���ui 2�Ř'���k0~$�D�̒0�T�+e#$���^}ϒ����]8 ��*�s��G���7�����q6w[m(�3�L�P?z�� � ��X�rd�x��Н�+R��W�{�v�Y!�P�=O����V��4y�P�/s�ɢq�:��HQ�v��a����Sy��g:���YKܬs�dL�cY�8ƾ��#�Zh����������rL/��!-�� �l`� 2>ZEͭ��A):��w��K�iJ#/g�Mb0��d�#�3���/�Uz�*��wls���V�^A�R��Ta0�Zx����'�;�F癊�������T��,���l�?o����ي?���f�����E*̒V���h��^r50��ݵ�� &�E{yV��:Ud����k���mt�f\(އi�˒BQvn�n�p�ez�#,��rKɛ]�*`�r�:ӟ���u��-���q�5�3��Q���sj�o,�',�S�X��\��ͤ ��S�]�0�S�*�G��~���#*�Ѐ5���]�TZ*�� $��Χԅ��s`�a%4����e];�2�rdW���n���qrqf�:|��*}�#ÅHdi��FPaS"��Q����}|��|�"�����%��:�����vh���CM{�Nڡ������������c{�ۊ$JY�B��_7�2��Φ��)�w�4lW�(�!m�ֲ�X��r�Ur���e���vmg��_@m%��7ր�+�S�a��m�˕e�o;�~"�&r�j��ؕ��%�@���f퀏�ד����6��\n�<_l���+S��yϐ.]T �Ɖw��anj��Q��N�{�� S�p��O*�1�������$Ѭ�L��O9k��k�}c��Q�M\��:��\��t��P��B=�!���?a���F�,���w5u/'�*�$��}�a�ɋ�U2d㽰�7�3 "���ۨ$�T�w����T���r� ��-��ח�bX���:���# o����zޱ���z2E�@K��U U�DZe7��X�Mb�\Qμ��um��cN����uy4>Q���g �Of �B����_�Ќ����9>\9/"������N�N�MZ���;������{�\?���C��w7�Ҕ��Q�i��@Y�!u���I8�������- 2��{/��Eއ���ԗ wY�tpY!���E��X^;��oQʏ5J�Q�s^ K0� ���u�C.`\|e���dF8@��rO�o���]�٦��� 7��g����l殺�֣ *���<�2*�*WI]��Oyw�Tƪ 8��I^����b�[d�!L=�1���r�;*p,G��ď���߂�c�<�(!�.��%��A!�@`�{���BLd��Wr�ֆ�>��=͞Gh��"��pXl�����%*�&!�D��9 �h5\����K��L��7��]X��.b'�����[���s����$Q2��H���gJkBS����{�ӂ=���ȁJ�0p��'�.tf(��Un�jTBE3ӈ��r�����fo:�x���>�B��w�����N\�G_��b����z��m�jo��[���ZN���)6�[���;�S�Α��$#��_�l����v��i'����4gQ(~�ո?�#�A���.2�+� ���e��'I��V|��FB���a�0U�*�M�M���N��Z��)���G"2�>��Űo&�t��j�O�n��������B6�h���j����U3���؛��IvXF�ʝv :�I]Ц����%/�AFiO`��Y�;�8*���N�Ӑ���R��|@[%]f�9��1e,S����$���/rU88j�T�r�9 �¯�����g��:��"|1, �ޢ� �- '��<��� �+�(�+w��VČ%���g `����]�%�d1o����z8�����;�����{6�.v�Izlz�v�k!}zZM�PK�w�7��h�����$��d17���R�����=�4snaY��"N14��5��������m���Uw]+��hܒ1���eD�2L�ËN�N`�����D�x7���I�'���p����Ś��rM���aM} ^ة��׃��Z���"f�|Gz�a^�=���j;o���e�@v��4������n��|<��T�߅�ޠ�ГQh��<��!�p>������jV���T M�i�R�����İ_��� �#3��D��[SދW��q"�� �/��]�<[�I�v��:e#�Omz-n��]g�\ �r��BZS���K�'p��Vۢ��ƙ"�}�Mc+e�e��`W)�e n�)����d�@eU�K��}��Ŀ�'s�����t0��-B,��>���� xwv� :����&��(Х�h�^y2RG.�����#XC�C�Mi(�{7��k�4���,��H�QU��X��N��dq�� �/D�j�peh�Q�I����'�Y�������U$��,⟱;�����>X�"tKZ2��$��!��E�m����Ԑ�_rH�օ+�$�����w�֘u5����PtB��,��q�*�_EO9��iWQ""�Ӊ|w$�l�*-���W,�Hp��5��bQף���]����D��?�`�$4'U](u� o[����/��������D�� 0ϑ(�2���h�9js$v��t��,�Xi¯f;��!F�o8�����v.Su/Lɪa~&�Bq�B���Ze�[O)�X�_>Vjv\��{���J� ��(}�jZ:�0v������zUܿ�]��ɪQl-�a�%�*�ph����'�X��*��D�8��O�D�H����t,o�g�������m��A��������& �V���~)r3�`�'QQX�,�^�.��� ��������������N��i�G��w�0M|��>~��n�Ekx́�k��֗a���ι���Z�`gu�9�=� �R1�}4J\�?9���a ��J|�xŹ���>�Ę&IbCH.��2�P�䇥�F��nJ?�J��5T��~$���Gϯ���pLJ��M�ã����5�"���k �ʑS��?�_�!��q���;T���bF�G�
Static task
static1
Behavioral task
behavioral1
Sample
大华录相恢复工具1[1].3(试用版).exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
大华录相恢复工具1[1].3(试用版).exe
Resource
win10v2004-20240910-en
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20240802-en
General
-
Target
fa872efd153e01ad19409510c78d4c0f_JaffaCakes118
-
Size
1.2MB
-
MD5
fa872efd153e01ad19409510c78d4c0f
-
SHA1
7b03c181638141869c675164c36027fab726b4dd
-
SHA256
8c45b32a2e27c67aa39f49db3d538482ea46e054142ce5bb179a4e887682ebfd
-
SHA512
5112964e1f63d35327fbb5b1831e939096fc2a4767fc7cd6a77b7595458e151de1f22d48bc96ec89c09010eee52a193d585295417d3341d964d5507946b53234
-
SSDEEP
24576:YHDJrgQpHZtHKx3jYl51jkm1SoXjBYr6+1wXE6cL6GJNV:YHDJrgOXKx3jYdl1SozBOC3cLX5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/大华录相恢复工具1[1].3(试用版).exe
Files
-
fa872efd153e01ad19409510c78d4c0f_JaffaCakes118.rar
-
大华录相恢复工具1[1].3(试用版).exe.exe windows:4 windows x86 arch:x86
101ca2507589b6f4c8b6a7aa8f08a536
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetFullPathNameA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
OemToCharA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
SetTextAlign
ole32
CoUninitialize
comctl32
ImageList_BeginDrag
shell32
SHBrowseForFolderA
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
CODE Size: - Virtual size: 791KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 132KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.DH0 Size: - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.DH1 Size: 234KB - Virtual size: 234KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.DH2 Size: - Virtual size: 532KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.DH3 Size: 938KB - Virtual size: 938KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 234KB - Virtual size: 234KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
新云软件.url.url