c:\MSDev\Projects\Hash\Release\Hash.pdb
Static task
static1
Behavioral task
behavioral1
Sample
冒险岛强强/MD5查询.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
冒险岛强强/MD5查询.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
冒险岛强强/QQPro.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
冒险岛强强/QQPro.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
冒险岛强强/冒险岛地图_766冒险岛专区.url
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
冒险岛强强/冒险岛地图_766冒险岛专区.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
冒险岛强强/冒险岛强强101228.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
冒险岛强强/冒险岛强强101228.exe
Resource
win10v2004-20240802-en
General
-
Target
d024b1a864534608ac4a4b08775cac93_JaffaCakes118
-
Size
2.9MB
-
MD5
d024b1a864534608ac4a4b08775cac93
-
SHA1
68ee27c2560d2250f322723269538a6eb0590f10
-
SHA256
1b1fdfdd3eb5b6fb1597944eb0325ff9bc692ba3c2d7eaa8dfe34c4093ba78bb
-
SHA512
ebc3a374d42d4ecfe34c1ad03c9bcd8dc322b4ae73da3859c044492aa63f0a3f5c2f4b1a3d6a3523496e0340e0bab45c5b820269ee5334157f89a38e5f8f42d5
-
SSDEEP
49152:TTl7ZHD8HaUQv3LLX4+xtKeOs25QIKTkki5oEP6QPKDQYb3ZkrU6QKwZBD:99nomMsCEGriQiXCrUkwZBD
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/冒险岛强强/MD5查询.exe unpack001/冒险岛强强/QQPro.dll unpack001/冒险岛强强/冒险岛强强101228.exe
Files
-
d024b1a864534608ac4a4b08775cac93_JaffaCakes118.rar
-
冒险岛强强/MD5查询.exe.exe windows:4 windows x86 arch:x86
91c8172effccd3ed565854517f1bf6fd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
WaitForSingleObject
SetEvent
CreateEventA
SetThreadPriority
CloseHandle
ResumeThread
CreateFileA
GetFileSize
lstrcpynA
GlobalLock
GetTimeFormatA
FormatMessageA
GetDateFormatA
WriteFile
lstrlenA
GlobalAlloc
GetFileAttributesA
FileTimeToSystemTime
ReadFile
GlobalUnlock
FindFirstFileA
GetLastError
FindClose
FindNextFileA
GetCurrentDirectoryA
GetFileTime
FileTimeToLocalFileTime
LocalFree
GetModuleHandleA
GetUserDefaultLangID
lstrcmpA
GetStartupInfoA
user32
EnableWindow
RegisterClassA
CloseClipboard
GetFocus
LoadIconA
wsprintfA
SetFocus
SetDlgItemTextA
UnregisterClassA
EmptyClipboard
GetDlgItem
EndDialog
CheckDlgButton
IsDlgButtonChecked
GetClassInfoA
PostMessageA
OpenClipboard
SetWindowTextA
DialogBoxParamA
SetClipboardData
SendMessageA
comdlg32
GetSaveFileNameA
GetOpenFileNameA
shell32
DragAcceptFiles
DragQueryFileA
msvcrt
_makepath
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
_splitpath
