E:\Development\ParsingSolutions\Src\HtmlParser2003\obj\Debug\Winista.HtmlParser.pdb
Overview
overview
3Static
static
3岩岩魂�...ib.dll
windows7-x64
1岩岩魂�...ib.dll
windows10-2004-x64
1岩岩魂�...er.dll
windows7-x64
1岩岩魂�...er.dll
windows10-2004-x64
1岩岩魂�...de.exe
windows7-x64
1岩岩魂�...de.exe
windows10-2004-x64
1岩岩魂�...rk.dll
windows7-x64
1岩岩魂�...rk.dll
windows10-2004-x64
1岩岩魂�...��.exe
windows7-x64
1岩岩魂�...��.exe
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
岩岩魂丝路英雄辅助工具/ICSharpCode.SharpZipLib.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
岩岩魂丝路英雄辅助工具/ICSharpCode.SharpZipLib.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
岩岩魂丝路英雄辅助工具/Winista.HtmlParser.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
岩岩魂丝路英雄辅助工具/Winista.HtmlParser.dll
Resource
win10v2004-20240910-en
Behavioral task
behavioral5
Sample
岩岩魂丝路英雄辅助工具/YYH.Upgrade.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
岩岩魂丝路英雄辅助工具/YYH.Upgrade.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
岩岩魂丝路英雄辅助工具/YYH.network.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
岩岩魂丝路英雄辅助工具/YYH.network.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
岩岩魂丝路英雄辅助工具/岩岩魂丝路英雄辅助工具.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
岩岩魂丝路英雄辅助工具/岩岩魂丝路英雄辅助工具.exe
Resource
win10v2004-20240802-en
General
-
Target
f6f22a74bd889522da6877ef8ea761b2_JaffaCakes118
-
Size
3.6MB
-
MD5
f6f22a74bd889522da6877ef8ea761b2
-
SHA1
f687123eb152a6d69d24ac3eb6dbe833790b33cb
-
SHA256
932fadcd897fa34b3684a88dde2d98d3e3475bff3aff01bf3fb838fa2d22e51b
-
SHA512
aa34b4ff5798030bd8ad5580a75bbd6ff4b3da3289ebe9c0d8417470223a8bdad205c2ff5dd9522e250363ddb118aeaee0d6541d9958c20856632ac1e9fde762
-
SSDEEP
98304:ThyxlnQuTIiRPwXtVJjLsV2nB9aXG6Hz4YE0Xi/Udb74kS5:NyxlQ5iRPwdVJjLB9aXXzhi8pc
Malware Config
Signatures
-
Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/岩岩魂丝路英雄辅助工具/ICSharpCode.SharpZipLib.dll unpack001/岩岩魂丝路英雄辅助工具/Winista.HtmlParser.dll unpack001/岩岩魂丝路英雄辅助工具/YYH.Upgrade.exe unpack001/岩岩魂丝路英雄辅助工具/YYH.network.dll unpack001/岩岩魂丝路英雄辅助工具/岩岩魂丝路英雄辅助工具.exe
Files
-
f6f22a74bd889522da6877ef8ea761b2_JaffaCakes118.rar
-
岩岩魂丝路英雄辅助工具/ICSharpCode.SharpZipLib.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 112KB - Virtual size: 110KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
岩岩魂丝路英雄辅助工具/Winista.HtmlParser.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
mscoree
_CorDllMain
Sections
.text Size: 172KB - Virtual size: 170KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
岩岩魂丝路英雄辅助工具/YYH.Upgrade.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
F:\VB\!!岩岩魂瑞士军刀\岩岩魂.通用升级工具\obj\Debug\YYH.Upgrade.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sdata Size: 512B - Virtual size: 137B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
岩岩魂丝路英雄辅助工具/YYH.network.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
F:\!程序\VS_2008.net\VB\!!岩岩魂瑞士军刀\岩岩魂.网络\obj\Debug\YYH.network.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sdata Size: 512B - Virtual size: 145B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
岩岩魂丝路英雄辅助工具/岩岩魂丝路英雄辅助工具.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
F:\VB\!岩岩魂丝路英雄辅助工具\QQ丝路英雄辅助工具\obj\Debug\岩岩魂丝路英雄辅助工具.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 4.5MB - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sdata Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 281KB - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
岩岩魂丝路英雄辅助工具/说明.txt