F:\Coding Date\c#\my C#\practice\5 定时提醒\eyeshield 3.0\eyeshield 3.0\obj\x86\Debug\eyeshield 3.0.pdb
Overview
overview
6Static
static
3huyanxiaoj...ib.dll
windows7-x64
1huyanxiaoj...ib.dll
windows10-2004-x64
1huyanxiaoj...ib.dll
windows7-x64
3huyanxiaoj...ib.dll
windows10-2004-x64
3huyanxiaoj....0.exe
windows7-x64
6huyanxiaoj....0.exe
windows10-2004-x64
6huyanxiaoj...cn.url
windows7-x64
1huyanxiaoj...cn.url
windows10-2004-x64
1huyanxiaoj...��.url
windows7-x64
1huyanxiaoj...��.url
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
huyanxiaojingling/AxInterop.WMPLib.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
huyanxiaojingling/AxInterop.WMPLib.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
huyanxiaojingling/Interop.WMPLib.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
huyanxiaojingling/Interop.WMPLib.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
huyanxiaojingling/eyeshield 3.0.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
huyanxiaojingling/eyeshield 3.0.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
huyanxiaojingling/河源下载站-cngr.cn.url
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
huyanxiaojingling/河源下载站-cngr.cn.url
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
huyanxiaojingling/淘宝热卖.url
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
huyanxiaojingling/淘宝热卖.url
Resource
win10v2004-20241007-en
General
-
Target
556ac75f293f8ebb70750f4ff973ab32_JaffaCakes118
-
Size
164KB
-
MD5
556ac75f293f8ebb70750f4ff973ab32
-
SHA1
a04857dd9cfba09f72a6ead039236ef8ec7b79b9
-
SHA256
f0eac458807bb4b1fae6408a2a971b61eee2b55b9bbf635c90c35c68a3c5829b
-
SHA512
4e5a989e33c1b23f14c80cecf748b6d2228fbbf159efa29002b6949152c60ebfdba5d9bd75e99c0105b4bf518e49498132669782b9fe9f41bcfa25bfca600c20
-
SSDEEP
3072:xFSm6uA546vYwqDDLQtZnjYnPKgI4THKZgbEw3vSyOrVHDDyu8lM:xwm/M2DDMtZnOI6agYSsRDyu3
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/huyanxiaojingling/AxInterop.WMPLib.dll unpack001/huyanxiaojingling/Interop.WMPLib.dll unpack001/huyanxiaojingling/eyeshield 3.0.exe
Files
-
556ac75f293f8ebb70750f4ff973ab32_JaffaCakes118.rar
-
huyanxiaojingling/AxInterop.WMPLib.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 48KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
huyanxiaojingling/Interop.WMPLib.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 320KB - Virtual size: 319KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 816B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
huyanxiaojingling/eyeshield 3.0.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 221KB - Virtual size: 220KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
huyanxiaojingling/shake.wav
-
huyanxiaojingling/河源下载站-cngr.cn.url.url
-
huyanxiaojingling/淘宝热卖.url.url