Overview
overview
3Static
static
3Ad/1.js
windows7-x64
3Ad/1.js
windows10-2004-x64
3Ad/10.js
windows7-x64
3Ad/10.js
windows10-2004-x64
3Ad/2.js
windows7-x64
3Ad/2.js
windows10-2004-x64
3Ad/3.js
windows7-x64
3Ad/3.js
windows10-2004-x64
3Ad/4.js
windows7-x64
3Ad/4.js
windows10-2004-x64
3Ad/5.js
windows7-x64
3Ad/5.js
windows10-2004-x64
3Ad/6.js
windows7-x64
3Ad/6.js
windows10-2004-x64
3Ad/7.js
windows7-x64
3Ad/7.js
windows10-2004-x64
3Ad/8.js
windows7-x64
3Ad/8.js
windows10-2004-x64
3Ad/9.js
windows7-x64
3Ad/9.js
windows10-2004-x64
3Ad/Hot.js
windows7-x64
3Ad/Hot.js
windows10-2004-x64
3Ad/New.js
windows7-x64
3Ad/New.js
windows10-2004-x64
3Ad/新云软件.url
windows7-x64
1Ad/新云软件.url
windows10-2004-x64
1Hits.js
windows7-x64
3Hits.js
windows10-2004-x64
3Index.html
windows7-x64
1Index.html
windows10-2004-x64
1Js/soxun.History.js
windows7-x64
3Js/soxun.History.js
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
Ad/1.js
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Ad/1.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
Ad/10.js
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Ad/10.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
Ad/2.js
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
Ad/2.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
Ad/3.js
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
Ad/3.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
Ad/4.js
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
Ad/4.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral11
Sample
Ad/5.js
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
Ad/5.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
Ad/6.js
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
Ad/6.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral15
Sample
Ad/7.js
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
Ad/7.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral17
Sample
Ad/8.js
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
Ad/8.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral19
Sample
Ad/9.js
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
Ad/9.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral21
Sample
Ad/Hot.js
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
Ad/Hot.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral23
Sample
Ad/New.js
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
Ad/New.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral25
Sample
Ad/新云软件.url
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
Ad/新云软件.url
Resource
win10v2004-20240704-en
Behavioral task
behavioral27
Sample
Hits.js
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
Hits.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral29
Sample
Index.html
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
Index.html
Resource
win10v2004-20240704-en
Behavioral task
behavioral31
Sample
Js/soxun.History.js
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
