{J���:@�yd$KsX���h�ˬ|>GZ-t@�',?�2���~�/��ֱ��;��=�Wr��n!|ǎ�]:��u��4��L�:p������]�,%:��� ���O���]̥� �H�y��ѭo9���CG�����zk�y��1Gt�!��X]2R��,W�4�֓�j&9��O������i�c���i,+��ga`3�lQY�o\ѷ�O��f�@\m30��|�Ŵ��� ��6X��؈�%Ák��s�����^���`�������S$$��.Cѡ�y�W�3p�a]�g�h�Ԏ�ۨ�:Б����g�c�0���A!��m��BJ�}��k*f-�m����ԇ��A�A�����J܄��S�u �*+HI��w���Ӓ����r��#���ihd��_i�!YIO}��a!��0�̓�L��ܟ��]�3 �ħ7K�H8��"�3ȍ���� ������(�VP3c ��Yys���L����*w6N||���8�,1H�����|5�1��!�vlȖމ��O�D������푥cX�o�֣/��YrR��z�:���t�v3r����x�Q W1��%�{�Y�nB�h�exw� ��e��M6�1^���|�=��6�Y���-�#�zo�����D�[Hr����{������]͎Wgq�ep��W��$�V����#�}�μۉ}���d��U:�IHD�c��;aj�R�����B�C��_8B���H�����;Ic�q�h-��Rfm/���� RYN#����?B�K� ��6��1�i�!��mK�����B����Cwu>A�:�f���etGZ}n}=�e�H���e��O���@�Պ�{{�m9�M�ءL�8:G��4)W�xi���*~�Tdo��T�W�>�I<�Nf�F��IW�:ϑ�6���� l����s��D&�d%=jØ�w�]�]D,��\�"�v"G\*�Iw�F*�h�3ƭ���"ڒ�/u�S>�-�����;w�4SL��DW�N�MfX�N�E'v��s�u:ߏ�BX���Kq � m���ˋm˳���G;f��u�;Ƨ�~�A^E+x�*O�� ���N TW�8��"����L6/�`�"CL��]4��ၚ����`��d�ta4I=�(k_Y\�Ӡ_Z�(N1�-t�������ۆ��jiT�����FP�q8�ɋ� �S<+_a��g�!^3p�l�f�f-Ie��7a�dg`�=�Q�Kʇ�ֱ��oG�C�ƍ91DE�B�*�y�&qʙZ�\\� �����U���-���v(0@�)W��nȂ!c�/�el0�qD~�i��;~�Y��I@$H��7��¦`�P|[�h��}���F�_F����2�f�GGe�_��Tɯ��s}h����(ܦ����Ȍ�3/�Kq�5F^�$��C��w��真M��^� ��w;'�;6d�L�A�J����ֽԂ����~Js�1wgGR+!���C������hHRfb8��D��Oޟ,��b6.m�ζ����Z��%3��l�w�bR�� c��7(.�, n7a�k�I�Ak[������W��ͽJ:uw�:z�uhl�s�쌒����zU����{����6V ϻ��`�Qz0�h��B�DML�F kt��mS��opׯ���@��#B�i� &X� �Қ`$�?� r��#�q�Xb�ĩ��S���N R��Z��7 ��ZT��9�����р8��7�W���Վ�(�t�j��Vg;�wK^{G����iA�K�ԝB��I��c�Sx��="��אI�V�mGo��.'���rw��? X�Yɓ�%����qc��MD�m���<�an��m�#��/xoN�u-2G��4�b3�K��_�z#�㙪��<AV�0!�5�CM����hW~�N�>*8m[.�q�H[%:Ii�p}^��SL�?��T5I����7�dY�]���� ������䒮���q���X.��l�'z=��'Z�,TG;X���X�G�9a��ƹ���:qΨ����e�ا�?���X>e��L�r�]�E�}W�^,�ْ�u|c+��߸��M�� 4��w.�����j�]����%��K4�Ef� M,_ŕ���[�Y\�uR��Nm|��e��^VG.5�Xg�Ҽ�� �����F|��`�{��������������i�y��\X�\1�½�NG���i.Ի��yG}����C��OF��7Z*�Y �[5LZQ�%��i��f���0D����Y���{������Z��~}�A��O� �&��A�xe�����EJ [_ƉΓ�ώ��靂)}��v�Kn�l�t "p19o#cw�f�U�\�$ ��P%P�o:lr��)�cH\S#1®��AQ� ʡ��;��L��h<��Ǿ�{�%1�$���-���g *����Y�`���M�� �[F�y��}��6��R�Q1��ڜ�nL�e�i�\����m���-�^@;-���_�<�����Vڪ[����y�`q��pE]4�����jW�&����"h�+#���s�wf���sKa��y"��#Q�x���8!�B_Ka�|�s��{�5 d���T���ϱD4=�<��oz����h$��O+�F,Ϫ �~V�Y����WɁ���p[�,�\��iB5�{�&� o�Q=���6Ҭ"He��(�z��E zx�W+El�����8�����P��1.Ֆu��Io�(�v�Kh_O��=�a�n�g��)�A��������ݶR=�b��c`���Z�Oa�w�����I��̃�������d� �p�ym�`P�`�ѡ�c0�Pqx^#�u���W�'c��hw�cW����Հ�-�f9D������'�@�|��V���|c�սF� c#ņ黌��Ϡ���>���rA����;��9Y�+r$ڐ����Y� rm��� gz��X�C J4��i�%�����[¼M�O�Kz҈��GK� �b�3$�#o�+oໃ'W�˒i�p�)�1��rzА�+���� &���^�5*��û�Z;���2jTBR tX,n��xVT��#
Behavioral task
behavioral1
Sample
Baidukongjianrenqiwang.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Baidukongjianrenqiwang.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20240704-en
General
-
Target
2c3eed0ee43fa58ada981f463c968241_JaffaCakes118
-
Size
1.3MB
-
MD5
2c3eed0ee43fa58ada981f463c968241
-
SHA1
02f6243c55e80326319b236f079e3de5e4e014c3
-
SHA256
36b34079854256865591ac9e70a2da55b4b01e806a70d71cc6faf364c7b4cf8e
-
SHA512
7f7f411f749bca1ee24adf989c3a411d57d9baa5c106b6a1da49ec2bfa241589a86c0d3c313eaa6d2c1741b27c093eb3d878120d8d29f862b4a0d830a851dddc
-
SSDEEP
24576:YsWoWcyF83yR4yso255qMFTgmyiPqyH6GQMk/SErvx55c3+AIr6B/CwoZ:ReHFDR4YO5qvSPrH6GISEd5OulV
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Baidukongjianrenqiwang.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Baidukongjianrenqiwang.exe
Files
-
2c3eed0ee43fa58ada981f463c968241_JaffaCakes118.rar
-
Baidukongjianrenqiwang.exe.exe windows:4 windows x86 arch:x86
25743054bb76ba9316766f97212d5f5b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
EnumCalendarInfoA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
ClientToScreen
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SafeArrayGetLBound
version
VerQueryValueA
gdi32
Rectangle
ole32
OleSetMenuDescriptor
comctl32
ImageList_DrawEx
shell32
Shell_NotifyIconA
wsock32
gethostname
ws2_32
WSACleanup
Exports
Exports
Sections
CODE Size: - Virtual size: 655KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 325KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 899KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 352B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
新云软件.url.url