Overview
overview
3Static
static
3NewsBar:...��.url
windows7-x64
1NewsBar:...��.url
windows10-2004-x64
1PC蛋蛋�...��.url
windows7-x64
1PC蛋蛋�...��.url
windows10-2004-x64
1八趣通�...��.url
windows7-x64
1八趣通�...��.url
windows10-2004-x64
1点击下�...ox.url
windows7-x64
1点击下�...ox.url
windows10-2004-x64
1点此下�...��.url
windows7-x64
1点此下�...��.url
windows10-2004-x64
1点点先�...��.url
windows7-x64
1点点先�...��.url
windows10-2004-x64
1睿智IT-BLOG.url
windows7-x64
1睿智IT-BLOG.url
windows10-2004-x64
1芝麻·�...��.url
windows7-x64
1芝麻·�...��.url
windows10-2004-x64
1金山毒�...��.exe
windows7-x64
3金山毒�...��.exe
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
NewsBar:看新闻和广告赚钱.url
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
NewsBar:看新闻和广告赚钱.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
PC蛋蛋:点广告+玩游戏=拿Q币.url
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
PC蛋蛋:点广告+玩游戏=拿Q币.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
八趣通宝:挂机赢取奖金或Q币.url
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
八趣通宝:挂机赢取奖金或Q币.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
点击下载高速安全防病毒浏览器 Firefox.url
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
点击下载高速安全防病毒浏览器 Firefox.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
点此下载快车FlashGet:全球最多人使用的下载工具.url
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
点此下载快车FlashGet:全球最多人使用的下载工具.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
点点先锋:边上网边赚钱.url
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
点点先锋:边上网边赚钱.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
睿智IT-BLOG.url
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
睿智IT-BLOG.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
芝麻·西西:看广告赚Q币,玩游戏赢大奖.url
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
芝麻·西西:看广告赚Q币,玩游戏赢大奖.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
金山毒霸通行证获取器.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
金山毒霸通行证获取器.exe
Resource
win10v2004-20240802-en
General
-
Target
06d5625adcbbbb5baa90f0cbfca61340_JaffaCakes118
-
Size
765KB
-
MD5
06d5625adcbbbb5baa90f0cbfca61340
-
SHA1
a97b2f65dc705ea8a45233b119b57c5bc444561c
-
SHA256
a103d4c33e8e858e41ea7ded8585edb4b657a6e2e7e611c2265001aea5964cd6
-
SHA512
bb729498c384fbee42617314e2ee8252c2f20f189e51dbc300076c40058c5a8f97358ae0d69e34b223213c590a2bd3497ed7a7dac70a466f3ccc16fcd396a281
-
SSDEEP
12288:oKKM6+evcOWs4wUpIs9GWiznJ0NNs6lMjoxtrKEkV1RzgAHjn3xUW6EvDWg8mR6:pZ7AP32ITSMZ6pwVPg6j3n/mmR6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/金山毒霸通行证获取器.exe
Files
-
06d5625adcbbbb5baa90f0cbfca61340_JaffaCakes118.rar
-
NewsBar:看新闻和广告赚钱.url.url
-
PC蛋蛋:点广告+玩游戏=拿Q币.url.url
-
使用必读.txt
-
八趣通宝:挂机赢取奖金或Q币.url.url
-
点击下载高速安全防病毒浏览器 Firefox.url.url
-
点此下载快车FlashGet:全球最多人使用的下载工具.url.url
-
点点先锋:边上网边赚钱.url.url
-
睿智IT-BLOG.url.url
-
芝麻·西西:看广告赚Q币,玩游戏赢大奖.url.url
-
金山毒霸通行证获取器.exe.exe windows:4 windows x86 arch:x86
65ae5cf17140aeaf91e3e9911da0ee3e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
LoadLibraryA
CloseHandle
WriteFile
CreateDirectoryA
GetTempPathA
ReadFile
SetFilePointer
CreateFileA
GetModuleFileNameA
GetStringTypeA
LCMapStringW
LCMapStringA
HeapAlloc
HeapFree
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
GetStringTypeW
user32
MessageBoxA
wsprintfA
Sections
.text Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