Js/soxun.History.js
Resource
win10v2004-20240704-en
General
-
Target
2f1bef1763f2c5dddcd24e6c531ee151_JaffaCakes118
-
Size
3.9MB
-
MD5
2f1bef1763f2c5dddcd24e6c531ee151
-
SHA1
959ff3d378b099e1bff3281d3a97756c7211cdea
-
SHA256
d50a95b82b8204f4b1f84a4a2b24fa5617525aa32699daaafbeba975ac679496
-
SHA512
4d2c628ca08ec8f21e04dad22e80896d1fcb6f16166bdf888a3b8f67ea5f1feeb22697fbd4a77d27261640bd247cdb369d661a2e541192025d1f70e52e3b89e8
-
SSDEEP
49152:xZFv3nUF99h4Fl37KKoEKP/QPIXXAQtqkvTwETGKJrqL/mfYWnWo1K/Ll2apLZtC:tvUcboTwPIgQUkM8NrTgYWo1ULZwN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Play/SXPLAY.EXE
Files
-
2f1bef1763f2c5dddcd24e6c531ee151_JaffaCakes118.rar
-
Ad/1.js
-
Ad/10.js
-
Ad/2.js
-
Ad/3.js
-
Ad/4.js
-
Ad/5.js
-
Ad/6.js
-
Ad/7.js
-
Ad/8.js
-
Ad/9.js
-
Ad/Hot.js.js
-
Ad/New.js.js
-
Ad/新云软件.url.url
-
Hits.asp.js
-
Index.html.html .js polyglot
-
Js/soxun.History.js.js
-
Js/soxun.Jquery.js.js
-
Js/soxun.ajax.js.js
-
Play/SXPLAY.EXE.exe windows:1 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 1024B - Virtual size: 588B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Play/soxunPlayer.html
-
Play/soxunPlayer.js.js
-
Qplayer.asp.vbs
-
Skin/soxuncms/Template/css.css
-
Skin/soxuncms/Template/css2.css
-
Skin/soxuncms/Template/images/1.gif.gif
-
Skin/soxuncms/Template/images/2.gif.gif
-
Skin/soxuncms/Template/images/anniu_03.gif.gif
-
Skin/soxuncms/Template/images/bj.gif.gif
-
Skin/soxuncms/Template/images/blank.gif.gif
-
Skin/soxuncms/Template/images/bmp.gif.gif
-
Skin/soxuncms/Template/images/booktop.jpg.jpg
-
Skin/soxuncms/Template/images/box_bg.gif.gif
-
Skin/soxuncms/Template/images/dui.gif.gif
-
Skin/soxuncms/Template/images/elite.gif.png
-
Skin/soxuncms/Template/images/faces/1.gif.gif
-
Skin/soxuncms/Template/images/faces/10.gif.gif
-
Skin/soxuncms/Template/images/faces/11.gif.gif
-
Skin/soxuncms/Template/images/faces/12.gif.gif
-
Skin/soxuncms/Template/images/faces/13.gif.gif
-
Skin/soxuncms/Template/images/faces/14.gif.gif
-
Skin/soxuncms/Template/images/faces/15.gif.gif
-
Skin/soxuncms/Template/images/faces/16.gif.gif
-
Skin/soxuncms/Template/images/faces/17.gif.gif
-
Skin/soxuncms/Template/images/faces/2.gif.gif
-
Skin/soxuncms/Template/images/faces/3.gif.gif
-
Skin/soxuncms/Template/images/faces/4.gif.gif
-
Skin/soxuncms/Template/images/faces/5.gif.gif
-
Skin/soxuncms/Template/images/faces/6.gif.gif
-
Skin/soxuncms/Template/images/faces/7.gif.gif
-
Skin/soxuncms/Template/images/faces/8.gif.gif
-
Skin/soxuncms/Template/images/faces/9.gif.gif
-
Skin/soxuncms/Template/images/faces/vssver2.scc
-
Skin/soxuncms/Template/images/gb.jpg.jpg
-
Skin/soxuncms/Template/images/hd-bj.png.png
-
Skin/soxuncms/Template/images/hot.gif.gif
-
Skin/soxuncms/Template/images/iccl.gif.gif
-
Skin/soxuncms/Template/images/icclr.gif.gif
-
Skin/soxuncms/Template/images/ico7.gif.gif
-
Skin/soxuncms/Template/images/ico_forgot.gif.gif
-
Skin/soxuncms/Template/images/ico_help.gif.gif
