Overview
overview
3Static
static
3haiqi_pgos...��.url
windows7-x64
1haiqi_pgos...��.url
windows10-2004-x64
1haiqi_pgos...��.url
windows7-x64
1haiqi_pgos...��.url
windows10-2004-x64
1haiqi_pgos...63.exe
windows7-x64
1haiqi_pgos...63.exe
windows10-2004-x64
1haiqi_pgos...��.url
windows7-x64
1haiqi_pgos...��.url
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
haiqi_pgos.cc/2345网址导航.url
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
haiqi_pgos.cc/2345网址导航.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
haiqi_pgos.cc/U盘启动盘制作工具 - U盘装系统,一键制作U盘.url
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
haiqi_pgos.cc/U盘启动盘制作工具 - U盘装系统,一键制作U盘.url
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
haiqi_pgos.cc/海奇杀毒软件+v1.0.6+官网最新版++-+云安全防毒引擎的杀毒软件@162_38463.exe
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
haiqi_pgos.cc/海奇杀毒软件+v1.0.6+官网最新版++-+云安全防毒引擎的杀毒软件@162_38463.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
haiqi_pgos.cc/软件下载-软件下载第一门户.url
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
haiqi_pgos.cc/软件下载-软件下载第一门户.url
Resource
win10v2004-20240426-en
General
-
Target
930a8f0f7c15c30a32fe5f7b803c68c2_JaffaCakes118
-
Size
401KB
-
MD5
930a8f0f7c15c30a32fe5f7b803c68c2
-
SHA1
3b9b61169769065257ca1583ab746b35254bba2e
-
SHA256
b90c057831ca552a97bfa1fb7157c48a3bff78bb0fcdff8676f1c666ad5066c4
-
SHA512
40e4fabb8ba9ba41188924c76b9efbb99aff4e35f6ab18c5d555ca97c0b776e6c6c07250187f9f12ad878b380fb8c2e5ee37974d2aa39a4ccacfbc86d4b5a687
-
SSDEEP
6144:kKCGlSRRj3/rkQh+r2YYyN+UkblCezyRwspH3t+Iwt+oYlFTdf7vMLBq+M29883Y:KGlSRRj3Muys6hwsBY9G/jvMtdM22F
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/haiqi_pgos.cc/海奇杀毒软件+v1.0.6+官网最新版++-+云安全防毒引擎的杀毒软件@162_38463.exe
Files
-
930a8f0f7c15c30a32fe5f7b803c68c2_JaffaCakes118.rar
-
haiqi_pgos.cc/2345网址导航.url.url
-
haiqi_pgos.cc/U盘启动盘制作工具 - U盘装系统,一键制作U盘.url.url
-
haiqi_pgos.cc/海奇杀毒软件+v1.0.6+官网最新版++-+云安全防毒引擎的杀毒软件@162_38463.exe.exe windows:5 windows x86 arch:x86
a7392c77e300dd8014bf96c0e932a34d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeviceIoControl
GetModuleFileNameA
WideCharToMultiByte
MultiByteToWideChar
ExitProcess
FindFirstFileW
MapViewOfFile
UnmapViewOfFile
GetCurrentProcess
SetEvent
GetSystemDirectoryW
TerminateProcess
GetSystemDirectoryA
WritePrivateProfileStringW
FindClose
GetLocalTime
Process32FirstW
CreateFileMappingW
CreateEventW
Process32NextW
FindNextFileW
CreateToolhelp32Snapshot
SetFileAttributesW
CreateMutexW
SetUnhandledExceptionFilter
GetComputerNameW
GetModuleFileNameW
SetCurrentDirectoryW
GetCurrentThreadId
GetCurrentProcessId
LoadLibraryW
GetTempPathW
GetProcAddress
MoveFileW
DeleteFileW
InterlockedIncrement
DosDateTimeToFileTime
SystemTimeToFileTime
ReadFile
CreateFileW
GetCurrentDirectoryW
GetFileType
GetVersionExW
lstrlenA
FlushFileBuffers
WriteConsoleW
SetStdHandle
LoadLibraryExW
LCMapStringW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
QueryPerformanceCounter
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
