Static task
static1
Behavioral task
behavioral1
Sample
zfgh-v1.0/字符批量替换精灵.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
zfgh-v1.0/字符批量替换精灵.exe
Resource
win10v2004-20240419-en
General
-
Target
027e99ef1ca005afd45deed4dc8403ce_JaffaCakes118
-
Size
24KB
-
MD5
027e99ef1ca005afd45deed4dc8403ce
-
SHA1
4d5b6fed390b04a869e312dfe4acf2915b2c840d
-
SHA256
aaf322544db64d81f3f02c537cb54c2a94d2cf0253e8b277757794c148146a5e
-
SHA512
28a99e5770eaab929bf2828976adad3c9ad3cab3712d856dd65c293433196821dfa51e5a54f0a663a355601a01ca49b3e6a752aee44d1f2707b8d6b1417b1fb6
-
SSDEEP
384:3tJiMNdS39EA1ba/fz0VF3TzvsWS9zDXQcj2dHxp21fMYb60tt73mgkQWuxtGhap:9LNdStP9aobzk9zDKR4FMy60DWQWEWM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/zfgh-v1.0/字符批量替换精灵.exe
Files
-
027e99ef1ca005afd45deed4dc8403ce_JaffaCakes118.rar
-
zfgh-v1.0/字符批量替换精灵.exe.exe windows:4 windows x86 arch:x86
9e3d7bdd54b07c7c752be2f81900bb61
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindResourceA
GetModuleHandleA
lstrcmpA
lstrcpynA
LoadResource
SetEndOfFile
SetFilePointer
CopyFileA
lstrcatA
lstrcpyA
CloseHandle
UnmapViewOfFile
MulDiv
CreateFileMappingA
FreeResource
LockResource
lstrlenA
WaitForSingleObject
SetEvent
FindClose
FindNextFileA
FindFirstFileA
SetThreadPriority
CreateThread
CreateEventA
MultiByteToWideChar
WideCharToMultiByte
GlobalFree
GlobalAlloc
GlobalLock
GetFileSize
CreateFileA
MapViewOfFile
GlobalUnlock
ExitProcess
GetVersion
GetProcAddress
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
LoadLibraryA
HeapReAlloc
HeapFree
RtlUnwind
VirtualFree
WriteFile
HeapDestroy
GetFileType
HeapCreate
SetHandleCount
GetEnvironmentStringsW
GetStdHandle
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetEnvironmentStrings
UnhandledExceptionFilter
GetCurrentProcess
GetModuleFileNameA
GetStartupInfoA
GetCommandLineA
VirtualAlloc
GetOEMCP
TerminateProcess
HeapAlloc
GetCPInfo
GetACP
user32
GetDC
ReleaseDC
SetWindowPos
DialogBoxIndirectParamA
GetSystemMetrics
SetWindowTextA
GetParent
GetWindowRect
DefDlgProcA
SendMessageA
RegisterClassA
LoadIconA
LoadCursorA
IsDlgButtonChecked
CheckDlgButton
SetDlgItemInt
EndDialog
SetDlgItemTextA
GetDlgItem
EnableWindow
MessageBoxA
GetDlgItemTextA
gdi32
GetDeviceCaps
GetStockObject
GetObjectA
advapi32
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
shell32
SHBrowseForFolderA
SHGetMalloc
SHGetPathFromIDListA
Sections
.text Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