash521/admin1/guest_add.asp
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
flash521/admin1/guest_edit.vbs
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
flash521/admin1/guest_edit.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
flash521/admin1/guest_more.vbs
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
flash521/admin1/guest_more.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
flash521/admin1/guest_save.vbs
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
flash521/admin1/guest_save.vbs
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
flash521/admin1/images/NK_SqlIn.vbs
Resource
win7-20240220-en
Behavioral task
behavioral24
Sample
flash521/admin1/images/NK_SqlIn.vbs
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
flash521/admin1/index.asp
Resource
win7-20240611-en
Behavioral task
behavioral26
Sample
flash521/admin1/index.asp
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
flash521/admin1/login.js
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
flash521/admin1/login.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
flash521/admin1/logout.asp
Resource
win7-20240611-en
Behavioral task
behavioral30
Sample
flash521/admin1/logout.asp
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
flash521/admin1/md5.vbs
Resource
win7-20240419-en
Behavioral task
behavioral32
Sample
flash521/admin1/md5.vbs
Resource
win10v2004-20240226-en
General
-
Target
0d673f89c0699ede16b7f2fbf7453141_JaffaCakes118
-
Size
11.8MB
-
MD5
0d673f89c0699ede16b7f2fbf7453141
-
SHA1
2f85ac4b85959f2dda72c6a34e484b4fa42de6ff
-
SHA256
3f500a52d108a2e1c66a3bdcd2b408ac4f2487ac916967102bbe95f80c1cd280
-
SHA512
cb2895651454a62479fb65be8f7194de4c1be1603ea64432ad3da47c22bd483e09574bec817acc43b4d57433eae32da43c38338c7e0734f156379a87314d62f7
-
SSDEEP
196608:d7W2Gm+rYP0s33wT4w4TDXF/zlLw7LF8g0h8Qu/k06Ph3GrhOLTULIIkJ+hAc06O:d7bF+rYMu3o4lTj9lLn1qQTPPJGrhOXF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/flash521/flashgbook/admin/Aws.exe
Files
-
0d673f89c0699ede16b7f2fbf7453141_JaffaCakes118.rar
-
flash521/1tb.swf
-
flash521/2tb.swf
-
flash521/3tb.swf
-
flash521/4tb.swf
-
flash521/5tb.swf
-
flash521/6tb.swf
-
flash521/LOGO.gif.gif
-
flash521/admin1/_desktop.ini
-
flash521/admin1/admin.asp.vbs
-
flash521/admin1/adminset.asp.vbs
-
flash521/admin1/aspcheck.asp.asp .vbs polyglot
-
flash521/admin1/check.asp.vbs
-
flash521/admin1/chkadmin.asp.vbs
-
flash521/admin1/conn.asp.vbs
-
flash521/admin1/css.css
-
flash521/admin1/data/_desktop.ini
-
flash521/admin1/data/guest1.mdb
-
flash521/admin1/guest.asp.vbs
-
flash521/admin1/guest_add.asp
-
flash521/admin1/guest_edit.asp.vbs
-
flash521/admin1/guest_more.asp.vbs
-
flash521/admin1/guest_save.asp.vbs
-
flash521/admin1/images/D_Tu_DL.gif.gif
-
flash521/admin1/images/NK_SqlIn.Asp.vbs
-
flash521/admin1/images/SqlIn.mdb
-
flash521/admin1/images/_desktop.ini
-
flash521/admin1/images/style.css
-
flash521/admin1/index.asp
-
flash521/admin1/login.asp.js
-
flash521/admin1/logout.asp
-
flash521/admin1/md5.asp.vbs
-
flash521/admin1/menu.asp.html .js polyglot
-
flash521/admin1/reply_edit.asp.vbs
-
flash521/admin1/reply_save.asp.vbs
-
flash521/admin1/saveadmin.asp.vbs
-
flash521/admin1/top.asp.vbs
-
flash521/admin1/upload_5xsoft.inc.html .vbs polyglot
-
flash521/admin1/upsave.asp.vbs
-
flash521/admin1/xgmima.asp
-
flash521/asp/luangjian.asp
-
flash521/conn.asp.vbs
-
flash521/e1.swf
-
flash521/exec5/xmlForExec5.xml.xml
-
flash521/flashgbook/admin/Aws.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
test Size: - Virtual size: 988KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
data Size: 625KB - Virtual size: 628KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
flash521/flashgbook/admin/admin.asp.html
-
flash521/flashgbook/admin/admin_conn.asp.vbs
-
flash521/flashgbook/admin/bottom.asp
-
flash521/flashgbook/admin/css.css
-
flash521/flashgbook/admin/data.asp.vbs
-
flash521/flashgbook/admin/error.asp.html
-
flash521/flashgbook/admin/gbook.asp.vbs
-
flash521/flashgbook/admin/index.asp.html
-
flash521/flashgbook/admin/login.asp.vbs
-
flash521/flashgbook/admin/main.asp.vbs
-
flash521/flashgbook/admin/pwd.asp.vbs
-
flash521/flashgbook/admin/stone_Upfile.asp.asp .vbs polyglot
-
flash521/flashgbook/admin/stone_Upload.asp.html .vbs polyglot
-
flash521/flashgbook/admin/stone_Uponefile.asp.vbs
-
flash521/flashgbook/admin/stone_Uppic_b.asp.vbs
-
flash521/flashgbook/admin/stone_Uppic_s.asp.vbs
-
flash521/flashgbook/admin/top.asp
-
flash521/flashgbook/admin/web_Set.asp.vbs
-
flash521/flashgbook/data.asp
-
flash521/flashgbook/data/xintiao.mdb
-
flash521/flashgbook/images/bg.jpg.jpg
-
flash521/flashgbook/inc/AC_RunActiveContent.js.js
-
flash521/flashgbook/inc/add.asp.vbs
-
flash521/flashgbook/inc/conn.asp.vbs
-
flash521/flashgbook/inc/gbook_set.asp.asp .vbs polyglot
-
flash521/flashgbook/inc/page.asp.asp .vbs polyglot
-
flash521/flashgbook/inc/show.asp.asp .vbs polyglot
-
flash521/flashgbook/inc/web_set.asp.vbs
-
flash521/guest.asp.vbs
-
flash521/guest.swf
-
flash521/houtai.swf
-
flash521/index-y.htm.html .js polyglot
-
flash521/index-y.swf
-
flash521/index.asp.asp .vbs polyglot
-
flash521/index.html.html .js polyglot
-
flash521/index.swf
-
flash521/kuzang.swf
-
flash521/ld.swf
-
flash521/mp3player.xml
-
flash521/mtv.swf
-
flash521/myadv.xml
-
flash521/mycodes.net说明.txt
-
flash521/read.asp.vbs
-
flash521/send.asp.vbs
-
flash521/sendre.asp.vbs
-
flash521/tp/1.JPG.jpg
-
flash521/tp/2.JPG.jpg
-
flash521/tp/3.JPG.jpg
-
flash521/tp/4.JPG.jpg
-
flash521/tp/5.JPG.jpg
-
flash521/tp/6.JPG.jpg
-
flash521/tp/7.JPG.jpg
-
flash521/tpf/021401b4e14830e6beee841710de9d94.jpg.jpg
-
flash521/tpf/050c83cba49002073e23a81a918d3439.jpg.jpg
-
flash521/tpf/059e7cdc55fada9c1179fc11555a6619.jpg.jpg
-
flash521/tpf/079f3be511c5e1d0c161ec7932899ddd.jpg.jpg
-
flash521/tpf/1.jpg.jpg
-
flash521/tpf/10.jpg.jpg
-
