Static task
static1
Behavioral task
behavioral1
Sample
ARP联盟.url
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ARP联盟.url
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
卡巴KEY获取器V2.0.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
卡巴KEY获取器V2.0.exe
Resource
win10v2004-20240226-en
General
-
Target
3886718dba4ba317a581612121654de0_JaffaCakes118
-
Size
37KB
-
MD5
3886718dba4ba317a581612121654de0
-
SHA1
44da8a2977879455f65c7c4fe9f39da0bf199f8f
-
SHA256
c7f1c8aef9375fc532f90d3639c70b1c3ec9c3aef9d042aa46ae39dfc679d354
-
SHA512
2ea657da795c51191efbd98f7a9e3658c39938e555ad37f3f74122bf4a6192b3ea99311090867a7d1f41672524f0bd6d722f1b7f26ee0b8a680d55f8f06ae062
-
SSDEEP
768:S9I2la5M5SijQ87QqiczzSO9MutD2S2HCwu8RC8XnHT7TGEX4DkZ0gPsJ3:mI2f5Si33zWO9Mut2SWCgnTx4dgPA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/卡巴KEY获取器V2.0.exe
Files
-
3886718dba4ba317a581612121654de0_JaffaCakes118.rar
-
ARP联盟.url
-
卡巴KEY获取器V2.0.exe.exe windows:4 windows x86 arch:x86
0e9f542111702c273a513320e7fa1d75
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
ord190
SHGetFolderLocation
ShellExecuteA
ole32
CoTaskMemFree
kernel32
ReadProcessMemory
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetCurrentProcess
LocalFree
RtlFillMemory
LocalAlloc
RtlMoveMemory
lstrcpyn
LocalSize
GetModuleHandleA
MultiByteToWideChar
lstrlenA
urlmon
URLDownloadToFileA
user32
GetWindowTextA
SetWindowTextA
CreateWindowExA
PostQuitMessage
GetWindowLongA
SetWindowLongA
IntersectRect
EqualRect
GetMessageA
TranslateMessage
DispatchMessageA
DestroyWindow
SetWindowRgn
SetWindowPos
MessageBoxA
wsprintfA
EnableWindow
GetWindowTextLengthA
IsWindowVisible
GetWindowRect
CallWindowProcA
ReleaseDC
FillRect
GetSysColor
GetDC
DefWindowProcA
TrackMouseEvent
SendMessageA
GetParent
InvalidateRect
EndPaint
BeginPaint
MoveWindow
LoadCursorA
LoadIconA
RegisterClassExA
ShowWindow
IsWindow
GetClassInfoExA
UpdateWindow
gdi32
GetObjectA
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
CreateSolidBrush
StretchBlt
CreatePatternBrush
GetPixel
CombineRgn
CreateFontA
CreateDIBitmap
SetTextColor
TextOutA
SetBkColor
DeleteObject
CreateRectRgn
msimg32
TransparentBlt
shlwapi
StrDupA
msvcrt
strncmp
sprintf
modf
_ftol
_strnicmp
Sections
.text Size: 92KB - Virtual size: 89KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE