Install
Uninstall
Behavioral task
behavioral1
Sample
冒险伴侣0918B/冒险伴侣0918B/PC6游戏下载.url
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
冒险伴侣0918B/冒险伴侣0918B/PC6游戏下载.url
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
冒险伴侣0918B/冒险伴侣0918B/Partner.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
冒险伴侣0918B/冒险伴侣0918B/Partner.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
冒险伴侣0918B/冒险伴侣0918B/冒險伴侶.exe
Resource
win7-20240708-en
Target
263ee3faeb004a1f45a7fe66292ef445_JaffaCakes118
Size
1.7MB
MD5
263ee3faeb004a1f45a7fe66292ef445
SHA1
8d91757028310d5270001060768e0d3182cf54d7
SHA256
2a95fb38fb31f7d45d43c2bb7f9f654cfb070bd931b8885604afbc85f3be794c
SHA512
354de72b9b738aee01c246c8727cbf9603a0fe5938cf13a486032478d9009e3f8e47162feec5f6679df90f499239d7b920ebd4cc63e73e03b4dd36a0368e41b3
SSDEEP
49152:P0XEamlTHd7wFO03SsjkezyOeXbet8BD5OYRt:PcNwTdwFO0Cc5/sySdOYRt
resource | yara_rule |
---|---|
static1/unpack001/冒险伴侣0918B/冒险伴侣0918B/Partner.dll | vmprotect |
static1/unpack001/冒险伴侣0918B/冒险伴侣0918B/冒險伴侶.exe | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
unpack001/冒险伴侣0918B/冒险伴侣0918B/Partner.dll |
unpack001/冒险伴侣0918B/冒险伴侣0918B/冒險伴侶.exe |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PlaySoundA
ord825
atoi
VirtualProtect
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
UnhookWindowsHookEx
LookupPrivilegeValueA
MapFileAndCheckSumA
EmptyWorkingSet
PathRemoveFileSpecA
??1_Lockit@std@@QAE@XZ
Install
Uninstall
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
setsockopt
ord3749
__getmainargs
DeleteFileA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
GetWindowTextA
GetOpenFileNameA
RegEnumKeyA
Shell_NotifyIconA
CoInitialize
URLDownloadToFileA
MapFileAndCheckSumA
InternetCheckConnectionA
SHDeleteKeyA
0J�zq�]R+H�}���a*���$»��=�� �%�;����P?ys��l��sc .�i��5��_�o�hT�L����Z�76�ٻ��K-/7�la�����h����\�<�J�[ h��(��mW���e��&~�_0b����c�T�pZÄ�Q����}����8k9"x0��>�^(�J�_=�Q+�3���2I��i���m��?=�� �'7�T��x��H�%�5��&�DŽ���V��2\&5v���=\+�\)Gz��N4T�\8'�9s��{G'����E�%rje;�J,�P���7��={a�&�_ �;r�ע�8|��֓H��b��W���x�s D;�E�Wu����a��J��3���^<Y<���7��T5��=;�C�ʻ�2��N� �#�h������5"g:c4�+����Z$��{�D�V����$��&s8�2�� ��Mʀ)�)���mK�k^�� ���Z�%���$������anw�`�ly�w%%w~��W=~�?