Behavioral task
behavioral1
Sample
无线网络密码查看器/无线网络密码查看器.chm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
无线网络密码查看器/无线网络密码查看器.chm
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
无线网络密码查看器/无线网络密码查看器.exe
Resource
win7-20240903-en
General
-
Target
441a099d34f8aa6737dd45549f2467d9_JaffaCakes118
-
Size
40KB
-
MD5
441a099d34f8aa6737dd45549f2467d9
-
SHA1
f4ce1c4300dc375edc5513b35ba7a51a77fdbcee
-
SHA256
db63c0491913c0b818629d801105ec6114c164ce13bf555a59be00dc2d029ab4
-
SHA512
89b3d72db59284854b8173123ed1337e4b105208d93544aeae1acab063f008f06141e39cc497755cfc633fd307085c4442b841302580ea727192c29de9d74bbd
-
SSDEEP
768:thFBTQ/t1P5XeB9eC1gHO9jg1Cl47wTmE+SFqrHf2aeggW0e9YgNg+:jTQjP50kCCCq7wTmE+1bPp4e9YT+
Malware Config
Signatures
-
Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule static1/unpack002/out.upx Nirsoft -
resource yara_rule static1/unpack001/无线网络密码查看器/无线网络密码查看器.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/无线网络密码查看器/无线网络密码查看器.exe unpack002/out.upx
Files
-
441a099d34f8aa6737dd45549f2467d9_JaffaCakes118.rar
-
无线网络密码查看器/【久友下载Www.9Upk.Com】使用说明.txt
-
无线网络密码查看器/无线网络密码查看器.cfg
-
无线网络密码查看器/无线网络密码查看器.chm.chm
-
无线网络密码查看器/无线网络密码查看器.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 48KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 29KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
无线网络密码查看器/无线网络密码查看器_lng.ini