Static task
static1
Behavioral task
behavioral1
Sample
阿D注入工具.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
阿D注入工具.exe
Resource
win10v2004-20241007-en
General
-
Target
39d6c0cc83b77ce279272262a1f1a230_JaffaCakes118
-
Size
1005KB
-
MD5
39d6c0cc83b77ce279272262a1f1a230
-
SHA1
dda00fe24614033c21f81bb469112531ec9981ff
-
SHA256
aca9a946b6ff9d25a1e26f59e9de6d561f1a0f77c0405718be955a75a6f11ca8
-
SHA512
8aafcea5c8ea0134772b0c1b010531aff6acf1f8472423fa2d6b24b3dc30fed3817f129bd0971c0b88c7cb827d465e3616b1f1bf02a3685837bd7cf6b1cea15c
-
SSDEEP
24576:bEkyCWbEseBJTU0lIA4q5SjenN4P6YNWJmbJFnXV+YpD:bEFCWQsiwm14KSje6iYmmPnXVDh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/阿D注入工具.exe
Files
-
39d6c0cc83b77ce279272262a1f1a230_JaffaCakes118.rar
-
)!双击导入.reg
-
D99.mdb
-
下载使用说明.txt
-
使用说明.txt
-
阿D注入工具.exe.exe windows:4 windows x86 arch:x86
bd227ba966c127e93fe82f25f211eaca
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
VirtualFree
VirtualAlloc
GetProcAddress
ExitProcess
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
HeapAlloc
GetProcessHeap
HeapFree
user32
wsprintfA
MessageBoxA
Sections
.data Size: 958KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ex_cod Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ex_rsc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