Overview
overview
7Static
static
7Readme-说明.htm
windows7-x64
3Readme-说明.htm
windows10-2004-x64
3bangnitao/...��.exe
windows7-x64
6bangnitao/...��.exe
windows10-2004-x64
6attachment-10.js
windows7-x64
3attachment-10.js
windows10-2004-x64
3attachment-11.js
windows7-x64
3attachment-11.js
windows10-2004-x64
3attachment-13.js
windows7-x64
3attachment-13.js
windows10-2004-x64
3attachment-15.js
windows7-x64
3attachment-15.js
windows10-2004-x64
3attachment-16.js
windows7-x64
3attachment-16.js
windows10-2004-x64
3attachment-18.js
windows7-x64
3attachment-18.js
windows10-2004-x64
3attachment-19.js
windows7-x64
3attachment-19.js
windows10-2004-x64
3attachment-20.js
windows7-x64
3attachment-20.js
windows10-2004-x64
3attachment-9.js
windows7-x64
3attachment-9.js
windows10-2004-x64
3Behavioral task
behavioral1
Sample
Readme-说明.htm
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Readme-说明.htm
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
bangnitao/帮你淘.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
bangnitao/帮你淘.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
attachment-10.js
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
attachment-10.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
attachment-11.js
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
attachment-11.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
attachment-13.js
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
attachment-13.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
attachment-15.js
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
attachment-15.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
attachment-16.js
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
attachment-16.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
attachment-18.js
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
attachment-18.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
attachment-19.js
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
attachment-19.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
attachment-20.js
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
attachment-20.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
attachment-9.js
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
attachment-9.js
Resource
win10v2004-20241007-en
General
-
Target
398d1f116bdb1e3d173ea996e9f6d6c6_JaffaCakes118
-
Size
968KB
-
MD5
398d1f116bdb1e3d173ea996e9f6d6c6
-
SHA1
f61edb68de4ae331b696d7dddcab47ca3309eef4
-
SHA256
7d8dfcabd9282c317aab1b9009a357aa933d5f5f6ec243487c553b5268c2d4fc
-
SHA512
31110e0150c2e4bfa833612e2e61625a7d4489bcf26c5c9f7f98b595b6c1e26542de7aa173a7a8174d0b64aef1c1ded5ef58dd98e264467d71de7a7607e8d94b
-
SSDEEP
24576:ww5DH3KQIFRqraWsJ/NnoeRV3bDj9IJpr+ZopA:ww53KvqrJW/15rDjefieA
Malware Config
Signatures
-
resource yara_rule static1/unpack001/bangnitao/帮你淘.exe aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/bangnitao/帮你淘.exe
Files
-
398d1f116bdb1e3d173ea996e9f6d6c6_JaffaCakes118.rar
-
Readme-说明.htm
-
bangnitao/帮你淘.exe.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 798KB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 17KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 83KB - Virtual size: 464KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 27KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
如果无法运行,请先安装.NET Framework - 飓风软件下载.mht.eml
-
http://www.baidu.com/s?tn=jfskychina&wd=site:jfsky.com+���°�Microsoft .NET Framework
-
http://www.google.cn/search?complete=1&hl=zh-CN&q=site:jfsky.com+���°�Microsoft .NET Framework
-
http://www.jfsky.com/
-
http://www.jfsky.com/Search_Soft.asp
-
http://www.jfsky.com/SoftDown/SoftDown_42598.html
-
http://www.jfsky.com/SoftList/Catalog_10_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_11_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_131_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_177_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_178_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_179_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_180_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_196_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_1_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_244_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_246_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_255_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_259_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_2_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_301_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_313_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_323_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_327_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_394_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_3_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_4_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_52_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_5_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_6_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_7_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Catalog_9_SoftTime_Desc_1.html
-
http://www.jfsky.com/SoftList/Commend_1.html
-
http://www.jfsky.com/SoftList/News_0_1.html
-
http://www.jfsky.com/SoftList/Soft_Category.html
-
http://www.jfsky.com/SoftList/Top_AllHits_1.html
-
http://www.jfsky.com/SoftView/
-
http://www.jfsky.com/SoftView/SoftView_12931.html
-
http://www.jfsky.com/SoftView/SoftView_1496.html
-
http://www.jfsky.com/SoftView/SoftView_15064.html
-
http://www.jfsky.com/SoftView/SoftView_15601.html
-
http://www.jfsky.com/SoftView/SoftView_15885.html
-
http://www.jfsky.com/SoftView/SoftView_17113.html
-
http://www.jfsky.com/SoftView/SoftView_18091.html
-
http://www.jfsky.com/SoftView/SoftView_18491.html
-
http://www.jfsky.com/SoftView/SoftView_18640.html
-
http://www.jfsky.com/SoftView/SoftView_19096.html
-
http://www.jfsky.com/SoftView/SoftView_19602.html
-
http://www.jfsky.com/SoftView/SoftView_20032.html
-
http://www.jfsky.com/SoftView/SoftView_22048.html
-
http://www.jfsky.com/SoftView/SoftView_22462.html
-
http://www.jfsky.com/SoftView/SoftView_22974.html
-
http://www.jfsky.com/SoftView/SoftView_23861.html
-
http://www.jfsky.com/SoftView/SoftView_24339.html
-
http://www.jfsky.com/SoftView/SoftView_24728.html
-
http://www.jfsky.com/SoftView/SoftView_25179.html
-
http://www.jfsky.com/SoftView/SoftView_3047.html
-
http://www.jfsky.com/SoftView/SoftView_32995.html
-
http://www.jfsky.com/SoftView/SoftView_33165.html
-
http://www.jfsky.com/SoftView/SoftView_33168.html
-
http://www.jfsky.com/SoftView/SoftView_33169.html
-
http://www.jfsky.com/SoftView/SoftView_33172.html
-
http://www.jfsky.com/SoftView/SoftView_33173.html
-
http://www.jfsky.com/SoftView/SoftView_33174.html
-
http://www.jfsky.com/SoftView/SoftView_33176.html
-
http://www.jfsky.com/SoftView/SoftView_33178.html
-
http://www.jfsky.com/SoftView/SoftView_33179.html
-
http://www.jfsky.com/SoftView/SoftView_33182.html
-
http://www.jfsky.com/SoftView/SoftView_33183.html
-
http://www.jfsky.com/SoftView/SoftView_39029.html
-
http://www.jfsky.com/SoftView/SoftView_3923.html
-
http://www.jfsky.com/SoftView/SoftView_42598.html#
-
http://www.jfsky.com/SoftView/SoftView_42598.html#content
-
http://www.jfsky.com/SoftView/SoftView_5467.html
-
http://www.jfsky.com/SoftView/SoftView_6704.html
-
http://www.jfsky.com/SoftView/SoftView_6705.html
-
http://www.jfsky.com/Tags/Tag_Microsoft_1.html
-
http://www.jfsky.com/Tags/Tag_qq����_1.html
-
http://www.jfsky.com/Tags/Tag_ɱ��_1.html
-
http://www.jfsky.com/Tags/Tag_��Ѷqq_1.html
-
http://www.jfsky.com/about.asp
-
http://www.jfsky.com/bcinfo.asp
-
http://www.jfsky.com/contract.asp
-
http://www.jfsky.com/default_study.html
-
http://www.jfsky.com/game.htm
-
http://www.jfsky.com/help.asp
-
http://www.jfsky.com/hezuo.asp
-
http://www.jfsky.com/link.html
-
http://www.jfsky.com/map/map_1.html
-
http://www.jfsky.com/mapinfo/map_1.html
-
http://www.jfsky.com/qq.html
-
http://www.jfsky.com/qudong.html
-
http://www.jfsky.com/shadu.html
-
http://www.jfsky.com/soft/
-
http://www.jfsky.com/softlist/Catalog_8_SoftTime_Desc_1.html
-
http://www.jfsky.com/tags/tagmap_1.html
-
http://www.jfsky.com/taogao.asp
-
http://www.jfsky.com/youxi.html
-
http://www.jfsky.com/zhidao
-
http://www.miibeian.gov.cn/
- Show all
-
-
attachment-10.js
-
attachment-11.js
-
attachment-13.js
-
attachment-14
-
attachment-15.js
-
attachment-16.js
-
attachment-18.js
-
attachment-19.js
-
attachment-2.gif
-
attachment-20.js
-
attachment-4.gif
-
attachment-5.gif
-
attachment-6.gif
-
attachment-7
-
attachment-8
-
attachment-9.js
-
email-html-1.txt.html
-
软件说明.txt