RemoveHook
SetSpeed
SetupHook
UnHook
Behavioral task
behavioral1
Sample
变速娃娃/173绿色软件.url
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
变速娃娃/173绿色软件.url
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
变速娃娃/HookDLL.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
变速娃娃/HookDLL.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
变速娃娃/变速娃娃.exe
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
变速娃娃/变速娃娃.exe
Resource
win10v2004-20240426-en
Target
24acca8cfaae309dfa8064aca9bb0fe4_JaffaCakes118
Size
184KB
MD5
24acca8cfaae309dfa8064aca9bb0fe4
SHA1
5210d0886cd89bc764a8c01fc255549dd06553d1
SHA256
9f1f0b636694aa4053cb1266fe52de93a9b7072d9e8ef0a34cb64c5ff9d14b3f
SHA512
172b508ec04d934ac54ac26c23d2657a8f1be38d196174cfdb09950712c21d13f46719b375bfe178ab045daedffaeefe67ad4aa24e9b7751e28312888bcb4afa
SSDEEP
3072:N/wSkP0mGH8lUSRfdDtJvga2IBNp2mNUiN1waryWy2ClwkjSKLvVEGG:N/wSkPSclUSRlZJvx2IfUiN2xWyvlwLd
resource | yara_rule |
---|---|
static1/unpack001/变速娃娃/变速娃娃.exe | upx |
Checks for missing Authenticode signature.
resource |
---|
unpack001/变速娃娃/HookDLL.dll |
unpack001/变速娃娃/变速娃娃.exe |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WaitForSingleObject
GetTickCount
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleFileNameA
CreateMutexA
WriteProcessMemory
VirtualProtect
VirtualQuery
GetProcAddress
ReleaseMutex
FreeLibrary
GetLocaleInfoA
GetCurrentProcess
GetLastError
LoadLibraryA
CloseHandle
GetStringTypeW
GetCurrentThreadId
GetCommandLineA
GetModuleHandleA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
HeapSize
ExitProcess
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
HeapReAlloc
VirtualAlloc
WriteFile
InitializeCriticalSectionAndSpinCount
RtlUnwind
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
SetTimer
GetMessageTime
UnhookWindowsHookEx
MessageBoxA
GetWindowThreadProcessId
SetWindowsHookExA
CallNextHookEx
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
timeSetEvent
timeGetTime
RemoveHook
SetSpeed
SetupHook
UnHook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE