Overview
overview
7Static
static
7安装数�...t1.exe
windows7-x64
3安装数�...t1.exe
windows10-2004-x64
3安装数�...og.vbs
windows7-x64
1安装数�...og.vbs
windows10-2004-x64
1通迅录S...ok.exe
windows7-x64
3通迅录S...ok.exe
windows10-2004-x64
3通迅录S...to.bat
windows7-x64
1通迅录S...to.bat
windows10-2004-x64
1通迅录S...dit.js
windows7-x64
3通迅录S...dit.js
windows10-2004-x64
3Behavioral task
behavioral1
Sample
安装数据库/Project1.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
安装数据库/Project1.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
安装数据库/通迅录_Log.vbs
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
安装数据库/通迅录_Log.vbs
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
通迅录SQL Server版/Addressbook.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
通迅录SQL Server版/Addressbook.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
通迅录SQL Server版/Auto.bat
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
通迅录SQL Server版/Auto.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
通迅录SQL Server版/Edit.js
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
通迅录SQL Server版/Edit.js
Resource
win10v2004-20240709-en
General
-
Target
741ee47e73ac3dde957b32a9471b7e84_JaffaCakes118
-
Size
1.4MB
-
MD5
741ee47e73ac3dde957b32a9471b7e84
-
SHA1
5a0462c62c692541f1ed42c1238f6fe9b27eac98
-
SHA256
daedfadb12ba4d6e0c5b484443af662a21d2817020f61d08aeb9ed0812f1e21a
-
SHA512
34c6b63c00e2ef864825a1c247f83b4be3c9eeb3665c26ce84097359751dd4b1be32bfd0385fc645fde6fdf69d1e7bb6e203e762d14db73601779b569bbf910e
-
SSDEEP
24576:Vl5w79XtfM7j4xTJyhViwaENbXYfIXJYV5BTsK5SOWObg0EvJosr6cmYje6n:Vg5tk7F5XYfIXJ8AGSOWogtS2EYq0
Malware Config
Signatures
-
resource yara_rule static1/unpack001/安装数据库/Project1.exe aspack_v212_v242 static1/unpack001/通迅录SQL Server版/Addressbook.exe aspack_v212_v242 -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/安装数据库/Project1.exe unpack001/通迅录SQL Server版/Addressbook.exe
Files
-
741ee47e73ac3dde957b32a9471b7e84_JaffaCakes118.rar
-
安装数据库/Project1.cfg
-
安装数据库/Project1.dof
-
安装数据库/Project1.dpr
-
安装数据库/Project1.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 212KB - Virtual size: 532KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
安装数据库/Project1.res
-
安装数据库/Unit1.ddp
-
安装数据库/Unit1.dfm
-
安装数据库/Unit1.pas
-
安装数据库/下载说明.htm.html .js polyglot
-
安装数据库/通迅录_Data.MDF
-
安装数据库/通迅录_Log.LDF.vbs
-
通迅录SQL Server版/About.ddp
-
通迅录SQL Server版/About.dfm
-
通迅录SQL Server版/About.pas
-
通迅录SQL Server版/Address.ddp
-
通迅录SQL Server版/Address.dfm
-
通迅录SQL Server版/Address.pas
-
通迅录SQL Server版/AddressBook.ini
-
通迅录SQL Server版/Addressbook.cfg
-
通迅录SQL Server版/Addressbook.dof
-
通迅录SQL Server版/Addressbook.dpr
-
通迅录SQL Server版/Addressbook.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 653KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 8KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 229KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 71KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
通迅录SQL Server版/Addressbook.res
-
通迅录SQL Server版/Auto.bat
-
通迅录SQL Server版/Build.ddp
-
通迅录SQL Server版/Build.dfm
-
通迅录SQL Server版/Build.pas
-
通迅录SQL Server版/Connect.ddp
-
通迅录SQL Server版/Connect.dfm
-
通迅录SQL Server版/Connect.pas
-
通迅录SQL Server版/DM.ddp
-
通迅录SQL Server版/DM.dfm
-
通迅录SQL Server版/DM.pas
-
通迅录SQL Server版/Edit.ddp
-
通迅录SQL Server版/Edit.dfm
-
通迅录SQL Server版/Edit.pas.js
-
通迅录SQL Server版/OutToExcelUnit.pas
-
通迅录SQL Server版/Progress.ddp
-
通迅录SQL Server版/Progress.dfm
-
通迅录SQL Server版/Progress.pas
-
通迅录SQL Server版/Search.ddp
-
通迅录SQL Server版/Search.dfm
-
通迅录SQL Server版/Search.pas
-
通迅录SQL Server版/Wait.dfm
-
通迅录SQL Server版/Wait.pas
-
通迅录SQL Server版/WaitPas1.pas
-
通迅录SQL Server版/report.RES
-
通迅录SQL Server版/下载说明.htm.html .js polyglot