Static task
static1
Behavioral task
behavioral1
Sample
C_PAQ_3.0/C_PAQ_3.0.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
C_PAQ_3.0/C_PAQ_3.0.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
ProxyCap_v302_汉化补丁.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
ProxyCap_v302_汉化补丁.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
原版文件 pcap302_x86.msi
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
原版文件 pcap302_x86.msi
Resource
win10v2004-20241007-en
General
-
Target
52468b8f8dcc4477758da3f2a1c38dc0_JaffaCakes118
-
Size
2.1MB
-
MD5
52468b8f8dcc4477758da3f2a1c38dc0
-
SHA1
dc8f49f64b19de9e5dc89c180090186c43798599
-
SHA256
37f1759f88c5bfd8afe46c6aadc196503cc0cb4ff45fdff642ae0b2eb96192e2
-
SHA512
ad5b7cd103129b0cb6d11eefce139b1d672b12b9f4301c2791c5447f3a3750759fb8bc0a9ee5fe9c9aabb49c0dbc25a3b7becbcafdfe69075fbba9fd444b1638
-
SSDEEP
49152:eGkBt0IXNWJmetQ0gXSyWHRr1wOOtfntqhfE7b5:exbdOmCpTr1Mtftqi9
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/C_PAQ_3.0/C_PAQ_3.0.exe unpack002/ProxyCap_v302_汉化补丁.exe
Files
-
52468b8f8dcc4477758da3f2a1c38dc0_JaffaCakes118.zip
-
C_PAQ_3.0/C_PAQ_3.0.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.Upack Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 712KB - Virtual size: 744KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
C_PAQ_3.0/reg.ini
-
C_PAQ_3.0/˵.txt
-
C_PAQ_3.0/ProxyCap_v302.rar.rar
-
ProxyCap 3.02 注册码.txt
-
ProxyCap_v302_汉化补丁.exe.exe windows:1 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 1024B - Virtual size: 584B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
原版文件 pcap302_x86.msi.msi
-
使用说明.txt