f��:���[���r�Vy�=pX�s{&{�%����y��`��il�!c�o韠�����3iG�a�_���J��́�4� �Z �:S�H^���s3����ƥ����v���@9Rw��F�M���0?V�2��e|�-�yji������MR{��h�9J��;C���}� )i����y�@���e�i�X�b��7���6�\U�2�T����Q���}{�}$a�s��@.>�,�����Q������_��îV��]�m��r&�qZ��O�&�\k'֫�%۩s����+CP?)p%}���L�<���F����b��2%�X�����CO��2�zR���t7��r�%�g����e�x�j�ٸO�(ۀ��!f�a[�0x�&�j��<r~��ٟщ�jx1B.����2��g0i����붺�.K���J��S:��������e��A�T+>�h�Ʀ����iU[�[��)��$�D���I�|a��-�|;~��P�#���͝^�ӰjRgG���P+.�n��߁��oc�Y�a�%���N }�"y�_�=�$�4�֔����h3$� ��>�&��jCh�Ҽ:�Ja�o��h=SGp���~��䥦hߞ�о a��Q]�>Me�ڛ����@�V{s^z\��M}��Q~�@ͻzTf_�6����.C)��ڑ��\G�g��o������,E�gl(�/����W�bN��NC�<�<l����>�����G��2��< '����0֢���)W���#t˫�0�:�R~�FoՊ�Q�����"��K�K�@��S�U+�������Ȃ�Ұ�S��g�7��u����j��G���[������bv�dIbb��'����b��-��k��3��z�o�l�� ����:1�^�J��Do�;��5�ߓ)U,�������������\x����&4ry���o\M�����VO����Kς�v����*��#�a�bS'�Z�> p�ewe':��e�P4�3�H�^ �$����u�@x���`�&�}M��1���;8WyхID��p4�~Y����v��[:j�k�w �� �S�=WQ�2�}�Z�J�9�I����z� ���F�ҎuP(��q�z9�3eЩ���J�e~�&��C3$���S'�����t8�-M�z.�D>n�u�O�;�S�rj���Z����ź�(�4"���N���bH�w&[pfN���9��k��p⭤g��#a(�Qq�H�U��Lc5E��˵�WŐw�*�%1��&_Jl���"�����f)��ȸ���|��r풯����l�����d���R�A��:�~�Q�$�Y���ǵEwuOc�o��[J���l�W ߸Zz�RФ�g^Px�3'dҮv&b.���Q�W���M)��|ʋ먯g� �E#�_n�p\�F�ܷ,p� X��*�@T�s��Sc- �pOJ��& ���x����� ����R;��8 �p.Ɠb݁�Ѣ�� 4qT2�&��D��K�C#��s�������і��ΊU����^�,/�V�rۖ�T�$G����H�vBE��r~���5�:$�Ⱦ��c��_PDM����0S���ޥ�p��㗀��ϰ�)�1�S�C$Q��I���F���jǥ@'%X��d ��c�� ��\�_��e;*��M�.�̢��7̅�K)�N9��t�o����\d�XP�w��!��m�~e^`΅p��q�Wqp�1�e'C�n�1�<7�!��yh#qe5i�%m�w[m�3�ű}�{�#�KiO'g�����<��z�d/ �'$�T��{O�:��M�^E\�$'VJ�2�Ώ�tu��1���&_单l�0�[�m-�d`Q��We(�ዡT����eѳ�a4�dS?�5<O1��:$� ��<o?�$ ����Y8�yZ ���_������uQ&�qŦ| \�ж�I�9��͆V��������p-I�P��Q�P���Ɲv����1�{t�@����!���Va�^x/C�S�s����vC!�TI��C���rD�oy�ɚ�t�F ��Gs��<�(��Zض�*��B��F�`0�:J�[4�'�M�v�@/�mDZO��\����,���l�����nb���77�_���AXZ�-᎕���ss���"���'����:�)�?Ȉ�����|9��2Oz [~v�ʄUk@��dZN���7dZo��KDϰ�C8�!"8F{=-ٛ49d�����#��Eh����3���I(IFh�E�p �z�������p�@���Ř��5�|��#S����,�{Y㙸d$ѣ,���}f����h����YJo�t�5}�,��&f��KG�sP�5#X3�:��x���+ֳo<�S�x��y_ 2((�(���|���OV|����ˌ��zMѲ`�tzҾl�4����� � �3ҙ�02�@�f���e��s���B��/��w�ms`g���O&���A���m����lFGNS=�����](��[~�d]�q���&(�����<w� 0���8v����Z̋�4r0r'Dv��"E��}�kH�G�:Z;[���K���_ܮ!�Ҽ�����ج�%z��~ޔ�w�r�Q��A��ӗt2�I������W�b~ ps��id�+���Ks�m3O'n�<#@���I���[�8�E])f��c7Z��!yj[���\�vţo���_�G}��|N��V��X��/D���˯4e�|�}Y�O�r�+��b������M�c3'#���6v�,֦�B�oh� 7���,����͔��:n�8��;��OT�3��9�����a=[����<��VIh��/��ۃ���߇��3 ���jN�#ǃ���� u�x��#�p�-Ah���:m��߭�&�r-a� �_f������� ��E���i47����j[x�k�H��I]�����ה���v�S�>�Wp���������^_�;[�����'f��� ,nP�%Z��$d�Cr�wF��}�\Ž˥�n�N"R[X������)�uz�Σ%]��0I���s�C#l��B>t�Ѣ�����F�wJ2�Al�
Overview
overview
7Static
static
720091020-s...��.url
windows7-x64
120091020-s...��.url
windows10-2004-x64
120091020-sp4/d3d9.dll
windows7-x64
720091020-sp4/d3d9.dll
windows10-2004-x64
720091020-s...��.url
windows7-x64
120091020-s...��.url
windows10-2004-x64
120091020-s...��.url
windows7-x64
120091020-s...��.url
windows10-2004-x64
120091020-s...��.exe
windows7-x64
720091020-s...��.exe
windows10-2004-x64
7Behavioral task
behavioral1
Sample
20091020-sp4/ARP联盟.url
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
20091020-sp4/ARP联盟.url
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
20091020-sp4/d3d9.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
20091020-sp4/d3d9.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
20091020-sp4/使用说明.url
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
20091020-sp4/使用说明.url
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
20091020-sp4/帮助文件.url
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
20091020-sp4/帮助文件.url
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
20091020-sp4/蜗牛透视.exe
Resource
win7-20240903-en
General
-
Target
388f10dc1ccc541fe9d6ff5f9919212c_JaffaCakes118
-
Size
172KB
-
MD5
388f10dc1ccc541fe9d6ff5f9919212c
-
SHA1
d2ccb4f959e4e70addbecefd1cdbcc1c89a36011
-
SHA256
4e12aad3cb454086d53eeffeb89ab15d6a58c46ec87887aec680854d5a89feae
-
SHA512
e1405e1ab2fd9389d5d53a4e5dbc17a71a6e60e9046d610523ebc16d277612190afb2c4b766982cf31cffd64c50a9a311a875153c093df427ab509528d5a2d0c
-
SSDEEP
3072:y6uvTju+QE7VdpMgpHWlgPG2BI+KupnCGVXLnE7cWijhW3AjoDSLx:y9vTjuZWVdp3p8SQ+KupC0XLnEFijkyN
Malware Config
Signatures
-
resource yara_rule static1/unpack001/20091020-sp4/d3d9.dll vmprotect static1/unpack001/20091020-sp4/蜗牛透视.exe vmprotect -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/20091020-sp4/d3d9.dll unpack001/20091020-sp4/蜗牛透视.exe
Files
-
388f10dc1ccc541fe9d6ff5f9919212c_JaffaCakes118.rar
-
20091020-sp4/ARP联盟.url
-
20091020-sp4/d3d9.dll.dll windows:4 windows x86 arch:x86
df3a2e074179823e7054326e286568cd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryExA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
MessageBoxA
msvcrt
__dllonexit
Exports
Exports
Sections
.text Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 996B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 72KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
20091020-sp4/使用说明.txt
-
20091020-sp4/使用说明.url
-
20091020-sp4/帮助文件.url
-
20091020-sp4/蜗牛透视.exe.exe windows:4 windows x86 arch:x86
a1e67e3281dcc40aadac422d328be723
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateMutexA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
AppendMenuA
MessageBoxA
shell32
ShellExecuteA
mfc42
ord1949
msvcrt
exit
comctl32
InitCommonControlsEx
msvcp60
?unsetf@ios_base@std@@QAEXH@Z
Exports
Exports
