Static task
static1
Behavioral task
behavioral1
Sample
Update.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Update.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
红蓝球霸.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
红蓝球霸.exe
Resource
win10v2004-20240802-en
General
-
Target
a53058e28eace8900edc43fc1f14be46_JaffaCakes118
-
Size
860KB
-
MD5
a53058e28eace8900edc43fc1f14be46
-
SHA1
8a53ffc40dc8386bf35ba434d8bd7c25e7ca5780
-
SHA256
5f7b36e1680a904676f649cbd7bc850843bc7836dbb2ea302e59e35c6386d645
-
SHA512
b2cb4e0ac1cb8a78a18210edcc4f4188cd99c21e10e6d7afa7425b745a935475224a9bfdc6adaf179a1139ebdc2cb31c206ec924f4487794e7c47b48e706895a
-
SSDEEP
24576:qF3tJT8zr4jQQWDd0ZAxaTdUFcI0FipQaKPYjVQg:sJa8xWDG1Ufq0xVn
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Update.exe unpack001/红蓝球霸.exe
Files
-
a53058e28eace8900edc43fc1f14be46_JaffaCakes118.rar
-
Ball8.ini
-
Balls/b1.bmp
-
Balls/b10.bmp
-
Balls/b11.bmp
-
Balls/b12.bmp
-
Balls/b13.bmp
-
Balls/b14.bmp
-
Balls/b15.bmp
-
Balls/b16.bmp
-
Balls/b2.bmp
-
Balls/b3.bmp
-
Balls/b4.bmp
-
Balls/b5.bmp
-
Balls/b6.bmp
-
Balls/b7.bmp
-
Balls/b8.bmp
-
Balls/b9.bmp
-
Balls/blue.bmp
-
Balls/r1.bmp
-
Balls/r10.bmp
-
Balls/r11.bmp
-
Balls/r12.bmp
-
Balls/r13.bmp
-
Balls/r14.bmp
-
Balls/r15.bmp
-
Balls/r16.bmp
-
Balls/r17.bmp
-
Balls/r18.bmp
-
Balls/r19.bmp
-
Balls/r2.bmp
-
Balls/r20.bmp
-
Balls/r21.bmp
-
Balls/r22.bmp
-
Balls/r23.bmp
-
Balls/r24.bmp
-
Balls/r25.bmp
-
Balls/r26.bmp
-
Balls/r27.bmp
-
Balls/r28.bmp
-
Balls/r29.bmp
-
Balls/r3.bmp
-
Balls/r30.bmp
-
Balls/r31.bmp
-
Balls/r32.bmp
-
Balls/r33.bmp
-
Balls/r4.bmp
-
Balls/r5.bmp
-
Balls/r6.bmp
-
Balls/r7.bmp
-
Balls/r8.bmp
-
Balls/r9.bmp
-
Balls/red.bmp
-
Balls/下载说明.htm.html .js polyglot
-
Buttons/AutoSelect.BMP
-
Buttons/Cast.BMP
-
Buttons/Check.bmp
-
Buttons/Clear.bmp
-
Buttons/Commit.bmp
-
Buttons/Delete.bmp
-
Buttons/EXPORT.BMP
-
Buttons/Filter.BMP
-
Buttons/INPORT.BMP
-
Buttons/Insert.bmp
-
Buttons/Modify.bmp
-
Buttons/OnLine.BMP
-
Buttons/Open.bmp
-
Buttons/Printer.bmp
-
Buttons/Refresh.bmp
-
Buttons/Save.bmp
-
Buttons/SelectFile.bmp
-
Buttons/UnReg.bmp
-
Buttons/reg.bmp
-
Buttons/下载说明.htm.html .js polyglot
-
DB/ball.mdb
-
DB/下载说明.htm.html .js polyglot
-
History.txt
-
Update.exe.exe windows:4 windows x86 arch:x86
f95c3d489bb12bcbac4bf2fe9e9a9ceb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
user32
GetKeyboardType
advapi32
RegQueryValueExA
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
UnrealizeObject
comctl32
ImageList_SetIconSize
shell32
ShellExecuteA
Sections
CODE Size: 284KB - Virtual size: 880KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 74KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
下载说明.htm.html .js polyglot
-
红蓝球霸.exe.exe windows:4 windows x86 arch:x86
4e0e88b1da4b40860eae92f0e5de056c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
user32
GetKeyboardType
advapi32
RegQueryValueExA
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
UnrealizeObject
ole32
CoTaskMemFree
comctl32
ImageList_SetIconSize
shell32
ShellExecuteA
comdlg32
GetSaveFileNameA
Sections
CODE Size: 469KB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 75KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE