914010e32ee84718f2ff113b1f2f4a15_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
914010e32ee84718f2ff113b1f2f4a15_JaffaCakes118
Size 30.6MB
Sample240603-k793aabb47
SHA256 db82d89c8ff30b6e7b0685e88ff1beadced423571c3537b3fef7cefb979a3806
MD5 914010e32ee84718f2ff113b1f2f4a15
SHA1 17a79b223927e663f1f80aab72bf9a3a483d2e6c
SHA512 15b63f70c44996ccacbe04d68e8a711fc8ddff1beb0837eb67c2865aac039dcc5905965cfe836db38c57961c5e66aac8cfee3f62c88d7fa948c7d7b471a8f05f
SSDEEP 786432:kD3OLQG9YpaBBuGNiONzRFp0YXM0J1Ni90kfO:kD3OH9YpaBBuGNiARFb9J1Ni90kfO
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack001/Gamersky-Hearts.of.Iron.IV.CHS.Patch.v7.0/Hearts.of.Iron.IV.CHS.Patch.v7.0.exe	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Gamersky-Hearts.of.Iron.IV.CHS.Patch.v7.0/Hearts.of.Iron.IV.CHS.Patch.v7.0.exe

File Explorer

914010e32ee84718f2ff113b1f2f4a15_JaffaCakes118

.rar 30.6MB
Gamersky-Hearts.of.Iron.IV.CHS.Patch.v7.0/Hearts.of.Iron.IV.CHS.Patch.v7.0.exe

.exe 31.0MB
Gamersky-Hearts.of.Iron.IV.CHS.Patch.v7.0/下载说明.txt

966B
Gamersky-Hearts.of.Iron.IV.CHS.Patch.v7.0/游民星空 Gamersky.com.url

.url 265B

914010e32ee84718f2ff113b1f2f4a15_JaffaCakes118

SHA256 db82d89c8ff30b6e7b0685e88ff1beadced423571c3537b3fef7cefb979a3806
MD5 914010e32ee84718f2ff113b1f2f4a15
SHA1 17a79b223927e663f1f80aab72bf9a3a483d2e6c
SHA512 15b63f70c44996ccacbe04d68e8a711fc8ddff1beb0837eb67c2865aac039dcc5905965cfe836db38c57961c5e66aac8cfee3f62c88d7fa948c7d7b471a8f05f
SSDEEP 786432:kD3OLQG9YpaBBuGNiONzRFp0YXM0J1Ni90kfO:kD3OH9YpaBBuGNiARFb9J1Ni90kfO
MD5 SHA1 SHA512 SSDEEP

Gamersky-Hearts.of.Iron.IV.CHS.Patch.v7.0/Hearts.of.Iron.IV.CHS.Patch.v7.0.exe

IMPHASH 68071c67dc5f2f397dd11050fada0dd3
SHA256 9ee929c678fe83eb87214a2627c6dbf475c20ed56bfb405136e6c06a56334db3
MD5 a15a6273b585fdac5a3565ea5a3df6e6
SHA1 de053e0bbbfdf9e7c6715bdbd3eb6abe33e34f55
SHA512 82c56cbbc5a82fa70bdf8a819416b621c5c7ffe46637faa7b3b8740f8d6ee249e1e4eb719dfbb330e3aecdc290873ef0e516284e011651f1681b4923bf131e67
SSDEEP 786432:DnUPbWdpcDgd5GvBGUO1Al03xympg6ex+IOR7a1Fk0AVt:DnU2pGe5GvBGAmB7vl9RuE0St
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

161511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

wsock32

__WSAFDIsSet recv send setsockopt ntohs recvfrom select WSAStartup htons accept listen bind closesocket connect WSACleanup ioctlsocket sendto WSAGetLastError inet_addr gethostbyname gethostname socket

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winmm

timeGetTime waveOutSetVolume mciSendStringW

comctl32

ImageList_Destroy ImageList_Remove ImageList_SetDragCursorImage ImageList_BeginDrag ImageList_DragEnter ImageList_DragLeave ImageList_EndDrag ImageList_DragMove ImageList_Create InitCommonControlsEx ImageList_ReplaceIcon

mpr

WNetUseConnectionW WNetCancelConnection2W WNetGetConnectionW WNetAddConnection2W

wininet

InternetReadFile InternetCloseHandle InternetOpenW InternetSetOptionW InternetCrackUrlW HttpQueryInfoW InternetQueryOptionW HttpOpenRequestW HttpSendRequestW FtpOpenFileW FtpGetFileSize InternetOpenUrlW InternetConnectW InternetQueryDataAvailable

psapi

GetProcessMemoryInfo

iphlpapi

IcmpCreateFile IcmpCloseHandle IcmpSendEcho

userenv

UnloadUserProfile DestroyEnvironmentBlock CreateEnvironmentBlock LoadUserProfileW