0,c?cwMfq}d�r$�=!���1��R}g��xA�F��&�r��#��;�f��S'��P�r�$+������$p��A�����d��&�8�Op\I(�LRuC����4�k�nF}Z���������Pl� 5�����<%�_b����k����9��4lVߑ��B)m`hW�r���QIK�l�'�Q*ї���jlP���doMܾ��픳l��i8?�D�ziݭ���w�1�� �L�ogn�:�o��}q���=���M�����[���G�"άw��*p�\G[1�9D�_�o4q�����}��Qm���T>y\� ��4�z}���"�}�?���!K�p ���v�%EGRl��Y��`)��־1:�D�Yv�����>�L�����b�m�䮎�)`*q�����8�o�,U��5�Y��φQ�G�կ�B��Ҩ�����g�.������.�ӘŨ7���;����K���pC��6�qI\�O�+�E~�}��&���5v�3l�%�$��N}�5�!����7��'g$��3��I�*o_a�����h7��T·��F�E����9���%��2$�!i�w�u�����[ƧC��$��q ���� Q)��(�U���9 kn$���D-5���}�Aw/XЬ�N�%ZJ��%�J`�ݘn���2j��T�D���ŧ�-ȟ^��*n��6�W�Us�S� �Д�����k�g��~ x��,�B��>ս����&ܤ����D���eݿ���n����%Pd�zo �[�����V�a�Jߢ��3{C7����m�L��y�� #˪���՟��A9�ç��;!hϒ��h�? �-�5�;>q��u��\���/ǥ�O�"b����~�~��D�� ���J��Ѥ�G1�#�OϺV �2��E����Z�H����RF[@Wx�nX��uB�I�W@��&�_ 6ط�+889��g;��F����������8�S�J�e�� {�L�a���3s��7OӄH�oD?�O�h�s���58�����L7{Tz* o�2ZW�\o.�;��-�W�\�a)�3�f����Ћ�K�-=Q� #�����[eH��Q �7lGΤ��������S�P�|�Ț< �? ! w��U� �B�B ������w2� ER wZ��e����Kl�˫���M���a������mЈ�Fx`�)�i��`|����HGD�f& ny�0���i�n Zjz۫����w�ǫ�ߠa��/�Ѷ��gC�V���里߭2W�S���7��%O�5_2D��Јّ�����Hw-�/��ұ1�sY���4�D�y��d*����+=��Gw�4E�Tf�NuV%!5w!�{P����L\!¾�v�х�_�qjq3vr�iYz�I��zȯ��������RU1G��>7h-��S�H-�-'��t���kCJƂ��K%y��r��QZ����3��q2�"4�_ipQ 4q��'y��-�:r�&BN6�E�[��j�:EƁ�.��)��e�t^�{���,���|�K���p��)^�*2?���l�8�GU�Ե2��}^�N7�����7ǟ�����W�YR����������f��P�t�vb�� 2�OK�BryVN�t�g����[e�5�閑�'�G�<b%d��F����#R�~2�D0�㘀<m$f��t~d�����6���o1e��dyvW��� @Jͅ���������S2��6���ҫ|8c@��ehj;�DZ�RLN���Î�h�������Y(/� ��8;���kR[�& &�gfv����i�!dø\�ض��fW�V�e�`�����\-�̋!��s��U���8�B!8ۇ飴�I�F��GAW�N@�� 0����dV%���U5-������������B��2O�gJVWD�숆�4cz�R��=�(�s�)n� �ΆA�ї�F��3��ˉ�%è��|Q�c�����VF] �� j��m�Ku�>�����;���M �l�@�ѐ���ͅ�8.^�ހ���k�B���B"�.���ԟ�$D�������xI�b��7�U�a$z!4����A�%�Q��*ރ9艬������7��k��J�PG�m�M�hHW>p�X�Z�n�]�k�eT��Ą����M/d�H�}���G��5,�_��7[�En[%ض@�7,l� CPჯK�-����t���Yz <ۭ�M"� ���%E�(We���#���D�!|:4]���`��%�k@�O崖������i�D#t����Ҹ6?���N+�-��:(m�t;c���_8� fۢ�i�+b�ZM�,l�i�\t{�֖�` Q�R������lb��Iz�� QE�H���[�(�E�G��TZ�����-��$���w�g`��c#��� �4�b ��v�"��������i��4%m����D/���O���+x�����b3�3����ξO>k������Ds!��5,cnzcnd�P��J���OIn���R�2٬K�צzA��W��T���rj���tĂ%�z :����Z^2Ŭ/�{n��%rU����J����/��v�y�x��}���H�nT�]���<��3P�U�����{_�b6R�Ç�C%�f{oƐ��W����U��QF:(,G�E_�� ���`]V����=3���BiY� @8��I��b���ﮒ$Q���Y��hB5u:�\G#�+�W/T�*,w����4`����'��X_�FZ�ޘ0��c3N���7r�aqvC:P��?2�ϞYW dY9�W2�Q���.ީ��]۷%�D�� i�M��j�L�b���℗:D�z@�}CN 5Y+\�g\+C��N��g�V@'��B��+���h�VC �+� ��5�ߠ��b�7xa孏�|�fc���E ������^۔`6k�Yۼ�~qEc�s��Q��6/5����@�/;J����P�&�_q�q����b��{��,�;v��� �h��;Wl O�`���h�*0뚁FN/tk�.�_������u��l�yz��}k�����Z���+R- ����F�
Sections
.text Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 108KB - Virtual size: 106KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