Overview
overview
3Static
static
1#$%shuju/�...��.url
windows7-x64
1#$%shuju/�...��.url
windows10-2004-x64
1GG500_CONT.vbs
windows7-x64
1GG500_CONT.vbs
windows10-2004-x64
1about.html
windows7-x64
3about.html
windows10-2004-x64
3allinc/downleft.asp
windows7-x64
3allinc/downleft.asp
windows10-2004-x64
3allinc/inc_down.asp
windows7-x64
3allinc/inc_down.asp
windows10-2004-x64
3allinc/inc_style.asp
windows7-x64
3allinc/inc_style.asp
windows10-2004-x64
3allinc/inc_top.vbs
windows7-x64
1allinc/inc_top.vbs
windows10-2004-x64
1allinc/wnag_ip.vbs
windows7-x64
1allinc/wnag_ip.vbs
windows10-2004-x64
1configs/config.vbs
windows7-x64
1configs/config.vbs
windows10-2004-x64
1configs/noip.vbs
windows7-x64
1configs/noip.vbs
windows10-2004-x64
1db_.htm.conn.vbs
windows7-x64
1db_.htm.conn.vbs
windows10-2004-x64
1down.vbs
windows7-x64
1down.vbs
windows10-2004-x64
1download_dx9.html
windows7-x64
3download_dx9.html
windows10-2004-x64
3download_ie.html
windows7-x64
3download_ie.html
windows10-2004-x64
3download_media.html
windows7-x64
3download_media.html
windows10-2004-x64
3download_real.html
windows7-x64
3download_real.html
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
#$%shuju/新云软件.url
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
#$%shuju/新云软件.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
GG500_CONT.vbs
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
GG500_CONT.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
about.html
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
about.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
allinc/downleft.asp
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
allinc/downleft.asp
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
allinc/inc_down.asp
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
allinc/inc_down.asp
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
allinc/inc_style.asp
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
allinc/inc_style.asp
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
allinc/inc_top.vbs
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
allinc/inc_top.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
allinc/wnag_ip.vbs
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
allinc/wnag_ip.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
configs/config.vbs
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
configs/config.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
configs/noip.vbs
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
configs/noip.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
db_.htm.conn.vbs
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
db_.htm.conn.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
down.vbs
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
down.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
download_dx9.html
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
download_dx9.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
download_ie.html