-
Skin/soxuncms/Template/images/loading.gif.gif
-
Skin/soxuncms/Template/images/login_2.gif.gif
-
Skin/soxuncms/Template/images/login_3.gif.gif
-
Skin/soxuncms/Template/images/login_4.gif.gif
-
Skin/soxuncms/Template/images/login_5.gif.gif
-
Skin/soxuncms/Template/images/login_6.gif.gif
-
Skin/soxuncms/Template/images/login_bt.gif.gif
-
Skin/soxuncms/Template/images/login_bt2.gif.gif
-
Skin/soxuncms/Template/images/login_title.gif.gif
-
Skin/soxuncms/Template/images/mb1-img_03.gif.gif
-
Skin/soxuncms/Template/images/mb1-img_03_bak.gif.gif
-
Skin/soxuncms/Template/images/mb1-img_06.gif.gif
-
Skin/soxuncms/Template/images/mb1-img_11.gif.gif
-
Skin/soxuncms/Template/images/mb1-img_142.jpg.jpg
-
Skin/soxuncms/Template/images/mb1-img_14_x.jpg.jpg
-
Skin/soxuncms/Template/images/mb1-img_18.gif.gif
-
Skin/soxuncms/Template/images/mb1-img_21.gif.gif
-
Skin/soxuncms/Template/images/mb1-img_26.gif.gif
-
Skin/soxuncms/Template/images/mb1-img_33.gif.gif
-
Skin/soxuncms/Template/images/mb1-img_37.gif.gif
-
Skin/soxuncms/Template/images/mb1-img_41.gif.gif
-
Skin/soxuncms/Template/images/mb1-img_45.gif.gif
-
Skin/soxuncms/Template/images/new.gif.gif
-
Skin/soxuncms/Template/images/nopic.gif.gif
-
Skin/soxuncms/Template/images/play.gif.gif
-
Skin/soxuncms/Template/images/softkeyboard.js.js
-
Skin/soxuncms/Template/images/thickbox.css
-
Skin/soxuncms/Template/images/thickbox.js.js
-
Skin/soxuncms/Template/images/title.gif.gif
-
Skin/soxuncms/Template/soxun_default.html.html .js polyglot
-
Skin/soxuncms/Template/soxun_details.html.html .js polyglot
-
Skin/soxuncms/Template/soxun_hot.html
-
Skin/soxuncms/Template/soxun_news.html.html
-
Skin/soxuncms/Template/soxun_player.html.html
-
Skin/soxuncms/Template/soxun_search.html.html .js polyglot
-
Skin/soxuncms/Template/soxun_type.html.html .js polyglot
-
data/soxuncms#cms#@#@$%@#$%@$%@#$%@#$%@#$com.mdb
-
pic/201052814515887112.jpg.jpg
-
pic/201052814521335531.jpg.jpg
-
pic/20105281452846820.jpg.jpg
-
pic/201052815122424452.jpg.jpg
-
playimg/1_01.jpg.jpg
-
playimg/1_02.jpg.jpg
-
playimg/1_04.jpg.jpg
-
playimg/1_05.jpg.jpg
-
playimg/3j.jpg.jpg
-
playimg/Player.js.js
-
playimg/bf.jpg.jpg
-
playimg/full.jpg.jpg
-
playimg/jdk.jpg.jpg
-
playimg/jdt.jpg.jpg
-
playimg/l.jpg.jpg
-
playimg/lbg.jpg.jpg
-
playimg/logo.png.png
-
playimg/pbg.jpg.jpg
-
playimg/pc_t.jpg.jpg
-
playimg/pc_tkkk.jpg.jpg
-
playimg/r.jpg.jpg
-
playimg/sd.jpg.jpg
-
playimg/sdk.jpg.jpg
-
playimg/t.jpg.jpg
-
playimg/tz.jpg.jpg
-
playimg/zt.jpg.jpg
-
search.asp
-
soxun.Cache/soxun.Admin.asp
-
soxun.Cache/soxun.Class.asp
-
soxun.Cache/soxun.Close.asp
-
soxun.Cache/soxun.Config.asp
-
soxun.Cache/soxun.Html.asp
-
soxun.Cache/soxun.Personal.Config.asp
-
soxun.Cache/soxun.Version.asp.vbs
-
soxun.Conn.asp.vbs
-
soxun.Include/soxun.Checkcode.asp
-
soxun.Include/soxun.Default.Conifg.asp.vbs
-
soxun.Include/soxun.Fso.asp.vbs
-
soxun.Include/soxun.Function.asp.vbs
-
soxun.Include/soxun.Lable.All.asp.vbs
