E:\qcms_net\classlib\ClassLibrary\obj\Debug\ClassLibrary.pdb
Overview
overview
3Static
static
3admin/Default.asp
windows7-x64
3admin/Default.asp
windows10-2004-x64
3admin/edit...tor.js
windows7-x64
3admin/edit...tor.js
windows10-2004-x64
3admin/edit...t.html
windows7-x64
3admin/edit...t.html
windows10-2004-x64
3admin/edit...r.html
windows7-x64
3admin/edit...r.html
windows10-2004-x64
1admin/edit...ger.js
windows7-x64
3admin/edit...ger.js
windows10-2004-x64
3admin/edit...h.html
windows7-x64
3admin/edit...h.html
windows10-2004-x64
3admin/edit...e.html
windows7-x64
3admin/edit...e.html
windows10-2004-x64
3admin/edit...k.html
windows7-x64
3admin/edit...k.html
windows10-2004-x64
3admin/edit...a.html
windows7-x64
3admin/edit...a.html
windows10-2004-x64
3admin/edit...e.html
windows7-x64
3admin/edit...e.html
windows10-2004-x64
3admin/edit...e.html
windows7-x64
3admin/edit...e.html
windows10-2004-x64
3admin/新�...��.url
windows7-x64
1admin/新�...��.url
windows10-2004-x64
1bin/App_Code.dll
windows7-x64
1bin/App_Code.dll
windows10-2004-x64
1bin/App_We...an.dll
windows7-x64
1bin/App_We...an.dll
windows10-2004-x64
1bin/App_We...en.dll
windows7-x64
1bin/App_We...en.dll
windows10-2004-x64
1bin/App_We...sz.dll
windows7-x64
1bin/App_We...sz.dll
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
admin/Default.asp
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
admin/Default.asp
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
admin/editor/kindeditor.js
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
admin/editor/kindeditor.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
admin/editor/plugins/about.html
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
admin/editor/plugins/about.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
admin/editor/plugins/file_manager/file_manager.html
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
admin/editor/plugins/file_manager/file_manager.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
admin/editor/plugins/file_manager/file_manager.js
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
admin/editor/plugins/file_manager/file_manager.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
admin/editor/plugins/flash.html
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
admin/editor/plugins/flash.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
admin/editor/plugins/image/image.html
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
admin/editor/plugins/image/image.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
admin/editor/plugins/link/link.html
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
admin/editor/plugins/link/link.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
admin/editor/plugins/media.html
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
admin/editor/plugins/media.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
admin/editor/plugins/plainpaste.html
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
admin/editor/plugins/plainpaste.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
admin/editor/plugins/wordpaste.html
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
admin/editor/plugins/wordpaste.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
admin/新云软件.url
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
admin/新云软件.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
bin/App_Code.dll
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
bin/App_Code.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
bin/App_Web_gfmbp-an.dll
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
bin/App_Web_gfmbp-an.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
bin/App_Web_nscgbmen.dll
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
bin/App_Web_nscgbmen.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
bin/App_Web_wcihjfsz.dll
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
bin/App_Web_wcihjfsz.dll
Resource
win10v2004-20240802-en
General
-
Target
c788b91d53df1d0cb63232a10695e181_JaffaCakes118
-
Size
267KB
-
MD5
c788b91d53df1d0cb63232a10695e181
-
SHA1
d15ad28dca268aca166fbe75dd87310900dae02e
-
SHA256
24167f5f0c9f02ef68f56fe1ad1416569a4e3bd310d4338dcf4dfdd701e7f3e4
-
SHA512
caf06d2369afd9adc877bf4301c4251b8afc16b7ca2dbe186ab350fdf2b934426d88491ddab355e51489e944b7a8ab8ce32aae92931a1bf60dca7bb9dd77bac5
-
SSDEEP
6144:zTbjieyFS+6lXOt8qB8NXhE1YdTjOnxRMrjb0GoLIIfjk9So9Wu:zualrq2NIYBOnTwBSxjx+Wu