��s��4}d�RS21���NoI�{z��#ϼ���ZFg���U���Y�|�^a����Kb��\�؈�6�5��k��0kRH�w�6m�Y��,-),��N�,Gp��c�2G��Q���㴅�RW����OyC�U�<� ��S�������U�[����%#���r�G*[ ���lb� �?g���&0#�t�S��^x���zr<�� @`M���@6�'�Z�^�~��e�A��+��$��}'�wV����N��9�о̫=���U܀\%��+�B�7=Ǹ<��x/��8��rjj�����j�dWN�����������ܝ[��D��a�u+ߟL[��ԭ�'�����).#��}I�~�������*����(-m֘�W��0WÈ���/hL< 8��~&J�)MW�W�h�A�S(���X��G�ԙi�i���3y�v�C��h`$��wv��*U��T�7���ʙY=B�Q��+d������}N�X���%:I#��0� U_�V`���*���M���V[�i��B?��o��{�H�w�6�N ԋ� R�Y�T��3��xQv���(��~gOΗ-�_~���|2�p+%B���,`���q���j�'�A�2L��v��Q���~|e��g~U&��u�Q�</d�:��F_d�v��(�+~�$xƢ��8�P����vC�_.@>�y�5'���[��t�2�>䃖Uٓ��D�*�1ǝ��Nj��8�[0N��bm��-�H��1D�M.m�@v�N�����k�'����ܬ��O礽j�|��[��H,t-��з#*����-ӷa1 ����C���k�W��niS����"98�s��ѐ'_6�\��xTY IޯB U���W�'8��Z$������~qv�@��D�*��ι��Fg��K��J�c�(�Ma3 ���/�%�mհ IE1k_���uSf�`�HWr�����m���UAޢ5�g��M�c��9�;��X���dz�N'r�dM�j5G�����w�Z�$J�I��)=���!��MFm�����Cޚۤ��d(�����,AJ�����\&7�Օ�+��+��Y��|�(06T�L�V��e1��l�6ݝ�ɤg �<��Xd��9Ѻ�N�������D�:��A|��K�F�p�K�t���{��Й�q�L_��a��G�D_�}�=���b'T���nn:��%� o�u��紷# Ib:�QS���^�6#�y����:a��+,ؕ�����yF �Nu{n2�#�c��"r��I���*����+냄���*���h����[F`����)�v|'��<�x[`^ f���3΅����@�t'�p5����v�J��':\�h!���?�n�I`�Z~>�zy�B^��ҖX�w��Z�m1��$P6�֚꺈��-@Xs�'�v$y���F��Ҁ�Q0�q� ,<T��e�\Z-8Vf�=���&T>7+�/QD|���5m�_�xy��.��ް o�����0�P!X��/F��٤k\\��������a��0B���H���$>����j`�㷎nY-���!G�E�Z.VX>]<MQ��w�z���{�|�J�t���:S�RP��P�D�ۄw�j�(JD��]閇� �����d�e��g���hߣ���0p~&+�L!/5H��8 y��H��}���Uly�ކ�~-���e|8��w��RP��@��h-����������tV�<��l��h��*��.�Qt�AH-���,8���/פ��k�%]�U�4��y+�,l�i[z��*�#�9�^m��#�aA��F�ZX#q���g7*wb.��:]����(D��\�Wn����@�u�f���fDp�0��3�c����lNU�L�WJ^���µm4)��!� ���6+ȑs� gR��)��Q���ޫ��$��uP#��0>ɖ��@��sD*��a����O�����Z/�]6�`p���||�fұj�+�z���v����1Xڅ�pz,(�^S��Oz.!��tSrj�:$�o����!���g��������1����Y�/f�,{z�������A]T���jfg���?,{g��"�Ω�'�����be�g�Q>3�2_}.�Q���x�b-�� Ga�]N�==�f���-j����_W�6� ux5'Zpd���B�ʼɤ�9�j�������B��zs�vbKW]2�lW����U�2����3 ��J��(Xa%IG���Ο��`��t��br�z��-~��?:T@� �@e|���'�Ȣ D���=��U��81|F���3�w���撺w�=�ܨe�m�p B燋&i^����pR�O����J*��}��:��,�-� ]c�H��i�����a3����m�6���ޘ����{��kPL�t0���Ǭ�PH+��|!��d]ŭ-&�p@�!� ?������T��zd7 ,�ȅp�t�����Ji��o�*��x�s�<�lTT�p���m�hr^��7`��8�� "k�/~e��2R}VUva�R�W���Q�V�Z�Ѥ��6���뒦�s����i6�cc"��2�0�����^�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