Static task
static1
Behavioral task
behavioral1
Sample
RegReplace125f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
RegReplace125f.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20240412-en
General
-
Target
f14ab623b00eccc79a753586ad8b675f_JaffaCakes118
-
Size
1.4MB
-
MD5
f14ab623b00eccc79a753586ad8b675f
-
SHA1
66531442d30cd453ed233d3da854e6b8c6944180
-
SHA256
eea6906b1b2c0a4f3ebff0e777e6f894a1619403ed76351c7e93f8c3b2ca2642
-
SHA512
a6de5e219f2467ee685444affe0af869dfef58b28524ae2d9b302e70e044e5431a0caf53bdaa9b9c92e44cc8d031695af9ef0d2e232265568d78c94ce10a5ef9
-
SSDEEP
24576:L52+ab4ZzhDOMvUiriIgX9G2ioDWRmdKbz+1MYebF84ShKDKGOygN6tVqKzT:wXkzhD7vBri39GdoLQz+1ubF8403yg6X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/RegReplace125f.exe
Files
-
f14ab623b00eccc79a753586ad8b675f_JaffaCakes118.rar
-
RegReplace125f.exe.exe windows:4 windows x86 arch:x86
f4e99281436bc7fdb3ae20b23962ff98
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
ShellExecuteA
FindExecutableA
user32
DefWindowProcA
BeginPaint
GetSysColor
GetClientRect
SetRect
EndPaint
SetWindowWord
GetWindowWord
RegisterClassA
OemToCharA
CharToOemA
OemToCharBuffA
LoadCursorA
DestroyWindow
SetWindowTextA
SendMessageA
EnableWindow
PostMessageA
GetLastActivePopup
ShowWindow
CharNextA
SetTimer
KillTimer
DialogBoxIndirectParamA
GetWindowRect
GetSystemMetrics
EndDialog
GetKeyState
PeekMessageA
TranslateMessage
DispatchMessageA
GetParent
SetDlgItemTextA
SendDlgItemMessageA
GetDlgItem
InvalidateRect
UpdateWindow
wsprintfA
MessageBoxA
SetCursor
SetWindowPos
GetDlgItemTextA
kernel32
lstrlenA
_lopen
_lclose
CreateDirectoryA
lstrcatA
RtlUnwind
lstrcmpA
GetCommandLineA
GetModuleHandleA
SetErrorMode
GetVersion
LoadLibraryA
GetProcAddress
GetModuleFileNameA
FreeLibrary
lstrcmpiA
GetWindowsDirectoryA
GetEnvironmentVariableA
LocalAlloc
LocalFree
GlobalUnlock
GlobalHandle
GlobalFree
GlobalAlloc
GlobalLock
WinExec
_llseek
GetDriveTypeA
_lread
_lwrite
GetVolumeInformationA
FindClose
FindFirstFileA
GetCurrentDirectoryA
SetCurrentDirectoryA
LocalFileTimeToFileTime
_lcreat
SetFileTime
DosDateTimeToFileTime
lstrcpyA
gdi32
SetTextColor
SetTextAlign
GetTextExtentPoint32A
GetBkColor
DeleteObject
SetBkColor
ExtTextOutA
CreateDCA
GetDeviceCaps
CreateFontIndirectA
DeleteDC
SelectObject
advapi32
RegQueryValueA
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 146B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
新云软件.url.url