Malware Config
Signatures
-
Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/bin/App_Code.dll unpack001/bin/App_Web_gfmbp-an.dll unpack001/bin/App_Web_nscgbmen.dll unpack001/bin/App_Web_wcihjfsz.dll unpack001/bin/ClassLibrary.dll unpack001/bin/Db.dll
Files
-
c788b91d53df1d0cb63232a10695e181_JaffaCakes118.rar
-
Controls/admin.ascx
-
Controls/admin_add.ascx
-
Controls/cate_add.ascx
-
Controls/cate_list.ascx
-
Controls/cont_add.ascx
-
Controls/cont_list.ascx
-
Controls/guest.ascx
-
Controls/sys.ascx
-
Controls/tag_list.ascx
-
Controls/user.ascx
-
Controls/user_add.ascx
-
PrecompiledApp.config
-
QCMS_NET_V1.0_beta.txt
-
admin/Default.aspx.asp
-
admin/XMLFile.xml
-
admin/editor/kindeditor.js.js
-
admin/editor/plugins/about.html.html .js polyglot
-
admin/editor/plugins/file_manager/file_manager.css
-
admin/editor/plugins/file_manager/file_manager.html.html
-
admin/editor/plugins/file_manager/file_manager.js.js
-
admin/editor/plugins/file_manager/images/file-16.gif.gif
-
admin/editor/plugins/file_manager/images/file-64.gif.gif
-
admin/editor/plugins/file_manager/images/folder-16.gif.gif
-
admin/editor/plugins/file_manager/images/folder-64.gif.gif
-
admin/editor/plugins/file_manager/images/go-up.gif.gif
-
admin/editor/plugins/flash.html.html .js polyglot
-
admin/editor/plugins/image/image.html.html .js polyglot
-
admin/editor/plugins/image/images/align_bottom.gif.gif
-
admin/editor/plugins/image/images/align_left.gif.gif
-
admin/editor/plugins/image/images/align_middle.gif.gif
-
admin/editor/plugins/image/images/align_right.gif.gif
-
admin/editor/plugins/image/images/align_top.gif.gif
-
admin/editor/plugins/image/images/refresh.gif.gif
-
admin/editor/plugins/link/link.html.html .js polyglot
-
admin/editor/plugins/media.html.html .js polyglot
-
admin/editor/plugins/plainpaste.html.html .js polyglot
-
admin/editor/plugins/wordpaste.html.html .js polyglot
-
admin/editor/skins/common/blank.gif.gif
-
admin/editor/skins/common/editor.css
-
admin/editor/skins/common/flash.gif.gif
-
admin/editor/skins/common/loading.gif.gif
-
admin/editor/skins/common/media.gif.gif
-
admin/editor/skins/common/rm.gif.gif
-
admin/editor/skins/oxygen.css
-
admin/editor/skins/oxygen/oxygen.gif.gif
-
admin/login.aspx
-
admin/main.aspx
-
admin/menu.aspx
-
admin/right.aspx
-
admin/styles/advanced/images/login.gif.gif
-
admin/styles/advanced/style.css
-
admin/新云软件.url.url
-
bin/App_Code.compiled
-
bin/App_Code.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 680B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
bin/App_Web_gfmbp-an.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
bin/App_Web_nscgbmen.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
bin/App_Web_wcihjfsz.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
bin/ClassLibrary.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
mscoree
_CorDllMain
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
bin/ClassLibrary.pdb
-
bin/Db.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
E:\qcms_net\classlib\Db\obj\Debug\Db.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 800B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
bin/Db.pdb
-
guest.aspx
-
images/bg_x.gif.gif
-
images/login.jpg.jpg
-
index.aspx
-
list.aspx
-
login.aspx
-
reg.aspx
-
sql/data
-
templist/default/css.css
-
templist/default/footer.html
-
templist/default/guest.html.js
-
templist/default/header.html.html .js polyglot
-
templist/default/images/banner.jpg.jpg
-
templist/default/images/bg_1.gif.gif
-
templist/default/images/bg_x.gif.gif
-
templist/default/images/bottMenuBg.jpg.jpg
-
templist/default/images/chanpin.gif.gif
-
templist/default/images/h4Bg.jpg.jpg
-
templist/default/images/headerBg.jpg.jpg
-
templist/default/images/login.jpg.jpg
-
templist/default/images/logo.jpg.jpg
-
templist/default/images/menuBg.jpg.jpg
-
templist/default/images/more.gif.gif
-
templist/default/images/new_dian.gif.gif
-
templist/default/images/notice-newsBg.jpg.jpg
-
templist/default/images/notice-newsLi.jpg.jpg
-
templist/default/images/rss.jpg.jpg
-
templist/default/images/search.png.png
-
templist/default/images/tp.jpg.jpg
-
templist/default/index.html
-
templist/default/list.html
-
templist/default/other.html
-
templist/default/prolist.html
-
templist/default/view.html
-
upfile/20100211044831chanpin.jpg.jpg
-
upfile/20100211044949chanpin2.jpg.jpg
-
upfile/20100211045048chanpin3.jpg.jpg
-
view.aspx
-
web.config