Overview
overview
7Static
static
7admin/Admi...ss.vbs
windows7-x64
1admin/Admi...ss.vbs
windows10-2004-x64
1admin/Admi...dd.vbs
windows7-x64
1admin/Admi...dd.vbs
windows10-2004-x64
1admin/Admi...el.vbs
windows7-x64
1admin/Admi...el.vbs
windows10-2004-x64
1admin/Admi...Up.vbs
windows7-x64
1admin/Admi...Up.vbs
windows10-2004-x64
1admin/Admi...ex.vbs
windows7-x64
1admin/Admi...ex.vbs
windows10-2004-x64
1admin/Admi...dd.vbs
windows7-x64
1admin/Admi...dd.vbs
windows10-2004-x64
1admin/Admi...el.vbs
windows7-x64
1admin/Admi...el.vbs
windows10-2004-x64
1admin/Admi...Up.vbs
windows7-x64
1admin/Admi...Up.vbs
windows10-2004-x64
1admin/Admin_Class.vbs
windows7-x64
1admin/Admin_Class.vbs
windows10-2004-x64
1admin/Admi...dd.vbs
windows7-x64
1admin/Admi...dd.vbs
windows10-2004-x64
1admin/Admi...el.vbs
windows7-x64
1admin/Admi...el.vbs
windows10-2004-x64
1admin/Admi...on.vbs
windows7-x64
1admin/Admi...on.vbs
windows10-2004-x64
1admin/Admi...Up.vbs
windows7-x64
1admin/Admi...Up.vbs
windows10-2004-x64
1admin/Admi...ch.vbs
windows7-x64
1admin/Admi...ch.vbs
windows10-2004-x64
1admin/Admi...ig.vbs
windows7-x64
1admin/Admi...ig.vbs
windows10-2004-x64
1admin/Admin_Data.vbs
windows7-x64
1admin/Admin_Data.vbs
windows10-2004-x64
1Behavioral task
behavioral1
Sample
admin/Admin_Ad_Class.vbs
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
admin/Admin_Ad_Class.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
admin/Admin_Ad_ClassAdd.vbs
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
admin/Admin_Ad_ClassAdd.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
admin/Admin_Ad_ClassDel.vbs
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
admin/Admin_Ad_ClassDel.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
admin/Admin_Ad_ClassUp.vbs
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
admin/Admin_Ad_ClassUp.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
admin/Admin_Ad_Index.vbs
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
admin/Admin_Ad_Index.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
admin/Admin_Ad_IndexAdd.vbs
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
admin/Admin_Ad_IndexAdd.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
admin/Admin_Ad_IndexDel.vbs
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
admin/Admin_Ad_IndexDel.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
admin/Admin_Ad_IndexUp.vbs
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
admin/Admin_Ad_IndexUp.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
admin/Admin_Class.vbs
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
admin/Admin_Class.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
admin/Admin_ClassAdd.vbs
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
admin/Admin_ClassAdd.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
admin/Admin_ClassDel.vbs
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
admin/Admin_ClassDel.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
admin/Admin_ClassFunction.vbs
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
admin/Admin_ClassFunction.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