RtlUnwind
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
UnhandledExceptionFilter
GetStdHandle
AreFileApisANSI
GetModuleHandleExW
SetLastError
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetModuleHandleW
CreateThread
DeleteFileA
GetTempPathA
CloseHandle
WaitForMultipleObjects
CreateDirectoryA
CreateProcessA
Sleep
InitializeCriticalSection
WriteFile
GetTickCount
WaitForSingleObject
InterlockedDecrement
SetEndOfFile
SetFilePointer
CreateFileA
HeapReAlloc
DeleteCriticalSection
DecodePointer
EnterCriticalSection
HeapSize
GetLastError
InterlockedExchange
RaiseException
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapFree
GetCommandLineW
IsProcessorFeaturePresent
ResumeThread
ExitThread
EncodePointer
VirtualQuery
VirtualProtect
VirtualAlloc
GetSystemInfo
OutputDebugStringW
IsDebuggerPresent
HeapAlloc
LocalFree
user32
MessageBoxW
DispatchMessageW
CopyRect
DefWindowProcW
SendMessageW
SetWindowTextA
GetSystemMetrics
PtInRect
IsWindow
FillRect
GetCursorPos
SetWindowPos
GetDesktopWindow
SetWindowLongW
EnableMenuItem
ReleaseDC
TrackPopupMenu
PostQuitMessage
GetMessageW
GetWindowTextW
GetWindowLongW
KillTimer
CreateWindowExW
SetRect
SetTimer
LoadMenuW
GetSystemMenu
LoadIconW
RegisterClassExW
TranslateMessage
DrawTextA
GetSubMenu
SetCursor
LoadCursorW
CharNextA
SetRectEmpty
BeginPaint
ShowWindow
DestroyWindow
SetForegroundWindow
EndPaint
GetDC
gdi32
EnumFontsW
CreateCompatibleBitmap
FrameRgn
GetTextExtentPoint32A
SetTextColor
StretchBlt
SetBkMode
CreateFontW
GetDIBColorTable
CreateRoundRectRgn
CreateSolidBrush
TextOutA
BitBlt
DeleteDC
CreateDIBSection
SetDIBColorTable
DeleteObject
SelectObject
CreateCompatibleDC
GetObjectW
advapi32
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
shell32
Shell_NotifyIconW
SHGetSpecialFolderPathA
ord165
ShellExecuteA
SHGetPathFromIDListA
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ole32
CoUninitialize
CoInitialize
CoCreateInstance
CreateStreamOnHGlobal
CLSIDFromString
oleaut32
VariantInit
VariantClear
GetErrorInfo
SysAllocString
SysFreeString
ws2_32
closesocket
socket
recv
setsockopt
htons
gethostbyname
send
WSAStartup
recvfrom
sendto
connect
inet_ntoa
inet_addr
shlwapi
PathIsDirectoryW
PathRemoveFileSpecW
PathFileExistsW
PathAppendW
StrStrIW
PathFileExistsA
StrStrIA
gdiplus
GdipFree
GdiplusShutdown
GdipGetImageHeight
GdiplusStartup
GdipGetImageWidth
GdipCloneImage
GdipBitmapLockBits
GdipGetImagePaletteSize
GdipDisposeImage
GdipAlloc
GdipDrawImageI
GdipBitmapUnlockBits
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipCreateBitmapFromStream
GdipGetImagePalette
msimg32
TransparentBlt
AlphaBlend
iphlpapi
GetAdaptersInfo
setupapi
SetupIterateCabinetW
urlmon
URLDownloadToFileW
dbghelp
MiniDumpWriteDump
Sections
.text Size: 228KB - Virtual size: 227KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 412KB - Virtual size: 422KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
haiqi_pgos.cc/软件下载-软件下载第一门户.url.url