Overview
overview
3Static
static
3560332500/...��.exe
windows7-x64
3560332500/...��.exe
windows10-2004-x64
3560332500/...��.htm
windows7-x64
3560332500/...��.htm
windows10-2004-x64
3神迹无�...ck2.js
windows7-x64
3神迹无�...ck2.js
windows10-2004-x64
3神迹监�...ck2.js
windows7-x64
3神迹监�...ck2.js
windows10-2004-x64
3神迹监�...ck2.js
windows7-x64
3神迹监�...ck2.js
windows10-2004-x64
3560332500/...��.htm
windows7-x64
3560332500/...��.htm
windows10-2004-x64
1560332500/...om.url
windows7-x64
1560332500/...om.url
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
560332500/TTee安全上网.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
560332500/TTee安全上网.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
560332500/sjsouce/游戏外挂网.htm
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
560332500/sjsouce/游戏外挂网.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
神迹无影源代码0.162/WinSock2.js
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
神迹无影源代码0.162/WinSock2.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
神迹监视器1.3源代码/WinSock2.js
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
神迹监视器1.3源代码/WinSock2.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
神迹监视器1.3源代码/winsock2/WinSock2.js
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
神迹监视器1.3源代码/winsock2/WinSock2.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
560332500/sjsouce/购买外挂.htm
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
560332500/sjsouce/购买外挂.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
560332500/就要上上上 91333.com.url
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
560332500/就要上上上 91333.com.url
Resource
win10v2004-20240802-en
General
-
Target
965b7390ca3ed7993c9206f2995d1bfe_JaffaCakes118
-
Size
276KB
-
MD5
965b7390ca3ed7993c9206f2995d1bfe
-
SHA1
fcb0af86916fad176b0878aad7359b9032537881
-
SHA256
0e0291e0b1ca7ccf2b25c28d87c0687010240d263cc196ca4c2e96f7ec217d87
-
SHA512
2545df6719a053dc7052f402da0485583bbb9936fb3a26509f23e1bcea471699d185cbbd297784230ae1cbe5d40e996a50a1d0f96c543ad38cf4335b85f1365f
-
SSDEEP
6144:ST6LHHTc/+hvctf9FhsUBoJPMymNpWpEwrezMP9Ec:E2ytnoJWNIqLcqc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/560332500/TTee安全上网.exe
Files
-
965b7390ca3ed7993c9206f2995d1bfe_JaffaCakes118.rar
-
560332500/91333.com.txt
-
560332500/TTee安全上网.exe.exe windows:4 windows x86 arch:x86
a69e520a60d354e28d870a87b12226e3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
ExitProcess
GetModuleHandleA
mfc42
ord4299
msvcrt
__set_app_type
user32
GetWindowLongA
gdi32
GetStockObject
advapi32
RegDeleteKeyA
shell32
SHGetMalloc
wsock32
htonl
Sections
��� Size: 75KB - Virtual size: 240KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 93KB - Virtual size: 204KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
560332500/sjsouce/游戏地图管理.rar.rar
-
游戏地图管理/GameCode.dcu
-
游戏地图管理/GameCode.pas
-
游戏地图管理/GameMap.dcu
-
游戏地图管理/GameMap.pas
-
游戏地图管理/Project1.cfg
-
游戏地图管理/Project1.dof
-
游戏地图管理/Project1.dpr
-
游戏地图管理/Project1.res
-
游戏地图管理/Unit1.dcu
-
游戏地图管理/Unit1.ddp
-
游戏地图管理/Unit1.dfm
-
游戏地图管理/Unit1.pas
-
游戏地图管理/神迹地图文件/0.nmp
-
游戏地图管理/说明.txt
-
560332500/sjsouce/游戏外挂网.htm.html
-
560332500/sjsouce/神迹无影源代码0.162.rar.rar
-
神迹无影源代码0.162/Dbt3.dpr
-
神迹无影源代码0.162/Dbt3Main.dfm
-
神迹无影源代码0.162/Dbt3Main.pas
-
神迹无影源代码0.162/Dbt3MainProj.dpr
-
神迹无影源代码0.162/DisPack.pas
-
神迹无影源代码0.162/GameCode.pas
-
神迹无影源代码0.162/Hook.pas
-
神迹无影源代码0.162/LoopAttack.pas
-
神迹无影源代码0.162/Move.dfm
-
神迹无影源代码0.162/Move.pas
-
神迹无影源代码0.162/PackStruct.pas
-
神迹无影源代码0.162/PopWin.dfm
-
神迹无影源代码0.162/SendPack.pas
-
神迹无影源代码0.162/UnitState.pas
-
神迹无影源代码0.162/WinSock2.pas.js
-
神迹无影源代码0.162/WorkThread.dfm
-
神迹无影源代码0.162/WorkThread.pas
-
神迹无影源代码0.162/info.txt
-
神迹无影源代码0.162/wgFace.dfm
-
神迹无影源代码0.162/wgFace.pas
-
神迹无影源代码0.162/ws2tcpip.inc
-
神迹无影源代码0.162/wsipx.inc
-
神迹无影源代码0.162/wsnetbs.inc
-
神迹无影源代码0.162/wsnwlink.inc
-
神迹无影源代码0.162/说明.txt
-
560332500/sjsouce/神迹消息结构.rar.rar
-
神迹消息结构/消息结构.txt
-
神迹消息结构/行动命令.txt
-
神迹消息结构/说明.txt
-
560332500/sjsouce/神迹监视器1.3源代码.rar.rar
-
神迹监视器1.3源代码/Dbt3.dpr
-
神迹监视器1.3源代码/Dbt3Main.dfm
-
神迹监视器1.3源代码/Dbt3Main.pas
-
神迹监视器1.3源代码/Dbt3MainProj.dpr
-
神迹监视器1.3源代码/FilterForm.dfm
-
神迹监视器1.3源代码/FilterForm.pas
-
神迹监视器1.3源代码/GameCode.pas
-
神迹监视器1.3源代码/Hook.pas
-
神迹监视器1.3源代码/NetData.dfm
-
神迹监视器1.3源代码/NetData.pas
-
神迹监视器1.3源代码/PopWin.dfm
-
神迹监视器1.3源代码/PopWin.pas
-
神迹监视器1.3源代码/Twain/Info.txt
-
神迹监视器1.3源代码/WinSock2.pas.js
-
神迹监视器1.3源代码/WorkThread.dfm
-
神迹监视器1.3源代码/WorkThread.pas
-
神迹监视器1.3源代码/info.txt
-
神迹监视器1.3源代码/winsock2/WinSock2.pas.js
-
神迹监视器1.3源代码/winsock2/svcguid.pas
-
神迹监视器1.3源代码/winsock2/ws2tcpip.inc
-
神迹监视器1.3源代码/winsock2/wsipx.inc
-
神迹监视器1.3源代码/winsock2/wsnetbs.inc
-
神迹监视器1.3源代码/winsock2/wsnwlink.inc
-
神迹监视器1.3源代码/ws2tcpip.inc
-
神迹监视器1.3源代码/wsipx.inc
-
神迹监视器1.3源代码/wsnetbs.inc
-
神迹监视器1.3源代码/wsnwlink.inc
-
神迹监视器1.3源代码/说明.txt
-
560332500/sjsouce/说明2.txt
-
560332500/sjsouce/购买外挂.htm.html
-
560332500/下载说明.htm.html .js polyglot
-
560332500/就要上上上 91333.com.url.url