InstallHook
UnHook
Static task
static1
Behavioral task
behavioral1
Sample
hook.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
hook.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
格盘拦截.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
格盘拦截.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
河源下载站-Xz7.com.url
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
河源下载站-Xz7.com.url
Resource
win10v2004-20240426-en
Target
6306779520c43f104a663ed74cb6bc15_JaffaCakes118
Size
19KB
MD5
6306779520c43f104a663ed74cb6bc15
SHA1
487fdaf3b833f5af2bcabbf8b282f88acff094b1
SHA256
7843461aeda990420436d87fd6efaca3e74b7e377eaec6ea03dcaea1203675bf
SHA512
1a885e9a4c504425e0371c29debe19fce5ca5de2f20ec7e8ceda7a192ba04ffbb4ea27e35f45ddd9ba0ebabb7f25d94761211210788ffe8b4a4e8e75dd1a5027
SSDEEP
384:2Olh6KnMDiv7bDO/sm3raCZfsw71tTiW8+7Nle7KKKtBUwHolfkFu3oN9KCApdU:2OlPnMDKbDObRfsw7HL8+7NcktB9Hu81
Checks for missing Authenticode signature.
resource |
---|
unpack001/hook.dll |
unpack001/格盘拦截.exe |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
CloseHandle
CreateFileA
ExitProcess
GetCommandLineA
GetCurrentProcess
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetVersionExA
GlobalAlloc
GlobalFree
LoadLibraryA
MultiByteToWideChar
ReadFile
SetErrorMode
SetFilePointer
SetLastError
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WideCharToMultiByte
WriteFile
WriteProcessMemory
RtlMoveMemory
CLSIDFromProgID
CoCreateInstance
CoInitialize
CoUninitialize
ProgIDFromCLSID
GetActiveObject
SafeArrayCreate
SysAllocStringByteLen
SysFreeString
SysStringByteLen
VariantClear
VariantCopy
CreateDialogParamA
CreateWindowExA
MessageBoxA
CallNextHookEx
DialogBoxParamA
SetWindowsHookExA
UnhookWindowsHookEx
InstallHook
UnHook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
_CIcos
_adj_fptan
_adj_fdiv_m64
_adj_fprem1
__vbaSetSystemError
__vbaHresultCheckObj
__vbaNameFile
_adj_fdiv_m32
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
DllFunctionCall
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
_CIlog
_adj_fdiv_m32i
_adj_fdivr_m32i
_adj_fdivr_m32
_adj_fdiv_r
ord100
_CIatan
_allmul
_CItan
_CIexp
__vbaFreeObj
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