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
download_ie.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
download_media.html
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
download_media.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
download_real.html
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
download_real.html
Resource
win10v2004-20240802-en
General
-
Target
cead60e7ed9db1219ec736c1e0a8bb95_JaffaCakes118
-
Size
1.4MB
-
MD5
cead60e7ed9db1219ec736c1e0a8bb95
-
SHA1
a5f4c9218c8827a3bc86b662f4592d88778164cf
-
SHA256
85cb2fc0c9a8c9fac21199cb7eb64694310835188b68aa48574280360c6d9de8
-
SHA512
a69225273b6b91e765172d9d19247bc99bb82890b4de6303fa6da05550660a7ef24f9d1cbe7449d3f734df0675fbcc553897ce7c719beb8ea36e97d166c03d9d
-
SSDEEP
24576:TkLEEzr+YK01V288zKbJZshJH9uGs3Azkt+vupoh3:TkLDr+q1Vf8m9mnHpj7upm3
Malware Config
Signatures
Files
-
cead60e7ed9db1219ec736c1e0a8bb95_JaffaCakes118.rar
-
#$%shuju/ht.ml#d_+b.mdb
-
#$%shuju/新云软件.url.url
-
GG500_CONT.asp.vbs
-
GG500_CONTENT.ASP.html .vbs polyglot
-
GG500_FENLEI.ASP.html .vbs polyglot
-
GG500_PAIHANG.ASP.html .vbs polyglot
-
GG500_SEARCH.ASP.html .vbs polyglot
-
GG500_SEARCHS.ASP.html .vbs polyglot
-
GG500_WUYECHANG.ASP.html .vbs polyglot
-
GG500_ZUIXIN.ASP.html .vbs polyglot
-
about.asp.html
-
allinc/downleft.asp
-
allinc/inc_down.asp
-
allinc/inc_style.asp
-
allinc/inc_top.asp.vbs
-
allinc/wnag_ip.asp.vbs
-
configs/config.asp.vbs
-
configs/noip.asp.vbs
-
db_.htm.conn.asp.vbs
-
down.asp.vbs
-
download_dx9.asp.html
-
download_ie.asp.html
-
download_media.asp.html
-
download_real.asp.html
-
download_web.asp.html
-
download_xunlei.asp.html
-
g_guanli/ADMIN.asp.asp
-
g_guanli/CHANGE.ASP.vbs
-
g_guanli/DELETE.ASP.vbs
-
g_guanli/DELall_look.ASP
-
g_guanli/DELeoff.ASP
-
g_guanli/DELuser.ASP
-
g_guanli/DELuser01.ASP
-
g_guanli/EDIT.ASP.vbs
-
g_guanli/EDIT1.ASP.vbs
-
g_guanli/FindAccount.asp.vbs
-
g_guanli/HOME1.ASP.vbs
-
g_guanli/INC/Css.css
-
g_guanli/INC/Eshopcode.js
-
g_guanli/INC/Ubb.inc
-
g_guanli/INC/Util.asp
-
g_guanli/INC/articleCHAR.INC.vbs
-
g_guanli/INC/config.asp
-
g_guanli/INC/eshopcode.asp.vbs
-
g_guanli/INC/function.asp.vbs
-
g_guanli/INC/link.htc
-
g_guanli/INC/md5.asp.vbs
-
g_guanli/INC/ubbcode.asp.vbs
-
g_guanli/INC/upload.asp.vbs
-
g_guanli/Index.asp
-
g_guanli/LOGIN.ASP.vbs
-
g_guanli/LOGOUT.ASP
-
g_guanli/MANAGE.ASP.vbs
-
g_guanli/MANAGE1.ASP.vbs
-
g_guanli/MANAGE_free.ASP.vbs
-
g_guanli/MANAGE_vip.ASP.vbs
-
g_guanli/SAVEEDIT.ASP.vbs
-
g_guanli/SAVEEDIT1.ASP.vbs
-
g_guanli/USER.ASP.vbs
-
g_guanli/USER02.ASP.vbs
-
g_guanli/USEREDIT.ASP.vbs
-
g_guanli/USERSEVE.ASP.vbs
-
g_guanli/UploadFileManage.asp.asp .vbs polyglot
-
g_guanli/adddvdmovie.asp.vbs
-
g_guanli/adddvdmovie1.asp.vbs
-
g_guanli/adddvdmovie2.asp.vbs
-
g_guanli/addip.ASP.vbs
-
g_guanli/addmem_save.asp.asp
-
g_guanli/addmember.asp.asp .js polyglot
-
g_guanli/addmovie.asp.vbs
-
g_guanli/addmovie1.asp
-
g_guanli/addmovie2.asp
-
g_guanli/addmovie3.asp.vbs
-
g_guanli/addurl.asp.vbs
-
g_guanli/addurl1.asp
