Static task
static1
Behavioral task
behavioral1
Sample
netsys/帮助说明.chm
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
netsys/帮助说明.chm
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
netsys/新云软件.url
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
netsys/新云软件.url
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
网络探索者.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
网络探索者.exe
Resource
win10v2004-20240709-en
General
-
Target
5c0769bb82b559032f197c7ccb74eb93_JaffaCakes118
-
Size
651KB
-
MD5
5c0769bb82b559032f197c7ccb74eb93
-
SHA1
a5d48cb9ac1720de1d853ca860ab60acb20002e4
-
SHA256
412b8d5b6a234b684e10a35c5ae83a2896abc841c617ec4134e2ede3cf6a1350
-
SHA512
8e18cb6463882378da2fab89d9a77488b5f63ad195f4d266699aa8f2c2ffd6ae9e7937e520f2fd1242d0770c235409b15941be7589af380d8d9f085dd4fab0b4
-
SSDEEP
12288:lkawCQiLApa4rk6JE73nJ02U24KVlfmGhA4Gi7c29IL//vceAfb:lkawCQiaaAke2UZslZhAic2OL//EeAfb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/网络探索者.exe
Files
-
5c0769bb82b559032f197c7ccb74eb93_JaffaCakes118.rar
-
netsys/cache/IP.txt
-
netsys/ico/234.ico
-
netsys/ico/Bitmap.ico
-
netsys/ico/Document.ico
-
netsys/ico/EXCE.ico
-
netsys/ico/IE.ico
-
netsys/ico/JPG.ico
-
netsys/ico/Media Clip.ico
-
netsys/ico/QQ.ico
-
netsys/ico/Zip.ico
-
netsys/ico/aa.ico
-
netsys/ico/bb.ico
-
netsys/ico/chm.ICO
-
netsys/ico/in.ICO
-
netsys/ico/ps.ICO
-
netsys/ico/psd.ICO
-
netsys/ico/rar.ICO
-
netsys/ico/rm.ICO
-
netsys/ico/win.ico
-
netsys/ico/word.ico
-
netsys/sound/downfile.wav
-
netsys/sound/login.wav
-
netsys/sound/offline.wav
-
netsys/sound/upfile.wav
-
netsys/帮助说明.chm.chm
-
netsys/必读文件.txt
-
netsys/新云软件.url.url
-
netsys/网络探索者.rar.rar
-
帮助说明.txt
-
网络探索者.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.nsp0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nsp1 Size: 417KB - Virtual size: 420KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nsp2 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE