Overview

overview

10

Static

static

10

如果无�...rk.url

windows7-x64

1

如果无�...rk.url

windows10-2004-x64

1

搜狐邮�...om.dll

windows7-x64

10

搜狐邮�...om.dll

windows10-2004-x64

5

搜狐邮�....0.exe

windows7-x64

6

搜狐邮�....0.exe

windows10-2004-x64

3

最新版�...��.url

windows7-x64

1

最新版�...��.url

windows10-2004-x64

1

软件更新.url

windows7-x64

1

软件更新.url

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    5453844b2e6fc0762eaa1870b63d1cc2_JaffaCakes118

  • Size

    1.3MB

  • MD5

    5453844b2e6fc0762eaa1870b63d1cc2

  • SHA1

    c775bd354b050a24ea61c3a7c595c63c050967db

  • SHA256

    aa854bd9743478659bfa8d62b5d6c918202191dc79c2f7348216fb3161575dda

  • SHA512

    410fab2c2d0ed3d8a9507f9be6593b81ac2313095815d3e55ab2e7843e484c1cfb71072e6013a6a5e261a3b7d42be58a3cc557e33a21270034c08c185fb252a3

  • SSDEEP

    24576:YFNJ6oTxKGanvtf+djvbqOIFFSboHoy+gNTqb9LjTRokKjl+YZC4fzdT4YmM:Y/J6WKGaliuOuSboHoVLjloh4YZC4+Yf

Score
10/10
upxblackmoon

Malware Config

Signatures

  • Blackmoon family
    blackmoon
  • Detect Blackmoon payload 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • 5453844b2e6fc0762eaa1870b63d1cc2_JaffaCakes118
    .rar
  • 如果无法运行，请先安装.NET Framework.url
  • 搜狐邮箱/wisdom.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • 搜狐邮箱/搜狐.邮箱自动注册机V1.0.exe
    .exe windows:5 windows x86 arch:x86

    36eec5a94b810766069a109dde0cf7f5


    Headers

    Imports

    Sections

  • 最新版到ARP联盟搜索下载.url
  • 软件更新.url