-
g_guanli/addurl2.asp
-
g_guanli/addurl3.asp.vbs
-
g_guanli/adduser.asp.asp
-
g_guanli/admin1.asp.vbs
-
g_guanli/adminall.asp.asp .js polyglot
-
g_guanli/adminip.asp.vbs
-
g_guanli/adminuser.asp.asp
-
g_guanli/adminwanip.asp.vbs
-
g_guanli/all_Null_movie.asp.vbs
-
g_guanli/asaveipwan.asp.vbs
-
g_guanli/asaveuser.asp.asp
-
g_guanli/asp_env.asp.asp .js polyglot
-
g_guanli/backup.asp.asp
-
g_guanli/buyUSERji.ASP.asp
-
g_guanli/buyuser01.asp.asp
-
g_guanli/buyuser01ji.asp.asp
-
g_guanli/car.ASP.vbs
-
g_guanli/carlog.ASP.vbs
-
g_guanli/carsave.asp.vbs
-
g_guanli/changeadmin.asp.asp
-
g_guanli/checkpost.asp.vbs
-
g_guanli/config_all.ASP.vbs
-
g_guanli/css/css.css
-
g_guanli/css/style.css
-
g_guanli/del_vod.asp
-
g_guanli/delbuy.ASP.asp
-
g_guanli/delbuy01.ASP.asp
-
g_guanli/delbuy01ji.ASP.asp
-
g_guanli/delbuy02ji.ASP.asp
-
g_guanli/delbuyuser.ASP.asp
-
g_guanli/delcar.asp
-
g_guanli/delcarlog.asp
-
g_guanli/deleteuser.asp
-
g_guanli/deletevod.asp
-
g_guanli/deljicar.asp.asp
-
g_guanli/delmyserver.asp.vbs
-
g_guanli/delsenduser.ASP.vbs
-
g_guanli/delurl.ASP
-
g_guanli/dosql.ASP.asp
-
g_guanli/edit.css
-
g_guanli/eoff.ASP.vbs
-
g_guanli/execsql.ASP.vbs
-
g_guanli/fileall.asp.vbs
-
g_guanli/fuckdel.asp
-
g_guanli/fucklook.asp.vbs
-
g_guanli/gmovie.asp.vbs
-
g_guanli/ifon.ASP.vbs
-
g_guanli/ifon2.ASP.vbs
-
g_guanli/images/admin_bg_1.gif.gif
-
g_guanli/images/admin_left_1.gif.gif
-
g_guanli/images/admin_left_2.gif.gif
-
g_guanli/images/admin_left_3.gif.gif
-
g_guanli/images/admin_left_4.gif.gif
-
g_guanli/images/admin_left_5.gif.gif
-
g_guanli/images/admin_left_6.gif.gif
-
g_guanli/images/admin_left_7.gif.gif
-
g_guanli/images/admin_left_8.gif.gif
-
g_guanli/images/admin_left_9.gif.gif
-
g_guanli/images/bbs.css
-
g_guanli/images/bg2c.gif.gif
-
g_guanli/images/bullet.gif.gif
-
g_guanli/images/dot.jpg.jpg
-
g_guanli/images/dot_orange.jpg.gif
-
g_guanli/images/forum_admin.css
-
g_guanli/images/title.gif.gif
-
g_guanli/images/title_bg_quit.gif.gif
-
g_guanli/jicar.ASP.asp
-
g_guanli/jicarsave.asp.vbs
-
g_guanli/listserver1.asp.vbs
-
g_guanli/lockip.asp
-
g_guanli/logimg/Admin_Login1.gif
-
g_guanli/logimg/Admin_Login2.gif.gif
-
g_guanli/logimg/Admin_Login3.gif
-
g_guanli/logimg/Admin_Style.css
-
g_guanli/logimg/checkcode.xbm
-
g_guanli/md5.asp.vbs
-
g_guanli/moneysave.asp.asp
-
g_guanli/msgsave.asp.vbs
-
g_guanli/myserver.asp.vbs
-
g_guanli/onlinepay.asp.asp
-
g_guanli/otherserver.asp.vbs
-
g_guanli/paysave.asp.vbs
-
g_guanli/review_no.asp.vbs
-
g_guanli/review_yes.asp.vbs
-
g_guanli/saveconfig.asp.vbs
-
g_guanli/savedvdmovie.asp.vbs
-
g_guanli/savedvdmovie1.asp.vbs
-
g_guanli/saveip1.asp.vbs
-
g_guanli/savemovie.asp.vbs
-
g_guanli/savemovie3.asp.vbs
-
g_guanli/saveuser1.asp.asp .vbs polyglot
-
g_guanli/savevod.asp.vbs
-
g_guanli/savewanip.asp.vbs
-
g_guanli/security.asp.vbs
-
g_guanli/sendmail.asp.asp .vbs polyglot
-
g_guanli/servu.asp
-
g_guanli/setmoney.asp.asp
-
g_guanli/sj.asa
-
g_guanli/talk.asp.vbs
-
g_guanli/talk1.asp.vbs
-