flash521/tpf/11.jpg.jpg
-
flash521/tpf/12.jpg.jpg
-
flash521/tpf/129babbe36115b3a87d925a7083345bf.jpg.jpg
-
flash521/tpf/13.jpg.jpg
-
flash521/tpf/14.jpg.jpg
-
flash521/tpf/15.jpg.jpg
-
flash521/tpf/16.jpg.jpg
-
flash521/tpf/17.jpg.jpg
-
flash521/tpf/18.jpg.jpg
-
flash521/tpf/19.jpg.jpg
-
flash521/tpf/2.jpg.jpg
-
flash521/tpf/20.jpg.jpg
-
flash521/tpf/21.jpg.jpg
-
flash521/tpf/22.jpg.jpg
-
flash521/tpf/23.jpg.jpg
-
flash521/tpf/24.jpg.jpg
-
flash521/tpf/25.jpg.jpg
-
flash521/tpf/26.jpg.jpg
-
flash521/tpf/26d39b54f7d1163736e2abec8d4b2ad5.jpg.jpg
-
flash521/tpf/27.jpg.jpg
-
flash521/tpf/28.jpg.jpg
-
flash521/tpf/29.JPG.jpg
-
flash521/tpf/3.jpg.jpg
-
flash521/tpf/30.JPG.jpg
-
flash521/tpf/31.JPG.jpg
-
flash521/tpf/32.JPG.jpg
-
flash521/tpf/33.JPG.jpg
-
flash521/tpf/34.JPG.jpg
-
flash521/tpf/35.JPG.jpg
-
flash521/tpf/3595d9e279475622d3882be82fa8e21a.jpg.jpg
-
flash521/tpf/36.JPG.jpg
-
flash521/tpf/37.jpg.jpg
-
flash521/tpf/38.jpg.jpg
-
flash521/tpf/39.jpg.jpg
-
flash521/tpf/3969b041908e3db1ed47e2d79abaae10.jpg.jpg
-
flash521/tpf/4.jpg.jpg
-
flash521/tpf/40.jpg.jpg
-
flash521/tpf/41.jpg.jpg
-
flash521/tpf/43.jpg.jpg
-
flash521/tpf/44.jpg.jpg
-
flash521/tpf/45.jpg.jpg
-
flash521/tpf/45fc4d855f13a7767436324c2955e9ec.jpg.jpg
-
flash521/tpf/46.jpg.jpg
-
flash521/tpf/47.jpg.jpg
-
flash521/tpf/48.jpg.jpg
-
flash521/tpf/49.jpg.jpg
-
flash521/tpf/5.jpg.jpg
-
flash521/tpf/50.jpg.jpg
-
flash521/tpf/507f337f9ea3b003d2c506c108abc1e2.jpg.jpg
-
flash521/tpf/51.jpg.jpg
-
flash521/tpf/518a05548f833a3b652907af43b2a186.jpg.jpg
-
flash521/tpf/52.jpg.jpg
-
flash521/tpf/53.jpg.jpg
-
flash521/tpf/53cf4025b47ff1770540d103a7035013.jpg.jpg
-
flash521/tpf/54.jpg.jpg
-
flash521/tpf/541437c800ba0352b4e884e3bc90db39.jpg.jpg
-
flash521/tpf/5488746c29ef8429cd52d4808cce347b.jpg.jpg
-
flash521/tpf/55.JPG.jpg
-
flash521/tpf/57d1f6f77e1909f23d86800b3209b005.jpg.jpg
-
flash521/tpf/58717a054543d18844b631dc5604a21e.jpg.jpg
-
flash521/tpf/6.jpg.jpg
-
flash521/tpf/62e4f57e52f11e2ee4207d12920ed320.jpg.jpg
-
flash521/tpf/7.jpg.jpg
-
flash521/tpf/71a2cec0f95f2b5c117c1d9476a025b7.jpg.jpg
-
flash521/tpf/73b7602c31288f5e78c48eef8c27c098.jpg.jpg
-
flash521/tpf/8.jpg.jpg
-
flash521/tpf/9.jpg.jpg
-
flash521/tpf/957fcacaab5930b25d196026b4a459e8.jpg.jpg
-
flash521/tpf/9648a98a0498465f8665dbcf89aaec38.jpg.jpg
-
flash521/tpf/989b5d2d3e7758df60493113bdd3d4a7.jpg.jpg
-
flash521/tpf/9b223312cfd697e817e0c28c313a77e9.jpg.jpg
-
flash521/tpf/9c7eabdbc7056f1221f208414af65191.jpg.jpg
-
flash521/tpf/9cb838680486e2ad4a25c5f5eadc8c2c.jpg.jpg
-
flash521/tpf/9cc7bfe1d3442b009bf9ba7996a9d05e.jpg.jpg
-
flash521/tpf/9f692bb38c957e229edbc3506d527751.jpg.jpg
-
flash521/tpf/a5658ce06298cbd3f68fa8daf26cd3e4.jpg.jpg
-
flash521/tpf/a9cccbaf23cc0c6f7d62b0f12c7db1a8.jpg.jpg
-
flash521/tpf/ab7c57672679030c886a3a1e5323c851.jpg.jpg
-
flash521/tpf/ac4d643290ddfbda556c52665d99d9ce.jpg.jpg
-
flash521/tpf/acc393d72a345fc10bcfde4cdbcaf184.jpg.jpg
-