admin/Admin_ClassUp.vbs
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
admin/Admin_ClassUp.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
admin/Admin_Class_Search.vbs
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
admin/Admin_Class_Search.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
admin/Admin_ConFig.vbs
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
admin/Admin_ConFig.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
admin/Admin_Data.vbs
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
admin/Admin_Data.vbs
Resource
win10v2004-20240802-en
General
-
Target
83d59081d6297415bc431088455f3934_JaffaCakes118
-
Size
545KB
-
MD5
83d59081d6297415bc431088455f3934
-
SHA1
eda937d25e9bc0d8f2ee21eabe4ed2e97d0db31a
-
SHA256
0c630fbfd5d23469744e7bdd603a217eb0ec208bba41aeead47fc1b8ad25105e
-
SHA512
a62eea7239fdd17560e9dcce3bb552be72e9707c3a5b35dd3c52a57158eb2e639ff2b888da875fb846cc4b2117d17969ceb6cac8b3f9b2af8b80642878642fa8
-
SSDEEP
12288:6HdpolrO0mIhimLrp210zY50b3OrspLx8:Kjmhim2yMi6YpL6
Malware Config
Signatures
-
resource yara_rule static1/unpack001/wsie.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/wsie.exe
Files
-
83d59081d6297415bc431088455f3934_JaffaCakes118.rar
-
admin/Admin_Ad_Class.asp.vbs
-
admin/Admin_Ad_ClassAdd.asp.vbs
-
admin/Admin_Ad_ClassDel.asp.vbs
-
admin/Admin_Ad_ClassUp.asp.vbs
-
admin/Admin_Ad_Index.asp.vbs
-
admin/Admin_Ad_IndexAdd.asp.vbs
-
admin/Admin_Ad_IndexDel.asp.vbs
-
admin/Admin_Ad_IndexUp.asp.vbs
-
admin/Admin_Class.asp.vbs
-
admin/Admin_ClassAdd.asp.vbs
-
admin/Admin_ClassDel.asp.vbs
-
admin/Admin_ClassFunction.asp.vbs
-
admin/Admin_ClassUp.asp.vbs
-
admin/Admin_Class_Search.asp.vbs
-
admin/Admin_ConFig.asp.vbs
-
admin/Admin_Data.asp.vbs
-
admin/Admin_HtmlClassSkin.asp.vbs
-
admin/Admin_HtmlClassSkinGO.asp.vbs
-
admin/Admin_HtmlSkin.asp.vbs
-
admin/Admin_HtmlSkinGO.asp.vbs
-
admin/Admin_Login_Del.asp.vbs
-
admin/Admin_Login_Yc.asp.vbs
-
admin/Admin_Login_YcDel.asp.vbs
-
admin/Admin_Login_Yn.asp.vbs
-
admin/Admin_Login_Yn2.asp.vbs
-
admin/Admin_MClass.asp.vbs
-
admin/Admin_MClassAdd.asp.vbs
-
admin/Admin_MClassDel.asp.vbs
-
admin/Admin_Manage.asp.vbs
-
admin/Admin_ManageAdd.asp.vbs
-
admin/Admin_ManageDel.asp.vbs
-
admin/Admin_ManageFunction.asp.vbs
-
admin/Admin_ManageUp.asp.vbs
-
admin/Admin_Message.asp.vbs
-
admin/Admin_MessageDel.asp.vbs
-
admin/Admin_Skin.asp.vbs
-
admin/Admin_SkinAdd.asp.vbs
-
admin/Admin_SkinClass.asp.vbs
-
admin/Admin_SkinClassAdd.asp.vbs
-
admin/Admin_SkinClassDel.asp.vbs
-
admin/Admin_SkinClassUp.asp.vbs
-
admin/Admin_SkinDel.asp.vbs
-
admin/Admin_SkinUp.asp.vbs
-
admin/Admin_Url.asp.vbs
-
admin/Admin_UrlAdd.asp.vbs
-
admin/Admin_UrlAddClass.asp.vbs
-
admin/Admin_UrlAllAdd.asp.vbs
-
admin/Admin_UrlClass.asp.vbs
-
admin/Admin_UrlClassAdd.asp.vbs
-
admin/Admin_UrlClassDel.asp.vbs
-
admin/Admin_UrlClassUp.asp.vbs
-
admin/Admin_UrlDel.asp.vbs
-
admin/Admin_UrlFunction.asp.vbs
-
admin/Admin_UrlUp.asp.vbs
-
admin/Admin_Url_Search.asp.vbs
-
admin/Admin_Url_Yn.asp.vbs
-
admin/Admin_mAdd.asp.vbs
-
admin/Admin_mClassUp.asp.vbs
-
admin/Admin_mHtmlSkin.asp.vbs
-
admin/Admin_mUp.asp.vbs
-
admin/Admin_mUrl.asp.vbs
