Overview
overview
4Static
static
3KHSmartNoD...��.url
windows7-x64
1KHSmartNoD...��.url
windows10-2004-x64
1KHSmartNoD...��.url
windows7-x64
1KHSmartNoD...��.url
windows10-2004-x64
1KHSmartNoD....5.doc
windows7-x64
4KHSmartNoD....5.doc
windows10-2004-x64
KHSmartNoD...��.exe
windows7-x64
3KHSmartNoD...��.exe
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
KHSmartNoDiskVer_386w.com/下载排行榜.url
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
KHSmartNoDiskVer_386w.com/下载排行榜.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
KHSmartNoDiskVer_386w.com/使用帮助.url
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
KHSmartNoDiskVer_386w.com/使用帮助.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
KHSmartNoDiskVer_386w.com/内网安全卫士安装及使用说明v1.5.doc
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
KHSmartNoDiskVer_386w.com/内网安全卫士安装及使用说明v1.5.doc
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
KHSmartNoDiskVer_386w.com/服务器端安装包/内网安全卫士服务端.exe
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
KHSmartNoDiskVer_386w.com/服务器端安装包/内网安全卫士服务端.exe
Resource
win10v2004-20240802-en
General
-
Target
bfd3b00e216f50d6839b68362222e877_JaffaCakes118
-
Size
5.0MB
-
MD5
bfd3b00e216f50d6839b68362222e877
-
SHA1
ff4ddec84cc331e2ef6cc8c6d8720e1ca320670a
-
SHA256
cf9a6e17676ccec65dde14e2ef31cea595abb4f1e8ab182a80d1aca9d2d86ded
-
SHA512
47165741054c8eb6537d6be0d581bb47f36f966d8c39c97e3ac31b07e89cabee938324da4673a80b7010f27a0f1534c5169c14f5bb79c791382434a45bb364af
-
SSDEEP
98304:OMFdc92l0of28KBH6enXqs0ntvRAgXCXQmroBiKCl08+e+PIIR2gyQMA0:Fs2l0Kx4H6dMgXCXmiKCloe+PIZQMA0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/KHSmartNoDiskVer_386w.com/服务器端安装包/内网安全卫士服务端.exe
Files
-
bfd3b00e216f50d6839b68362222e877_JaffaCakes118.rar
-
KHSmartNoDiskVer_386w.com/下载排行榜.url.url
-
KHSmartNoDiskVer_386w.com/乡巴佬下载站.txt
-
KHSmartNoDiskVer_386w.com/使用帮助.url
-
KHSmartNoDiskVer_386w.com/内网安全卫士安装及使用说明v1.5.doc.doc windows office2003
-
KHSmartNoDiskVer_386w.com/客户端安装说明.txt
-
KHSmartNoDiskVer_386w.com/服务器端安装包/内网安全卫士服务端.exe.exe windows:1 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 1024B - Virtual size: 588B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