Behavioral task
behavioral1
Sample
预言者CF辅助0602for1/155绿色软件站.url
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
预言者CF辅助0602for1/155绿色软件站.url
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
netsh_winsock_reset.bat
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
netsh_winsock_reset.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
预言者CF辅助0602for1/预言者辅助v6.4通用版.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
预言者CF辅助0602for1/预言者辅助v6.4通用版.exe
Resource
win10v2004-20240709-en
General
-
Target
5dc8798bb291806ad9d912d5a8351bf4_JaffaCakes118
-
Size
1.3MB
-
MD5
5dc8798bb291806ad9d912d5a8351bf4
-
SHA1
a11315f5048bfd811a548da636ac597b148c95ba
-
SHA256
7b4242d0f853e55e3e1eedb34d442585ae23037c52a20b6e21324f8a7bc5acbd
-
SHA512
ccb986822cb1f9d7488ef81b09c74a5d3f5d6c6607f111d052c8b787b6057a2da165d707fb744d3e8c38b45abae2eecd3846c89bf794615004dfc65142cf5cf0
-
SSDEEP
24576:oLmL0sHC79SnoOjFCKWByTDsu8DtZH6cK6D5ZnLEpbTNOXOqHS:oMbaY+racK6D5VEYXOUS
Malware Config
Signatures
-
resource yara_rule static1/unpack001/预言者CF辅助0602for1/预言者辅助v6.4通用版.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/预言者CF辅助0602for1/预言者辅助v6.4通用版.exe
Files
-
5dc8798bb291806ad9d912d5a8351bf4_JaffaCakes118.rar
-
预言者CF辅助0602for1/155绿色软件站.url.url
-
预言者CF辅助0602for1/23_0错误解决补丁.7z.7z
-
netsh_winsock_reset.bat
-
预言者CF辅助0602for1/自动开枪配置.ini
-
预言者CF辅助0602for1/预言者辅助v6.4通用版.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.UPX1 Size: 512B - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE