Overview

overview

3

Static

static

3

VE修改�...ok.dll

windows7-x64

3

VE修改�...ok.dll

windows10-2004-x64

3

VE修改�...er.exe

windows7-x64

3

VE修改�...er.exe

windows10-2004-x64

3

VE修改�...er.exe

windows7-x64

3

VE修改�...er.exe

windows10-2004-x64

3

VE修改�...al.exe

windows7-x64

3

VE修改�...al.exe

windows10-2004-x64

3

VE修改�...ne.exe

windows7-x64

3

VE修改�...ne.exe

windows10-2004-x64

3

VE修改�...32.dll

windows7-x64

3

VE修改�...32.dll

windows10-2004-x64

3

VE修改�...32.sys

windows7-x64

1

VE修改�...32.sys

windows10-2004-x64

1

VE修改�...ll.dll

windows7-x64

3

VE修改�...ll.dll

windows10-2004-x64

3

VE修改�...ss.exe

windows7-x64

1

VE修改�...ss.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    b71362d88cb99125c98da507c2c69306_JaffaCakes118

  • Size

    1.2MB

  • MD5

    b71362d88cb99125c98da507c2c69306

  • SHA1

    dc9b155713b4a71aa25c98a944e10b3c09722097

  • SHA256

    b415f934a10139fc6c5d1e41c810d8614a640dffb0610f15fb6e3acf9d2307b9

  • SHA512

    eb98dd187c8d3a87fb1c2338814c994a73b9f774086543d6890d8fc35709beeca5bc1e545ac64e40af284c1892d3f76e691bbf4d28398e47bec3f7f5ab6a5ba0

  • SSDEEP

    24576:P80bHrWjb1EIEMghbDJyj+OO2eSShaozGQlNGIvDeMjryfq5sHkOmH:5LWv2bDJyj+VBa6GQXJSM1+yH

Score
3/10

Malware Config

Signatures

  • Unsigned PE 9 IoCs

    Checks for missing Authenticode signature.

Files

  • b71362d88cb99125c98da507c2c69306_JaffaCakes118
    .rar
  • VE修改器汉化版/VE修改器汉化版/vzla_engine/ADDRESSESFIRST.TMP
  • VE修改器汉化版/VE修改器汉化版/vzla_engine/Addresses-3232.TMP
  • VE修改器汉化版/VE修改器汉化版/vzla_engine/Addys.tmp
  • VE修改器汉化版/VE修改器汉化版/vzla_engine/DAHook.dll
    .dll windows:4 windows x86 arch:x86

    847129de4cb396f6d65a2c3fd914154a


    Headers

    Imports

    Exports

    Sections

  • VE修改器汉化版/VE修改器汉化版/vzla_engine/DAKernDat.dat
  • VE修改器汉化版/VE修改器汉化版/vzla_engine/Kernelmoduleunloader.exe
    .exe windows:4 windows x86 arch:x86

    26f9730a19ca0efd06d8dd0a13662b74


    Headers

    Imports

    Sections

  • VE修改器汉化版/VE修改器汉化版/vzla_engine/MEMORYFIRST.TMP
  • VE修改器汉化版/VE修改器汉化版/vzla_engine/SysCallRetriever.exe
    .exe windows:4 windows x86 arch:x86

    22e26b67d8d33e6ccbb1da428b01b687


    Headers

    Imports

    Sections

  • VE修改器汉化版/VE修改器汉化版/vzla_engine/SysCallSignal.exe
    .exe windows:4 windows x86 arch:x86

    4467f6f3ae05e670dfdde4a5da870444


    Headers

    Imports

    Sections

  • VE修改器汉化版/VE修改器汉化版/vzla_engine/Vzla Engine.exe
    .exe windows:4 windows x86 arch:x86

    101768a96717a104af385f5c6de76b63


    Headers

    Imports

    Sections

  • VE修改器汉化版/VE修改器汉化版/vzla_engine/dak32.dll
    .dll windows:4 windows x86 arch:x86

    a7537a763be3c3c6a63dec8ed1c19d25


    Headers

    Imports

    Exports

    Sections

  • VE修改器汉化版/VE修改器汉化版/vzla_engine/dak32.sys
    .sys windows:6 windows x86 arch:x86

    cd6e1fde8eb2c1c1d7fafe4511663265


    Headers

    Imports

    Sections

  • VE修改器汉化版/VE修改器汉化版/vzla_engine/emptydll.dll
    .dll windows:4 windows x86 arch:x86

    6760a0ff6425a5b23bc76f162583bd01


    Headers

    Imports

    Sections

  • VE修改器汉化版/VE修改器汉化版/vzla_engine/emptyprocess.exe
    .exe windows:4 windows x86 arch:x86

    78c94c599fd4e7e62fd1296d28f17711


    Headers

    Imports

    Sections