Overview
overview
3Static
static
3yckzkfd/77...��.htm
windows7-x64
3yckzkfd/77...��.htm
windows10-2004-x64
3yckzkfd/Զ...��.exe
windows7-x64
3yckzkfd/Զ...��.exe
windows10-2004-x64
3yckzkfd/�...��.url
windows7-x64
1yckzkfd/�...��.url
windows10-2004-x64
1yckzkfd/�...��.url
windows7-x64
1yckzkfd/�...��.url
windows10-2004-x64
1yckzkfd/�...��.url
windows7-x64
1yckzkfd/�...��.url
windows10-2004-x64
1yckzkfd/�...��.url
windows7-x64
1yckzkfd/�...��.url
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
yckzkfd/77169.org˵.htm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
yckzkfd/77169.org˵.htm
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
yckzkfd/Զ̿ƿͻ/ͻ/VNCͻ.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
yckzkfd/Զ̿ƿͻ/ͻ/VNCͻ.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
yckzkfd/ĺڿͬ˽ѧѵ.url
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
yckzkfd/ĺڿͬ˽ѧѵ.url
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
yckzkfd/ĺڿͬ.url
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
yckzkfd/ĺڿͬ.url
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
yckzkfd/¿ƼIDC˾.url
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
yckzkfd/¿ƼIDC˾.url
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
yckzkfd/¿Ƽȫά.url
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
yckzkfd/¿Ƽȫά.url
Resource
win10v2004-20241007-en
General
-
Target
36f4a8095934d1846fdb70c6edabdbc7_JaffaCakes118
-
Size
579KB
-
MD5
36f4a8095934d1846fdb70c6edabdbc7
-
SHA1
370a2a2240f11367a84e336b7268e4562830cba5
-
SHA256
63e58b8988f2f776689ba7361bc01cbde8ab77b5c063b3db7c94321a7a44c494
-
SHA512
53e7c6f7e6fb5cc491c0e1e4b882a5df84d3903721e5445a6712ffe5f8b38df36441cd6821c26a187cae39dcc3c14a91a24e675624507ebf6ed9367e1d38a112
-
SSDEEP
12288:8OVpoJGfd/ejJ7sKThTN760+zPlHA11RJsY/8dFzWggy0PpQd5af1lI+lpM/:8oHfd/el7s8TulG1sYUdFqPhQ7yrI+ls
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/yckzkfd/Զ̿ƿͻ/ͻ/VNCͻ.exe
Files
-
36f4a8095934d1846fdb70c6edabdbc7_JaffaCakes118.zip
-
yckzkfd/##ע##.txt
-
yckzkfd/77169.orgʹð˵.txt
-
yckzkfd/77169.org˵.htm.html
-
yckzkfd/Զ̿ƿͻ/ͻ/VNCͻ.exe.exe windows:4 windows x86 arch:x86
65ae5cf17140aeaf91e3e9911da0ee3e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
LoadLibraryA
CloseHandle
WriteFile
CreateDirectoryA
GetTempPathA
ReadFile
SetFilePointer
CreateFileA
GetModuleFileNameA
GetStringTypeA
LCMapStringW
LCMapStringA
HeapAlloc
HeapFree
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
GetStringTypeW
user32
MessageBoxA
wsprintfA
Sections
.text Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ecode Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 136KB - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
yckzkfd/ĺڿͬ˽ѧѵ.url
-
yckzkfd/ĺڿͬ.url
-
yckzkfd/¿ƼIDC˾.url
-
yckzkfd/¿Ƽȫά.url