-
admin/GetCode.asp.vbs
-
admin/LabelHtml.asp.vbs
-
admin/admin_mDel.asp.vbs
-
admin/chklogin.asp.vbs
-
admin/css.css
-
admin/images/admincp/add.gif.gif
-
admin/images/admincp/admincp.css
-
admin/images/admincp/ajax_loader.gif.gif
-
admin/images/admincp/bg_button.gif.gif
-
admin/images/admincp/bg_custom.gif.gif
-
admin/images/admincp/bg_custom_t.gif.gif
-
admin/images/admincp/bg_header.gif.gif
-
admin/images/admincp/bg_input.gif.gif
-
admin/images/admincp/bg_list.gif.gif
-
admin/images/admincp/bg_login.gif.gif
-
admin/images/admincp/bg_menu.gif.gif
-
admin/images/admincp/bg_menu2.gif.gif
-
admin/images/admincp/bg_repno.gif.gif
-
admin/images/admincp/bg_repx.gif.gif
-
admin/images/admincp/bg_repx_h.gif.gif
-
admin/images/admincp/bg_repx_hb.gif.gif
-
admin/images/admincp/bg_repx_hc.gif.gif
-
admin/images/admincp/bg_repx_hd.gif.gif
-
admin/images/admincp/btn_add2menu.gif.gif
-
admin/images/admincp/btn_block.gif.gif
-
admin/images/admincp/btn_block_2.gif.gif
-
admin/images/admincp/btn_block_3.gif.gif
-
admin/images/admincp/btn_custommenu.gif.gif
-
admin/images/admincp/btn_map.gif.gif
-
admin/images/admincp/close.gif.gif
-
admin/images/admincp/color.jpg.jpg
-
admin/images/admincp/desc.gif.gif
-
admin/images/admincp/getcolor.htm.html .js polyglot
-
admin/images/admincp/login_header.gif.gif
-
admin/images/admincp/logo.GIF.gif
-
admin/images/admincp/process.gif.gif
-
admin/images/admincp/processbg.gif.gif
-
admin/images/admincp/watermarkpreview.jpg.jpg
-
admin/index.asp.js
-
admin/index.html.html
-
admin/jianpin.asp.vbs
-
admin/js.js.js
-
admin/js/common.js.js
-
admin/login.asp.vbs
-
admin/logout.asp
-
admin/londing.html.html
-
admin/mofeiimg/Head.Fix
-
admin/mofeiimg/body.Fix
-
admin/welcome.asp.vbs
-
admin/新云软件.url.url
-
css/1.css
-
css/2008.css
-
css/fankui.css
-
data/data.mdb
-
favicon.ico
-
index.html.html
-
ln.html.html .js polyglot
-
maillogo.js.js
-
newhao123/1.css
-
newhao123/hao.css
-
newhao123/images/bg.jpg.jpg
-
newhao123/images/logo.gif.gif
-
newhao123/images/track.gif.gif
-
newimg/close.gif.gif
-
newimg/fh.gif.gif
-
newimg/google.gif.gif
-
newimg/home.gif.gif
-
newimg/logo-ss.gif.gif
-
newimg/notebook.gif.gif
-
newimg/sogou.gif.gif
-
newimg/soso.gif.gif
-
newimg/taobao.gif.gif
-
newjs/base.js.js
-
newjs/config.js.js
-
newjs/funb.js.js
-
newjs/gbfh.js
-
newjs/jfzh.js.js
-
newjs/main.js.js
-
newjs/monitor.js.js
-
newjs/rc.js.js
-
newjs/sug.js.js
-
newjs/tanchuang.js.js
-
siteconfig/conn.asp.vbs
-
siteconfig/md5.asp.vbs
-
souimg/logo_map.gif.gif
-
souimg/logo_mp3.gif.gif
-
souimg/logo_news.gif.gif
-
souimg/logo_pic.gif.gif
-
souimg/logo_post.gif.gif
-
souimg/logo_video.gif.gif
-
souimg/logo_zhidao.gif.gif
-
souimg/logox3.gif.gif
-
support/Message.asp.vbs
-
support/fk2a.html.html
-
support/fkimg/face.gif.gif
-
support/fkimg/fk_anniu.gif.gif
-
support/fkimg/fk_tips.gif.gif
-
support/fkimg/fk_tips1.gif.gif
-
support/fkimg/fknav1.gif.gif
-
support/fkimg/fknav2.gif.gif
-
support/fkimg/tx.gif.gif
-
support/index.html.html
-
support/info.asp.vbs
-
support/url.asp.vbs
-
wsie.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 56KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
安装说明.url