Overview
overview
4Static
static
3564219833/data.htm
windows7-x64
3564219833/data.htm
windows10-2004-x64
3564219833/deltemp.bat
windows7-x64
1564219833/deltemp.bat
windows10-2004-x64
1564219833/weather.exe
windows7-x64
3564219833/weather.exe
windows10-2004-x64
3564219833/...��.doc
windows7-x64
4564219833/...��.doc
windows10-2004-x64
1564219833/...��.htm
windows7-x64
3564219833/...��.htm
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
564219833/data.htm
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
564219833/data.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
564219833/deltemp.bat
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
564219833/deltemp.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
564219833/weather.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
564219833/weather.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
564219833/说明文档.doc
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
564219833/说明文档.doc
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
564219833/说明文档.htm
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
564219833/说明文档.htm
Resource
win10v2004-20240802-en
General
-
Target
bd0a839afc96e9f5f2aa8ea2a50976de_JaffaCakes118
-
Size
809KB
-
MD5
bd0a839afc96e9f5f2aa8ea2a50976de
-
SHA1
a84952f03e527e573368e2812a4673a023c4b518
-
SHA256
ef96a450b81f965d6e0460f0f21bfadf8b1cdce080613b364d3a4ebd5fcc8d8b
-
SHA512
113093ce3ae2e6abbc40c6ff4361542e7bdc7a97b547446e735fa3f45ab787314a8adbe4d8afcf4970aa6315c8a29b31a5bf954e373ccff3a283327970b451e3
-
SSDEEP
24576:/NQ+01HCKqy8+WUdlCQ1BFTEC5eYPk4nu6X:Vx01Hrq0WUd8KZ18L6X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/564219833/weather.exe
Files
-
bd0a839afc96e9f5f2aa8ea2a50976de_JaffaCakes118.rar
-
564219833/Project1.dpr
-
564219833/Project1.res
-
564219833/about.dcu
-
564219833/about.dfm
-
564219833/about.jpg.jpg
-
564219833/about.pas
-
564219833/banner.jpg.jpg
-
564219833/bd____.jpg.jpg
-
564219833/city/上海.txt
-
564219833/city/云南.txt
-
564219833/city/内蒙古.txt
-
564219833/city/加拿大.txt
-
564219833/city/北京.txt
-
564219833/city/吉林.txt
-
564219833/city/四川.txt
-
564219833/city/天津.txt
-
564219833/city/宁夏.txt
-
564219833/city/安徽.txt
-
564219833/city/山东.txt
-
564219833/city/山西.txt
-
564219833/city/广东.txt
-
564219833/city/广西.txt
-
564219833/city/新疆.txt
-
564219833/city/新西兰.txt
-
564219833/city/江苏.txt
-
564219833/city/江西.txt
-
564219833/city/河北.txt
-
564219833/city/河南.txt
-
564219833/city/法国.txt
-
564219833/city/浙江.txt
-
564219833/city/海南.txt
-
564219833/city/湖北.txt
-
564219833/city/湖南.txt
-
564219833/city/澳大利亚.txt
-
564219833/city/澳门.txt
-
564219833/city/爱尔兰.txt
-
564219833/city/甘肃.txt
-
564219833/city/福建.txt
-
564219833/city/美国.txt
-
564219833/city/英国.txt
-
564219833/city/西藏.txt
-
564219833/city/贵州.txt
-
564219833/city/辽宁.txt
-
564219833/city/重庆.txt
-
564219833/city/陕西.txt
-
564219833/city/青海.txt
-
564219833/city/香港.txt
-
564219833/city/黑龙江.txt
-
564219833/config.dcu
-
564219833/config.dfm
-
564219833/config.ini
-
