�(��{����r�}[.��Z�Bnw~����4h����le�g�YR�-��yZ�3��QD��3�b�h�|���ʎVw����i���.dz����Kq*�,�����A⎒�����>'���IѫS�r�=ݝi#N�]��������7&4lVt=��v�G�� &7� -J3�Ϛ ��(���f4�)�t��ղ]j A� yI���+cF�^���+���RL�Z�M�� ��HU~�D86�����{��+q���帼Eb# z6�v�M�5�Y������ya��T�>��t�"���EʅUh�[�h)��ѯF2��V ����f���ƪ:.l��3�K���} ��fP�g>`=Vo@�Wx)}�g��5�J쐒�L��� ^(��2 ��#���3�}X�n�*vlG�K �p�29Lcv��êƒqq9�t=r���ϿP!.�G}a)�C�Cǡ��i������l������<a�Z��\$>���� ��hM��!�r�QfnB�s�]��D��6Q�E1�i�Q��}����Y�E����(�l"�Jr�FW��6���t��뎲�K�Zb&�Gؓi��*�D�1툎D�s��2]H'b�,��o�� 0�ң����_�O�RQ��-3TM�����9l] �(s_8�!9���v���=�b4p`ί��0� U�q�0#���ն˟��d>���O:�����,�T��Mm����.����2�H1=C��/[7���ɳ>�2C�HՇ�Ι��j[F�30���E��:9;f�"$�L�ǗS�v�Z�N���}´X�y�?�����|��e�;�ٖ���I�o��&�����&S�4M5l(Р|��T��!N:�:���n��f���t=�'{��!�L���u7�Vs]��eg��2�v���~�� ���KcGZH�x���쿇 I���U<��a��`���3�q~�S��X�ѱL��� �♫��4��=���8��W�!�X�-o�,��{�,���B�1�&N�J���'Ǝ���dnRZ&�m����.u��l��4e�폧��W��X�9�[�2>�7O��$wڰt SY��J(W�1�%�Q� �-7yw�������v 0�O��"�H�%��Bpn�,湍U[�/�[͟�AUF�x�< ɟ�P��[��z�v��{x�c���-�?��[g�A��y�_�N?�>T������"��2LV�uCq������v���B0��<��V���N����'%�"{!�f�pE��C �N܋�7���0!��H�Ɇk,SqF @e�"�shD��W� [�E]���A?�Hspp�{�U���>�`F�rE�A�IԵ�ܫcNQ���:�!��+��>F8���5ԫ#�����o$�������zm����lM?T�6�9���B��M���/1b+���$�˩�Mz�!�TK���4�_E�.��yM&-���-d����tD�95�������g����#ɇo���3e~��V"�� (+�H�EU.�y��>q����U$��c����:c�Թ���ԋ�h��ޞ��*��Z�_NA��8[�L JفK��R�9�W���:�����io�ҵ�9j3)�B���i�sk�s��d����A`��M�0��6}��2���� ���\����2���֣���=�#����V���e�2·�*�� {e=�(DQ�l�c�[�ԩ�2��ptف��E��K���WR�Q|}��.B�3(õ#���4(����ݕL��D�ٲ�pMOq�xJq< ����m���,������]�O���8��c����C�?Um��7z�~�����+[{k�0��� �����܌�~]�\1t�|S��F����w;=|R�'�5+{Sn�Ts�}(8td�������x�m�p��f�bd?n���R|�����6GI�ց��ʹ�f�~W��c��X��T��Cmt��i�p)\��~�Q�$s ��>|�{ �Q�&�F� ���U�]������.%��%[��� ��?{��J:��2��e�C�C���\���������������R}<�V�s}��{���f��� ���b!ݽ���~���yL�x"'�Fj��u�~�]���s����_I��|,�j�A�f�3�/F�r`*��G�9���wN rje�|�,����:��-�S��yWC<dll-����0��v�Y"�ksH_wV�Zk�&��������;�Gq�~a{ " ��'��l����� \�m�'�=�N��D�����Q�Э �tY��ǧ0g�n�pP���5Xf}�C}7֗�o=T˘L����u�52���$����^� �Ϭ\@!���?5��U�0F�}'�O��� 榗���P�F]Vw���bR"m�\C�Љ��L_ѷE�!q|���(d���Ij��w���P^{gb�@��v=�zF���džRQ��r�_�Hͣ5ߋ4A�g�kR� h&H�@�h�LN>A�Xq��k�*"q_mjhptF����Y��y����k�@��F���#��)am�Ĝ�q�^��Ӓւ��\!�$H;�-Nk�;{���S� ���½��z�;��'���"C{�xK�`辵����G ] ����?P$�:�j�9��;�h�'�뼿?>S�ެ�SCn���E��{����Y,(��`�'�������h�D����B�,���F�@�{w���Ex \Q78��a��m�z�����m7d%���s��Ϭ��*ב;wE-�B���X�I����v7K�yMՀ7v�א�⹃�ʲ�Jn�p62�ܨ��e}}xu�ڣ��l�1[P5]�c�a����k%T��k�6Nf�OX�F������q��V�&�17)��A�-G��̴�ϑ��� _h������>�Fr��WcM�ܱ�ay�i���y�]5d0@�I��\���{>�.���`��Ь���|1,`Swx�Pص��~��>�����7 �(_7�4!��??N�<���R��5l�xEƺΏ�8?�DD��쪶��ĮH�'>2;�z�,�H2k|��C-y���1������1����ct� O��Y�
Static task
static1
Behavioral task
behavioral1
Sample
6kun.com外挂说明.htm
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6kun.com外挂说明.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
t6t8下载说明.htm
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
t6t8下载说明.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
『炫音』E版全模式全P辅助.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
『炫音』E版全模式全P辅助.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
美女中心.htm
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
美女中心.htm
Resource
win10v2004-20240802-en
General
-
Target
adea763f9cbc5353cd22f5264c8dad9d_JaffaCakes118
-
Size
2.3MB
-
MD5
adea763f9cbc5353cd22f5264c8dad9d
-
SHA1
6da59cccf32785ecf1fa9dc4fefbc798adc4fbf1
-
SHA256
707053181bd05014350861000be4c9ca740ecf39e8d64d92f48fc258672cb09a
-
SHA512
c4a0291b5711ccd4f98e2b016bad41ba4073917d09e9674f5a7d6e0ab58ba28a1b38d44b6f4783d5672736b44f8948918433b9e37b013c08819edb050e077498
-
SSDEEP
49152:3O+nj/Z25sZTkJ8PQOOI6BJ7fGKweODVdG7woG1ibYs5gbK6s:eD5Gk9FrW/+wo/U1bK6s
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/『炫音』E版全模式全P辅助.exe
Files
-
adea763f9cbc5353cd22f5264c8dad9d_JaffaCakes118.rar
-
6kun.com外挂说明.htm.html
-
t6t8下载说明.htm.html
-
『炫音』E版全模式全P辅助.exe.exe windows:5 windows x86 arch:x86
e98cd6993c0c399101a0a8e190ef3719
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SafeArrayPtrOfIndex
advapi32
RegFlushKey
user32
EnumWindows
MessageBoxA
kernel32
TlsSetValue
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msimg32
AlphaBlend
gdi32
GetObjectW
version
GetFileVersionInfoSizeW
ole32
ProgIDFromCLSID
comctl32
ImageList_GetBkColor
imm32
ImmInstallIMEW
wininet
InternetReadFile
shell32
ShellExecuteW
Exports
Exports
Sections
.text Size: - Virtual size: 805KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 30KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didata Size: - Virtual size: 806B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 60B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 226KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1011KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
美女中心.htm.html