28259b80b5dfd68aac23044f25dcf902_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
28259b80b5dfd68aac23044f25dcf902_JaffaCakes118
Size 1.8MB
Sample240509-d9tpragg3t
SHA256 8f83d2ebf1432f032bb308db5faa318d334e3c804b4670fca82fde807813f4aa
MD5 28259b80b5dfd68aac23044f25dcf902
SHA1 c1b1ecc858ccd75d06b7c9fd4f03cdf9cf66a193
SHA512 739f6d4d7aee19184a9383c2f753c478f6565ee30926f26f83cd6e0a1fa2fcda57b8b3710e9aaedee9a7cf34b0f36b732bebe75e391cc2db2b2c880cc2482c50
SSDEEP 49152:2hyAH7wSS/Ql96hU2xJavdN0uq7dmupUEabdwOAr:wyWKc6u+avdN0OupUEwdwOAr
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/注册机1.7.exe	upx

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/注册机1.3.exe
unpack001/注册机1.7.exe
unpack002/out.upx
unpack001/迅雷VIP账号获取器V1.3.exe

File Explorer

28259b80b5dfd68aac23044f25dcf902_JaffaCakes118

.rar 1.8MB
注册机1.3.exe

.exe 908KB
注册机1.7.exe

.exe 590KB
out.upx

.exe 908KB
迅雷VIP账号获取器V1.3.exe

.exe 926KB
飘荡软件.url

.url 328B

28259b80b5dfd68aac23044f25dcf902_JaffaCakes118

SHA256 8f83d2ebf1432f032bb308db5faa318d334e3c804b4670fca82fde807813f4aa
MD5 28259b80b5dfd68aac23044f25dcf902
SHA1 c1b1ecc858ccd75d06b7c9fd4f03cdf9cf66a193
SHA512 739f6d4d7aee19184a9383c2f753c478f6565ee30926f26f83cd6e0a1fa2fcda57b8b3710e9aaedee9a7cf34b0f36b732bebe75e391cc2db2b2c880cc2482c50
SSDEEP 49152:2hyAH7wSS/Ql96hU2xJavdN0uq7dmupUEabdwOAr:wyWKc6u+avdN0OupUEwdwOAr
MD5 SHA1 SHA512 SSDEEP

注册机1.3.exe

IMPHASH 4ddfb6cb403ef36bbf1f10a8c4505f41
SHA256 369b85d184da3dadfe166871d4260ce9c125f52322614d12119afc9fe3cf4ae2
MD5 4d99ca221758f65dc947fa8b8dbae62c
SHA1 ddcfe9a951b942aceb84ac0ca19a9a29aac31976
SHA512 7bc75bd6a08def65f668b717757ca99d287b80dd23ac0696b59f8260c8400165b224027a3d1a40429c645ff93154ae1b217413df59edb207cfe30c6e338f0760
SSDEEP 24576:kfwzcXavYOOHLoWvIpjZc7BebpYjWb8FQNGN2:kf8cKvYOOHc2IpjZOBUPGKq2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

444104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer GetCurrentProcess DuplicateHandle lstrcpynA SetLastError FileTimeToLocalFileTime FileTimeToSystemTime LocalFree MultiByteToWideChar WideCharToMultiByte InterlockedDecrement CreateSemaphoreA SetStdHandle IsBadCodePtr IsBadReadPtr CompareStringW CompareStringA SetUnhandledExceptionFilter GetStringTypeW GetStringTypeA IsBadWritePtr VirtualAlloc LCMapStringW LCMapStringA SetEnvironmentVariableA VirtualFree HeapCreate HeapDestroy GetEnvironmentVariableA GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter GetACP HeapSize ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile ReadFile GetLastError WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetFullPathNameA FreeLibrary LoadLibraryA lstrlenA GetVersionExA WritePrivateProfileStringA CreateThread CreateEventA Sleep GlobalAlloc GlobalLock GlobalUnlock FindFirstFileA FindClose TerminateProcess GetLocalTime GetSystemTime GetTimeZoneInformation RaiseException RtlUnwind GetStartupInfoA GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags GetCurrentThread GetFileTime GetFileSize TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle GetFileAttributesA SetCurrentDirectoryA GetVolumeInformationA TlsAlloc LocalAlloc lstrcmpA GetVersion GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcmpiA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount WaitForSingleObject CloseHandle InterlockedIncrement

user32

OpenClipboard SetClipboardData EmptyClipboard GetSystemMetrics GetCursorPos MessageBoxA SetWindowPos SendMessageA DestroyCursor SetParent GetClipboardData PostMessageA GetTopWindow GetParent GetFocus GetClientRect InvalidateRect ValidateRect UpdateWindow CloseClipboard wsprintfA EqualRect GetWindowRect SetForegroundWindow IsWindow DestroyMenu IsChild ReleaseDC IsRectEmpty FillRect GetDC SetCursor LoadCursorA SetCursorPos SetActiveWindow GetSysColor SetWindowLongA GetWindowLongA RedrawWindow EnableWindow IsWindowVisible OffsetRect PtInRect DestroyIcon IntersectRect SetRect InflateRect SetScrollPos SetScrollRange GetScrollRange SetCapture SystemParametersInfoA LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetSystemMenu GetWindowTextA GetWindowTextLengthA CharUpperA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA GetDlgItem DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetForegroundWindow GetLastActivePopup GetMessageTime RemovePropA CallWindowProcA GetPropA UnhookWindowsHookEx SetPropA GetClassLongA CallNextHookEx SetWindowsHookExA CreateWindowExA GetMenuItemID GetMenuItemCount RegisterClassA GetScrollPos UnregisterClassA AdjustWindowRectEx MapWindowPoints SendDlgItemMessageA ScrollWindowEx IsDialogMessageA SetWindowTextA MoveWindow CheckMenuItem SetMenuItemBitmaps GetMenuState GetMenuCheckMarkDimensions GetClassNameA GetDesktopWindow LoadStringA GetSysColorBrush DeleteMenu GetClassInfoA DefWindowProcA GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture

gdi32

SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateEllipticRgn CreateRoundRectRgn GetTextColor GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBitmap SelectObject GetObjectA PatBlt FillRgn CreateRectRgn CombineRgn CreateSolidBrush GetStockObject CreateFontIndirectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps SaveDC RestoreDC SetBkMode SetPolyFillMode SetROP2 SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect MoveToEx LineTo CreateRectRgnIndirect SetBkColor CreatePen GetTextMetricsA Escape ExtTextOutA TextOutA RectVisible PtVisible GetViewportExtEx ExtSelectClipRgn

winmm

midiStreamRestart midiStreamClose midiOutReset midiStreamStop midiStreamOut midiOutPrepareHeader midiStreamProperty midiStreamOpen midiOutUnprepareHeader waveOutOpen waveOutGetNumDevs waveOutClose waveOutReset waveOutPause waveOutWrite waveOutPrepareHeader waveOutUnprepareHeader

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegCloseKey RegOpenKeyExA RegSetValueExA RegQueryValueA RegCreateKeyExA

shell32

ShellExecuteA Shell_NotifyIconA

ole32

OleUninitialize CLSIDFromString OleInitialize

oleaut32

UnRegisterTypeLi RegisterTypeLi LoadTypeLi

comctl32

ImageList_Destroy ord17

ws2_32

recv getpeername accept ioctlsocket recvfrom WSAAsyncSelect closesocket WSACleanup inet_ntoa

comdlg32

GetFileTitleA GetSaveFileNameA GetOpenFileNameA ChooseColorA

注册机1.7.exe

SHA256 be6dcf2932461acad2413415b54b10340f6db02973cccc2b18f0a2606756ccf2
MD5 333881cbddd33e7081f6f4a1a0a30023
SHA1 ca214e2cd65f1415529ae4b7d3cfbfac7f67be5d
SHA512 b3a894b8ea05bdfe32741b88faca233896333f98d80429b1e3a79e18e1732be80bd792a60321831ff650c3a49b9c99ffe1efcc730f1af8647031590fe78d66cc
SSDEEP 12288:EQaTwJbyRaVUN8SmsYdKf3DLYfcRIQlWHnU6HdEnifDSt1nGmKT:v36ys5ffYePWHUydxqGPT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1004464

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 ab1a44972cfaa3b3a9fa66774e16f8a543e4981d514159c460d7790dd541601f
MD5 e87fdb87ffae20475453e83d2238480b
SHA1 3c56f23beab91b2509c71a7c2d66faeed033c7a3
SHA512 0544812758ba5371259ba02df1114baaf7ff296e906415aabb0cfb7e7eb3065c64d06710d8a25a4a1390606b965694f75cae63dac6360ea445fe12f84af3208a
SSDEEP 12288:dAPehMaffDQCrpBfBQGguRuj7PrIZ5J7iR5nWFpPoSmImYEzt1nGmK:dAifDDvf6GguRG7apb8oQGP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

317123

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

迅雷VIP账号获取器V1.3.exe

SHA256 38d61aeed652662b205998d104420f01e80e7c58a383d1caca253973ced53591
MD5 c11772b4430194806ae884d0b2020709
SHA1 5569f57353ce3bb27dd12b55bb708d5826600624
SHA512 73ded597125c09ef45297274857dd637884a6fa79e46e741a81620421bce4a64bd5e61a2d01e3df63a675de0c2bd6d213e9581900bfe900f2474bd3a0526ea2a
SSDEEP 24576:NdYneTd/nKCv8CI+/AAJj/K/Ft6meRSFrVDg06QX//B:NdYeTZKMnwtpeRSpRgyB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

97760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

28259b80b5dfd68aac23044f25dcf902_JaffaCakes118

注册机1.3.exe

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

generic

注册机1.7.exe

generic

out.upx

generic

迅雷VIP账号获取器V1.3.exe

generic

飘荡软件.url