_vsnprintf
_snprintf
_beginthreadex
??2@YAPAXI@Z
memmove
??3@YAXPAX@Z
shlwapi
PathAddBackslashA
comctl32
InitCommonControlsEx
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
冒险岛强强/QQPro.dll.dll windows:4 windows x86 arch:x86
3da1c6025f0c3756834589643117bd29
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
rpcrt4
UuidCreate
mfc42
ord3597
msvcrt
??0exception@@QAE@ABV0@@Z
kernel32
CreateMutexA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetWindowPos
MessageBoxA
advapi32
LookupPrivilegeValueA
iphlpapi
GetAdaptersInfo
msvcp60
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
winmm
PlaySoundA
Exports
Exports
?setHook@@YAXK@Z
?unsetHook@@YAXXZ
�������{l�M�7Y�����EeB!tՕ�[� ���d�*��a�ɟ�8��`h�#8hnob��M���W��-� >����uƃ�A���pU�bԈc����>mE{�*d�:���y3�ʀg�7�{Bz ,=⤍*�9���wH� �?��)s��j���+��K�Q$˒2���cN���i����UdR�����x�+��ly��ou��U\f<Z���� �,�!�~��� >���:�U-�1���ކQv>�VA��^�J�x�8�܄��m�h�* ;�j����I���拋��P剴�� <�*�뷾�>%��As(s?� ��_��Y@c\D����o~A[��5 ?�݄ÿu��É ��~�R<������Q/)�N��8��]k���'X�^\�0�h����|7㊖��� 4��k��,��[Jhn����y�\��&sV $)�� �����a.:լ������\ պ��D4��%o�m�V��$ � ��!��h6�*�����"'@ńQ��ə=ÿ�DC�}Uk߹R� Q�Dˬ����X����g��ԃj��D=�R��Y����\8�w��S}m6�ă�UQmưw"�24{^7~;�MF�5�� λa�o;�٧��6��5�'zE�!A��!W�-{�km�������*#�7�Y��4IO�@/8 ��H�*���z!7x69NtO���͓��E�@ּ�M��()P-J�������Ab+E��f���\�lƪ ��}����lZ9&�8�N�i��IV�Ɠ�izE�Ff��+�a��%�=���^5<&���轕�����f����"khr�����^&q�o��{ϵJޒ_]{�/ڈ�"f 3LQ~��HUj��eU�+�B �h�nv�;S���d߶� wx���*��3 J��)����:>rQ|���պc�>�f� o$�6�^���G`LJ���ҌÅ:�],,&@M��M�`T�(��̈�u�E�D�~g.Xs�~���C����� ���ç�hi���_�Y�R����c3�X*����rQ_�y�1�����@G"p�UK�ؙJA����ȻL >��j�卽�ζWl�h�u�i#���J�.�踔�l�*���j���j� �*���M>��\��r��s���ݹ��i"8ꍶ�LXj�6�nN4h�k���]\������&�b�����>�EPumz�&�A*�i++�ED�����Sq� ������6�k��.�\CT��Ɨ�P��nN֮��ئ�Ґ����-"������7�Z_��:u{x0ۏ=�(�F�+���B��,�>UO��y�.,�B�獯�*�H�M�b 3����lr��*_A�U0�uS7uF�<��ן��M�s�Uj@˞oʮ����]�O;J3"6�y0��%/�n͛JQD�,l��������)�d����} S#�|�ȑ&4�b�j>u��W)�ն�5U&}��/�/?��0馋��_��am��Q=��'Vi�X�j1�;�U�X��U3F.��W4�YXԽ�7��5`�J��wHְz�H�i��(��e���+e����(X��qq��$����U���� ��#��^ِ"��d�K6b@*��uXZ#�/�ȰDž3�H9�!�7/̹��ga�0�e>���F��ĵSX��G���H�F D��+n�km+^��9��ٗ����ׅ�2�W��[�})�M���������H �#^~W�ʪ^���L������f��r��7~u�>�@1���e�=��t7Ǧ��|���e�H�A�y+�~�>W� �(X4�G+ʹ�ie���-�i�t]1��s�Eg��k��t�s�D��+9��v �O���D�'in��Ğk��e��N2Yg�p��be�0G)n�� U����Y"�-�M��dW�Gu�j���Խ��ME�WR�����{�O�J��ʡ{og��Iz�-Bh�VT�7�%���ݝ'zt@]�F��(�lA<ݺ��K�93S7��\�l�A�,�Z���su�<l>�4Y)H)_paR���������f��,�"aYL�Ƽ �����;6��}I����R[�M���y#��Z�{צ���T9v�� ��F:�k^��@zT�r�.