-
soxun.Include/soxun.Md5.asp.vbs
-
soxun.Include/soxun.Security.asp.vbs
-
soxun.Scnn.asp.vbs
-
soxun.Sql.asp.vbs
-
soxun_fun.asp.vbs
-
soxun_indexpic.asp.vbs
-
soxunadmin/Editor/ColorSelect.htm.html .js polyglot
-
soxunadmin/Editor/FontFaceSelect.htm.html
-
soxunadmin/Editor/FontSizeSelect.htm.html
-
soxunadmin/Editor/blankpage.htm.html
-
soxunadmin/Editor/colorSelect.js.js
-
soxunadmin/Editor/editfunc.js.js
-
soxunadmin/Editor/editorArea.css
-
soxunadmin/Editor/images/1.gif.gif
-
soxunadmin/Editor/images/10.gif.gif
-
soxunadmin/Editor/images/11.gif.gif
-
soxunadmin/Editor/images/12.gif.gif
-
soxunadmin/Editor/images/13.gif.gif
-
soxunadmin/Editor/images/14.gif.gif
-
soxunadmin/Editor/images/15.gif.gif
-
soxunadmin/Editor/images/16.gif.gif
-
soxunadmin/Editor/images/17.gif.gif
-
soxunadmin/Editor/images/18.gif.gif
-
soxunadmin/Editor/images/19.gif.gif
-
soxunadmin/Editor/images/2.gif.gif
-
soxunadmin/Editor/images/20.gif.gif
-
soxunadmin/Editor/images/3.gif.gif
-
soxunadmin/Editor/images/4.gif.gif
-
soxunadmin/Editor/images/5.gif.gif
-
soxunadmin/Editor/images/6.gif.gif
-
soxunadmin/Editor/images/7.gif.gif
-
soxunadmin/Editor/images/8.gif.gif
-
soxunadmin/Editor/images/9.gif.gif
-
soxunadmin/Editor/images/bg.gif.gif
-
soxunadmin/Editor/images/line.gif.gif
-
soxunadmin/Editor/index.html.html .js polyglot
-
soxunadmin/Editor/portraitSelect.js.js
-
soxunadmin/calendar.css
-
soxunadmin/calendar.js.js
-
soxunadmin/css/common.css
-
soxunadmin/images/an1.gif.gif
-
soxunadmin/images/ct_01.gif.gif
-
soxunadmin/images/denglu_02.jpg.jpg
-
soxunadmin/images/denglu_05.jpg.jpg
-
soxunadmin/images/direct.gif.gif
-
soxunadmin/images/direct_blue.gif.gif
-
soxunadmin/images/down_list.gif.gif
-
soxunadmin/images/hi.gif.gif
-
soxunadmin/images/icon_01.gif.gif
-
soxunadmin/images/icon_02.gif.gif
-
soxunadmin/images/left_nav_bg.jpg.jpg
-
soxunadmin/images/list_title.gif.gif
-
soxunadmin/images/list_title_onclick.gif.gif
-
soxunadmin/images/man_logo.gif.gif
-
soxunadmin/images/man_logo.jpg.jpg
-
soxunadmin/images/manage_r2_c1.jpg.jpg
-
soxunadmin/images/manage_r2_c13.jpg.jpg
-
soxunadmin/images/manage_r2_c14.jpg.jpg
-
soxunadmin/images/manage_r2_c18.jpg.jpg
-
soxunadmin/images/manage_r3_c11.jpg.jpg
-
soxunadmin/images/manage_r5_c1.jpg.jpg
-
soxunadmin/images/manage_r6_c2.jpg.jpg
-
soxunadmin/images/manage_r7_c2.jpg.jpg
-
soxunadmin/images/manage_r9_c1.jpg.jpg
-
soxunadmin/images/nav_bg.jpg.jpg
-
soxunadmin/images/qian.gif.gif
-
soxunadmin/images/return.gif.gif
-
soxunadmin/images/slide.gif.gif
-
soxunadmin/images/switch_left.gif.gif
-
soxunadmin/images/switch_right.gif.gif
-
soxunadmin/images/sz.gif.gif
-
soxunadmin/images/up_list.gif.gif
-
soxunadmin/js/nav.js.js
-
soxunadmin/skins/css/main.css
-
soxunadmin/skins/css/soxun_main.css
-
soxunadmin/skins/css/style.css
-
soxunadmin/skins/css/style_left.css
-
soxunadmin/skins/default/Forum_nav.gif.gif
-
soxunadmin/skins/default/bg2.gif.gif
-