564219833/config.pas
-
564219833/data.htm
-
564219833/deltemp.bat
-
564219833/jm.jpg.jpg
-
564219833/jm1.jpg.jpg
-
564219833/jm2.jpg.jpg
-
564219833/main.dcu
-
564219833/main.dfm
-
564219833/main.pas
-
564219833/weather.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 701KB - Virtual size: 700KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 131KB - Virtual size: 131KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
564219833/weather.query.gif.gif
-
564219833/下载说明.htm.html .js polyglot
-
564219833/图标/NotePad.ico
-
564219833/图标/bd____.gif.gif
-
564219833/图标/bdg1__.gif.gif
-
564219833/图标/bdg2__.gif.gif
-
564219833/图标/bdg3__.gif.gif
-
564219833/图标/bdr1__.gif.gif
-
564219833/图标/bdr2__.gif.gif
-
564219833/图标/bdr3__.gif.gif
-
564219833/图标/bds1__.gif.gif
-
564219833/图标/bds2__.gif.gif
-
564219833/图标/bds3__.gif.gif
-
564219833/图标/bdsn1_.gif.gif
-
564219833/图标/bdsn2_.gif.gif
-
564219833/图标/bdsn3_.gif.gif
-
564219833/图标/bdsns1.gif.gif
-
564219833/图标/bdsns2.gif.gif
-
564219833/图标/bdsns3.gif.gif
-
564219833/图标/bmp/bd____.bmp
-
564219833/图标/bw____.gif.gif
-
564219833/图标/bwg1__.gif.gif
-
564219833/图标/bwg2__.gif.gif
-
564219833/图标/bwg3__.gif.gif
-
564219833/图标/bwr1__.gif.gif
-
564219833/图标/bwr2__.gif.gif
-
564219833/图标/bwr3__.gif.gif
-
564219833/图标/bws1__.gif.gif
-
564219833/图标/bws2__.gif.gif
-
564219833/图标/bws3__.gif.gif
-
564219833/图标/bwsn1_.gif.gif
-
564219833/图标/bwsn2_.gif.gif
-
564219833/图标/bwsn3_.gif.gif
-
564219833/图标/bwsns1.gif.gif
-
564219833/图标/bwsns2.gif.gif
-
564219833/图标/bwsns3.gif.gif
-
564219833/图标/jpg/bd____.jpg.jpg
-
564219833/图标/jpg/bdg1__.jpg.jpg
-
564219833/图标/jpg/bdg2__.jpg.jpg
-
564219833/图标/jpg/bdg3__.jpg.jpg
-
564219833/图标/jpg/bdr1__.jpg.jpg
-
564219833/图标/jpg/bdr2__.jpg.jpg
-
564219833/图标/jpg/bdr3__.jpg.jpg
-
564219833/图标/jpg/ms____(1).jpg.jpg
-
564219833/图标/jpg/so____.jpg.jpg
-
564219833/图标/jpg/wb____.jpg.jpg
-
564219833/图标/jpg/wbg1__.jpg.jpg
-
564219833/图标/jpg/wbsn1_.jpg.jpg
-
564219833/图标/jpg/复件 bdg3__.jpg.jpg
-
564219833/图标/jpg/复件 ms____(1).jpg.jpg
-
564219833/图标/ms____(1).gif.gif
-
564219833/图标/ms____.gif.gif
-
564219833/图标/so____.gif.gif
-
564219833/图标/wb____.gif.gif
-
564219833/图标/wbg1__.gif.gif
-
564219833/图标/wbg2__.gif.gif
-
564219833/图标/wbg3__.gif.gif
-
564219833/图标/wbr1__.gif.gif
-
564219833/图标/wbr2__.gif.gif
-
564219833/图标/wbr3__.gif.gif
-
564219833/图标/wbs1__.gif.gif
-
564219833/图标/wbs2__.gif.gif
-
564219833/图标/wbs3__.gif.gif
-
564219833/图标/wbsn1_.gif.gif
-
564219833/图标/wbsn2_.gif.gif
-
564219833/图标/wbsn3_.gif.gif
-
564219833/图标/wbsns1.gif.gif
-
564219833/图标/wbsns2.gif.gif
-
564219833/图标/wbsns3.gif.gif
-
564219833/说明文档.doc.doc windows office2003
-
564219833/说明文档.files/filelist.xml
-
564219833/说明文档.files/image001.png.png
-
564219833/说明文档.files/image002.jpg.jpg
-
564219833/说明文档.files/image003.jpg.jpg
-
564219833/说明文档.files/image004.jpg.jpg
-
564219833/说明文档.files/image005.png.png
-
564219833/说明文档.files/image006.jpg.jpg
-
564219833/说明文档.files/image007.jpg.jpg
-
564219833/说明文档.htm.html