`� ك��j��)��$^.]0ٲ��� ƚ�ܔI��Hr�\�\o��,�0�RE� �����^Ğ"WQO��&�^�>����B�q�~���ܢ��J ���ܐ��znuD�٣�{��xK��B�\������Yͫd�.���!1����35:v����ޝ��!������{6{>&������R�6�i������T5��������@6d_�<�m�G,�1�>��t���EuZ�b�Cm���G<���O �ڇ�ی-Mo��OS���h��X��EZ�Kb��^��!���V���ٷ��.z~�y*"��7�'e/�_���6��`2��@��X��@�t*�ߕxKP�5B'4qdC���:v�ߌw��b�^`ː�.#C� X�WP�^x-J���3���8��uL]�J z;���1N�0 �0�[��)�Â����<a�x��-waf�/��X>y7itA�cK�VBC���9���Px�c�ݤa��� �n�o�o���9�5p<�,O���ŷ��V^W[Kj*��R���Bzm�M��g�70��c�P��o[������a��~����W1g=U��R3+���f[��!�qY��>�Zp����;6���03���/�_H������PgFBⴋ�3o- B���&��$Mm����@��*�O��r�j�D�o��[^d�%:�L�������}��-�i�.���á,�*o,᳖"���E��ppC�6˘���������3V�p�gp���ѫ ����G'{�g� %e��hV]�9T�����jw�]�����F��R����-��|�u�++X�8�X�����^�7y&%,~�Mダ&�m�-Sd�F�Z������R�x��jQY�˿"ê������=#=�&]~��s �Y\�]�Sz�ܔ���If{y�@\����ĵ9��|G
Sections
.text Size: - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text0 Size: - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: - Virtual size: 448KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text2 Size: 576KB - Virtual size: 572KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 328B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
冒险岛强强/冒险岛地图_766冒险岛专区.url.url
-
冒险岛强强/冒险岛强强101228.exe.exe windows:4 windows x86 arch:x86
7c3ce81b4186ec3c3116766d200fd720
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
UuidCreate
qqpro
?unsetHook@@YAXXZ
mfc42
ord2135
msvcrt
_CxxThrowException
kernel32
MulDiv
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SubtractRect
MessageBoxA
gdi32
ExtTextOutA
advapi32
RegQueryValueExA
shell32
ShellExecuteA
comctl32
_TrackMouseEvent
iphlpapi
GetAdaptersInfo
msvcp60
?_Xlen@std@@YAXXZ
Exports
Exports
���V6��l�p�-Pc���9+ƒ#�{�O��оx'ũ%u/��W��!����|�(�H��(%xw�\�ᑤ���-�є(��3%�:v����� q=���6X"w���S�_M#�H�R��*sE��x���^/ �Hc3�3W�&��3�W�w����梳�s͏�h���6j�"���g/o/t�6��/u�1���S���J�˕�� �����^>iE��r���u_h��E1��fd}G�N�8D�1g @K�R��C�}yÚJ�Up~ h�����Fw05KOS��g��8��ˎ���O�mby8A^�!%.0�Q�q���I*��ɓ�� Y���3��f�il���B~ޏ�����u�O,fJ�Ԣ�d�����8[b���"�D�� �/���a���u��E���'�(��Na�����ǧZȚE����OJϾ���FS�9 �+��m�we����?