g_guanli/userbuyserver.asp.asp
-
g_guanli/userbuyserverji.asp.vbs
-
g_guanli/userlook.ASP.vbs
-
g_guanli/uup.asp.js
-
g_guanli/vod.asp.vbs
-
g_guanli/wantsever.asp.vbs
-
g_guanli/wantseverdvd.asp.vbs
-
g_guanli/wantuserout.asp
-
g_guanli/yanshi.asp.html
-
g_guanli/zcm.asp
-
g_guanli/zcmayireg.asp.asp
-
images/1.jpg.jpg
-
images/5.jpg.jpg
-
images/aa1.jpg.jpg
-
images/aa2.jpg.jpg
-
images/aa3.jpg.jpg
-
images/ary/1STAR.GIF.gif
-
images/ary/2STAR.GIF.gif
-
images/ary/3STAR.GIF.gif
-
images/ary/4STAR.GIF.gif
-
images/ary/5STAR.GIF.gif
-
images/bon.png.png
-
images/btn_bg.gif.gif
-
images/common.js.js
-
images/default_rmtj_h23.jpg.jpg
-
images/down/0114041.gif.gif
-
images/down/Media.gif.gif
-
images/down/baidu1.gif.gif
-
images/down/baidu2.gif.gif
-
images/down/baidu3.gif.gif
-
images/down/dx9.gif.gif
-
images/down/ie.gif.gif
-
images/down/real.gif.gif
-
images/down/top1.gif.gif
-
images/down/top2.gif.gif
-
images/down/webplayer.gif.gif
-
images/down/xunlei.gif.gif
-
images/down/xunlei1.jpg.jpg
-
images/down/xunlei2.jpg.jpg
-
images/down/xunlei3.jpg.jpg
-
images/flash.js.js
-
images/good/a18.gif.gif
-
images/good/a6.gif.gif
-
images/good/a7.gif.gif
-
images/good/a8.gif.gif
-
images/good/kehuan.jpg.jpg
-
images/good/kongbu.jpg.jpg
-
images/good/lunli.jpg.jpg
-
images/good/zhanzheng.jpg.jpg
-
images/good/zy.jpg.jpg
-
images/images_110.gif.gif
-
images/li.gif.gif
-
images/li_active.jpg.jpg
-
images/line.gif.gif
-
images/line_yin_200.gif.gif
-
images/linksTitleBg.gif.gif
-
images/listBoxTitle.gif.gif
-
images/logo.gif.gif
-
images/munu.jpg.jpg
-
images/munu_active.jpg.jpg
-
images/munu_bg - 复制.jpg.jpg
-
images/munu_bg.jpg.jpg
-
images/nav1_ico.jpg.jpg
-
images/news.jpg.jpg
-
images/on_radio.jpg.jpg
-
images/radio.jpg.jpg
-
images/save.gif.gif
-
images/show_a.jpg.jpg
-
images/show_l.jpg.jpg
-
images/sigline.gif.gif
-
images/stat.jpg.jpg
-
images/style.css
-
images/system.css
-
images/tab.bg.gif.gif
-
images/tab_bg.jpg.jpg
-
images/tab_libg.jpg.jpg
-
images/tade_top.jpg.jpg
-
images/tade_top1.jpg.jpg
-
images/title.jpg.jpg
-
images/title_bg.jpg.jpg
-
images/title_dot.jpg.jpg
-
images/title_ico.jpg.jpg
-
images/vip/service_nav_01.gif.gif
-
images/vip/service_nav_02.gif.gif
-
images/vip/service_nav_03.gif.gif
-
images/vip/service_nav_04.gif.gif
-
images/vip/service_nav_05.gif.gif
-
images/vip/service_nav_06.gif.gif
-
images/vip/service_nav_07.gif.gif
-
images/vip/service_nav_08.gif.gif
-
images/vip/service_nav_09.gif.gif
-
images/vip/service_nav_10.gif.gif
-
images/vip/service_nav_menu_01.gif.gif
-
images/vip/service_nav_menu_02.gif.gif
-
images/vip/service_nav_menu_03.gif.gif
-
images/vip/service_nav_menu_04.gif.gif
-
images/vip/service_nav_menu_05.gif.gif
-
images/vip/service_nav_menu_06.gif.gif
-
images/vip/service_nav_menu_07.gif.gif
-
images/vip/service_nav_menu_08.gif.gif
-
images/vip/service_nav_menu_09.gif.gif
-
images/vip/service_nav_menu_10.gif.gif
-
images/vip/vip.gif.gif
-
index.asp.html .vbs polyglot
-
look.asp.vbs
-
mdb_.htm.conn.asp.vbs
-
save.asp.vbs