flash521/tpf/ad5b51b021967aa420c43787dcc67e1f.jpg.jpg
-
flash521/tpf/b0506229984f7bd936acef74498db430.jpg.jpg
-
flash521/tpf/b7420292d2440d3a097af280a7c8f4f7.jpg.jpg
-
flash521/tpf/b8031a74fdbfaf6f673963d0b8d68a32.jpg.jpg
-
flash521/tpf/ba8ced4a205e13625aa5a6345277a2cc.jpg.jpg
-
flash521/tpf/bc882ece954523f3b87e9e2ff188b886.jpg.jpg
-
flash521/tpf/bd61253e0a3e3ddd914da6de72411375.jpg.jpg
-
flash521/tpp/1.jpg.jpg
-
flash521/tpp/10.jpg.jpg
-
flash521/tpp/11.jpg.jpg
-
flash521/tpp/12.jpg.jpg
-
flash521/tpp/13.jpg.jpg
-
flash521/tpp/14.jpg.jpg
-
flash521/tpp/15.jpg.jpg
-
flash521/tpp/16.jpg.jpg
-
flash521/tpp/17.jpg.jpg
-
flash521/tpp/18.jpg.jpg
-
flash521/tpp/19.jpg.jpg
-
flash521/tpp/2.jpg.jpg
-
flash521/tpp/20.jpg.jpg
-
flash521/tpp/21.jpg.jpg
-
flash521/tpp/22.jpg.jpg
-
flash521/tpp/23.jpg.jpg
-
flash521/tpp/24.jpg.jpg
-
flash521/tpp/25.jpg.jpg
-
flash521/tpp/26.jpg.jpg
-
flash521/tpp/27.jpg.jpg
-
flash521/tpp/28.jpg.jpg
-
flash521/tpp/29.JPG.jpg
-
flash521/tpp/3.jpg.jpg
-
flash521/tpp/30.JPG.jpg
-
flash521/tpp/31.JPG.jpg
-
flash521/tpp/4.jpg.jpg
-
flash521/tpp/5.jpg.jpg
-
flash521/tpp/6.jpg.jpg
-
flash521/tpp/7.jpg.jpg
-
flash521/tpp/8.jpg.jpg
-
flash521/tpp/9.jpg.jpg
-
flash521/xintiao/10001.jpg.jpg
-
flash521/xintiao/10002.jpg.jpg
-
flash521/xintiao/10003.jpg.jpg
-
flash521/xintiao/10004.jpg.jpg
-
flash521/xintiao/10005.jpg.jpg
-
flash521/xintiao/10006.jpg.jpg
-
flash521/xintiao/10007.jpg.jpg
-
flash521/xintiao/10008.jpg.jpg
-
flash521/xintiao/10009.jpg.jpg
-
flash521/xintiao/10010.jpg.jpg
-
flash521/xintiao/10011.jpg.jpg
-
flash521/xintiao/10012.jpg.jpg
-
flash521/xintiao/10013.jpg.jpg
-
flash521/xintiao/10014.jpg.jpg
-
flash521/xintiao/10015.jpg.jpg
-
flash521/xintiao/10016.jpg.jpg
-
flash521/xintiao/10017.jpg.jpg
-
flash521/xintiao/10018.jpg.jpg
-
flash521/xintiao/10019.jpg.jpg
-
flash521/xintiao/10020.jpg.jpg
-
flash521/xintiao/10021.jpg.jpg
-
flash521/xintiao/10022.jpg.jpg
-
flash521/xintiao/10023.jpg.jpg
-
flash521/xintiao/10024.jpg.jpg
-
flash521/xintiao/10025.jpg.jpg
-
flash521/xintiao/10026.jpg.jpg
-
flash521/xintiao/10027.jpg.jpg
-
flash521/xintiao/10028.jpg.jpg
-
flash521/xintiao/10029.jpg.jpg
-
flash521/xintiao/10030.jpg.jpg
-
flash521/xintiao/10031.jpg.jpg
-
flash521/xintiao/10032.jpg.jpg
-
flash521/xintiao/10033.jpg.jpg
-
flash521/xintiao/10034.jpg.jpg
-
flash521/xintiao/10035.jpg.jpg
-
flash521/xintiao/10036.jpg.jpg
-
flash521/xintiao/10037.jpg.jpg
-
flash521/xintiao/10038.jpg.jpg
-
flash521/xintiao/10039.jpg.jpg
-
flash521/xintiao/10040.jpg.jpg
-
flash521/xintiao/10041.jpg.jpg
-
flash521/xintiao/10042.jpg.jpg
-
flash521/xintiao/10043.jpg.jpg
-
flash521/xintiao/10044.jpg.jpg
-
flash521/xintiao/10045.jpg.jpg
-
flash521/xintiao/ps.fla
-
flash521/xintiao/ps.swf
-
flash521/xintiao/zwjs.fla
-
flash521/xintiao/zwjs.swf
-
flash521/xtbook.swf
-
flash521/yu.swf
-
flash521/ziyvang.swf
-
flash521/zouping.swf
-
flash521/整站使用说明.txt
-
flash521/源码之家.url.url