~�������|J���&r�s���or��NL"#� �L,Ex���k�����QS6��re<N4�;��M����@ʿ�2z%�ʤ[�R#=x�(��NŌr�Y�Yؤ�̤<���t��",Y3F�Κ5�F��I��2��RYO��:%~�/����z��s�O�I���O<�D�Q� W3�UE!Qj�L�u��kX@p����"Np��O����vo�Kj����Z�D��/�|S�$l��������f�CG����s�I��u����}�+h�d��gO��/�ue�5t��t2�4W�"��(��<��W�r|E�Gc1<l��[-&Ϊ��.y+I&����$9X�8��wD�K� YR'��,����ox5C�a�FrٕM�A�p����<(g�����%�m��#ބ1�b�>��Wn�� �}2{M��2"���-�AYj��w�E���]��p%呃��S��|�G�yu�*�w�y����v�okL�/�7=����uǠo9��y6_Z��S�XF[(����ϷA���X_%o2���`�7uw�{�I �����Vݓ�L��g�D�-���y.���G���ܣ3������n�}���)X%w��R�9P��uK��J�:">0F���Ӽ<�>�bɩ?�!�n�U>�l���be���lX��N�]����6��n�n���9��Sw����/��h��X�y�l��'ӭ��u�%� ��k�(�|-I�!{�[�*?L�e�͌��i��:���E�<LCZ��b�9&�+-D���ӵD��$��Jc����O�^V�#]*K��ņ��=�V�,uPa嬉�qM%�����,`Z8U���ܵy�y!}I���E��q��Hi� ���� /DtC���E�5���\��ʰ�*t:�$�8ӏ@�<d�a%�8Pk�E�q����(�^�M �5l�s�[Vu�a�B_/���ec[��[��a�V��u��S����]���8�lѯ���|��_�i)���d{��n-5[�bÝ 3�D�"�Rх�="��]z��Z�8� 9)ԉN[�=���B�O�����5�?��9r�*�&��ۈw�ߨ�� �T�v�n�Hɹ7N�M!��Q��5�����Z� �8f� r��LR��m9��) Y�|�wx������$Tg�-?�c�s�������5�G:qgS�)qǽ f�X��'�J#�ڠP� ���7�\��g�[�s��łH|ZyM!ϡŪITx��bbV`B'�y�SP��A�Ƨ�*.̳�&��+�M�mKL��Qz�}��Џ�j�h՞�(�`��B���'[����Jጊ���/%E�c��� '!��U�Ø������23�^��A�\D����r�+¾�A�>�Ɖ�x�E�w$�d��-��&�;hд����%�!�Zq�T��uA��M �n�ٛ���l��$����v0g���<�ӧy6 ���;]-۶�w�#Kw����q�I��H��Q��X0��̳xީ�ׅ�(��謈b*��q�f��4���}��m��c܊^tU,Te~ �� I�s둲��T��W[Lb5'|���L��5��m#���&�L�y�]���� �xo p��W {S��^���&d"Z5�F��*�K�e[���]8A V}(�7U%��h��Ӗ����"�.l� �� �F+������ :��w2�h�4�(y�t|��!ϙ������}>3�i�NS [c�M�-�����_x�N��Z?�R�⥬מ|cg8ש�&S�$S6|��F�ή�=d�.���De�}��ъ�#p>T�coQ�:��9�Ij�~���@1K��^zW�%"��"3����Ha��� �~k�u�6Ϡ��2�!��|^Z�[ �XC�'7<��,+m;��ف��5.�ź�3c�DiA�]|ܶ��@Z��<�����.�d�^YI:�x��v�W����#�� o�Q�3���� n������e'.�.����ɉC���n�]�2 �s��rlfT �@��˕�[l+= � � �C�J m�4�����F�����I;p����!��)(�Q�0iB'Y4#_��ڼ6j�' |8d:8�k6��ԙ���x�;IGF�V�~+�4�:h�E��!�CwW��� U�_Is�;�ʾm.�����R�a�ƽ-��ab;'�O���w�4"�אӂ�=��]L㶥e\��1���Lr.]|�}ʐ<����n�8+52�B���p���[�Cݐ�����������Rv�?�Ek�ao�{�F�x�` ���!��8$�hb��ZJ?,�4��( �}��w%����J�n�Nik<�X�B���'S>��ھ�Ѕ������n�n�S��g�X�LW�Q�w9�0�V=G/�_}��PPy���/��i@|_�0����J�`��gC���Q�!I1����.6K�y�B��4����'=����b&ݭ=����gv7>�������в��4���^�� xQ�g�j�x��g�'�Kf��.��QZQ���g�0���4d�R���7�����}�H�9��h,��#���8uTr5�d���0 ��X��+��&164�����1ד&MI�1�*�k3�@N��W���v;�����[�|<�
Sections
.text Size: - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text1 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
冒险岛强强/战神挂机精准技能使用说明.jpg.jpg
-
冒险岛强强/稳定生怪使用说明/稳定生怪步骤1.jpg.jpg
-
冒险岛强强/稳定生怪使用说明/稳定生怪步骤2.jpg.jpg
-
冒险岛强强/稳定生怪使用说明/稳定生怪步骤3.jpg.jpg
-
冒险岛强强/防封地图.txt