soxunadmin/skins/default/line_bg.gif.gif
-
soxunadmin/skins/images/arrow.gif.gif
-
soxunadmin/skins/images/bbs_home.gif.gif
-
soxunadmin/skins/images/bg.gif.gif
-
soxunadmin/skins/images/bg2.gif.gif
-
soxunadmin/skins/images/bg3.gif.gif
-
soxunadmin/skins/images/bg4.gif.gif
-
soxunadmin/skins/images/body_bg.gif.gif
-
soxunadmin/skins/images/botbg.gif.gif
-
soxunadmin/skins/images/button_bg.gif.gif
-
soxunadmin/skins/images/left.gif.gif
-
soxunadmin/skins/images/leftbg.gif.gif
-
soxunadmin/skins/images/leftop.gif.gif
-
soxunadmin/skins/images/login.gif.gif
-
soxunadmin/skins/images/logo_up.gif.gif
-
soxunadmin/skins/images/menu01.gif.gif
-
soxunadmin/skins/images/menu01_right.gif.gif
-
soxunadmin/skins/images/menu02.gif.gif
-
soxunadmin/skins/images/menu_button_bg.gif.gif
-
soxunadmin/skins/images/menu_icon2.gif.gif
-
soxunadmin/skins/images/menu_left_topbg.gif.gif
-
soxunadmin/skins/images/menubg.gif.gif
-
soxunadmin/skins/images/menubg_hover.gif.gif
-
soxunadmin/skins/images/menubg_on.gif.gif
-
soxunadmin/skins/images/right.gif.gif
-
soxunadmin/skins/images/tableft6.gif.gif
-
soxunadmin/skins/images/tabright6.gif.gif
-
soxunadmin/skins/images/top_bg.gif.gif
-
soxunadmin/soxun_Ad.asp.js
-
soxunadmin/soxun_Ajax.asp.vbs
-
soxunadmin/soxun_All.js.js
-
soxunadmin/soxun_Check.asp.vbs
-
soxunadmin/soxun_Class_Sub.asp.vbs
-
soxunadmin/soxun_Conn.asp
-
soxunadmin/soxun_Create.asp
-
soxunadmin/soxun_CreateAll.asp.vbs
-
soxunadmin/soxun_CreateClass.asp.vbs
-
soxunadmin/soxun_CreateData.asp.vbs
-
soxunadmin/soxun_CreateIndex.asp.vbs
-
soxunadmin/soxun_CreateOther.asp.vbs
-
soxunadmin/soxun_Link.asp.vbs
-
soxunadmin/soxun_Skin.asp.vbs
-
soxunadmin/soxun_caiji.asp.vbs
-
soxunadmin/soxun_caiji2.asp.vbs
-
soxunadmin/soxun_class_save.asp.vbs
-
soxunadmin/soxun_config.asp
-
soxunadmin/soxun_connsql.asp.vbs
-
soxunadmin/soxun_data.asp.vbs
-
soxunadmin/soxun_data1.asp.vbs
-
soxunadmin/soxun_data2.asp.vbs
-
soxunadmin/soxun_data_all.asp.vbs
-
soxunadmin/soxun_data_edit.asp.vbs
-
soxunadmin/soxun_data_manage.asp.vbs
-
soxunadmin/soxun_data_save.asp.vbs
-
soxunadmin/soxun_index.asp
-
soxunadmin/soxun_indexpic_edit.asp.vbs
-
soxunadmin/soxun_leftframe.asp.js
-
soxunadmin/soxun_login.asp.js
-
soxunadmin/soxun_mainframe.asp.js
-
soxunadmin/soxun_manframe.asp.vbs
-
soxunadmin/soxun_movie_Class.asp.vbs
-
soxunadmin/soxun_movie_add.asp
-
soxunadmin/soxun_movie_manage.asp.html
-
soxunadmin/soxun_personal.asp.vbs
-
soxunadmin/soxun_profile.asp.js
-
soxunadmin/soxun_switchframe.asp.html
-
soxunadmin/soxun_sysinfo.asp.vbs
-
soxunadmin/soxun_topframe.asp.html
-
soxunadmin/soxun_url.asp.vbs
-
soxunadmin/soxun_url_save.asp.vbs
-
soxunadmin/soxun_user.asp.vbs
-
soxunadmin/test.asp
-
soxunadmin/up/upload.asp.asp .vbs polyglot
-
soxunadmin/up/upload.htm
-
soxunadmin/up/upload2.asp.asp .vbs polyglot
-
soxunadmin/up/upload2.htm
-
soxunadmin/up/upload3.asp.asp .vbs polyglot
-
soxunadmin/up/upload3.htm
-
soxunadmin/up/upsave.inc.vbs
-
安装说明.txt