uxtheme

IsThemeActive

kernel32

WaitForSingleObject HeapAlloc GetProcessHeap HeapFree Sleep GetCurrentThreadId MultiByteToWideChar MulDiv GetVersionExW GetSystemInfo FreeLibrary LoadLibraryA GetProcAddress SetErrorMode WideCharToMultiByte lstrcpyW lstrlenW GetModuleHandleW QueryPerformanceCounter VirtualFreeEx OpenProcess VirtualAllocEx WriteProcessMemory ReadProcessMemory CreateFileW SetFilePointerEx ReadFile WriteFile FlushFileBuffers TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFileTime GetFileAttributesW FindFirstFileW FindClose DeleteFileW CloseHandle MoveFileW CopyFileW CreateDirectoryW RemoveDirectoryW SetSystemPowerState QueryPerformanceFrequency FindResourceW LoadResource LockResource SizeofResource EnumResourceNamesW OutputDebugStringW GetTempPathW GetTempFileNameW DeviceIoControl GetLocalTime CompareStringW DeleteCriticalSection CreateThread LeaveCriticalSection GetStdHandle CreatePipe InterlockedExchange TerminateThread LoadLibraryExW FindResourceExW VirtualFree FormatMessageW GetExitCodeProcess GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileSectionNamesW FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToFileTime LocalFileTimeToFileTime GetDriveTypeW GetDiskFreeSpaceExW GetDiskFreeSpaceW GetVolumeInformationW SetVolumeLabelW CreateHardLinkW SetFileAttributesW GetShortPathNameW CreateEventW SetEvent GetEnvironmentVariableW SetEnvironmentVariableW GlobalLock GlobalUnlock GlobalAlloc GetFileSize GlobalFree GlobalMemoryStatusEx Beep GetSystemDirectoryW GetComputerNameW GetWindowsDirectoryW GetCurrentProcessId GetProcessIoCounters CreateProcessW SetPriorityClass LoadLibraryW VirtualAlloc GetLastError GetModuleFileNameW GetFullPathNameW SetCurrentDirectoryW IsDebuggerPresent GetCurrentDirectoryW lstrcmpiW RaiseException InitializeCriticalSectionAndSpinCount InterlockedDecrement InterlockedIncrement DuplicateHandle GetCurrentProcess EnterCriticalSection GetCurrentThread ExitProcess GetModuleHandleExW ExitThread GetSystemTimeAsFileTime ResumeThread GetCommandLineW IsProcessorFeaturePresent HeapSize IsValidCodePage GetACP GetOEMCP GetCPInfo SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetStringTypeW SetStdHandle GetFileType GetConsoleCP GetConsoleMode RtlUnwind ReadConsoleW SetFilePointer GetTimeZoneInformation GetDateFormatW GetTimeFormatW LCMapStringW GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc WriteConsoleW SetEndOfFile FindNextFileW SetEnvironmentVariableA

user32

CopyImage SetWindowPos GetCursorInfo RegisterHotKey ClientToScreen GetKeyboardLayoutNameW IsCharAlphaW IsCharAlphaNumericW IsCharLowerW IsCharUpperW GetMenuStringW GetSubMenu GetCaretPos IsZoomed MonitorFromPoint GetMonitorInfoW SetWindowLongW SetLayeredWindowAttributes FlashWindow GetClassLongW TranslateAcceleratorW IsDialogMessageW GetSysColor InflateRect DrawFocusRect DrawTextW FrameRect DrawFrameControl FillRect PtInRect DestroyAcceleratorTable CreateAcceleratorTableW SetCursor GetWindowDC GetSystemMetrics GetActiveWindow CharNextW wsprintfW RedrawWindow DrawMenuBar DestroyMenu SetMenu GetWindowTextLengthW CreateMenu IsDlgButtonChecked DefDlgProcW CallWindowProcW ReleaseCapture SetCapture MonitorFromRect LoadImageW CreateIconFromResourceEx mouse_event ExitWindowsEx SetActiveWindow FindWindowExW EnumThreadWindows SetMenuDefaultItem InsertMenuItemW IsMenu TrackPopupMenuEx AdjustWindowRectEx DeleteMenu CheckMenuRadioItem GetMenuItemID GetMenuItemCount SetMenuItemInfoW GetMenuItemInfoW SetForegroundWindow IsIconic UnregisterHotKey SystemParametersInfoW keybd_event SendInput GetAsyncKeyState SetKeyboardState GetKeyboardState GetKeyState VkKeyScanW LoadStringW DialogBoxParamW MessageBeep EndDialog SendDlgItemMessageW GetDlgItem SetWindowTextW CopyRect ReleaseDC GetDC EndPaint BeginPaint GetClientRect GetMenu DestroyWindow EnumWindows GetDesktopWindow IsWindow IsWindowEnabled IsWindowVisible EnableWindow InvalidateRect GetWindowLongW GetWindowThreadProcessId AttachThreadInput GetFocus ScreenToClient SendMessageTimeoutW EnumChildWindows CharUpperBuffW GetClassNameW GetParent GetDlgCtrlID SendMessageW MapVirtualKeyW PostMessageW GetWindowRect SetUserObjectSecurity CloseDesktop CloseWindowStation OpenDesktopW SetProcessWindowStation GetProcessWindowStation OpenWindowStationW GetUserObjectSecurity SetRect SetClipboardData EmptyClipboard CountClipboardFormats CloseClipboard GetClipboardData IsClipboardFormatAvailable OpenClipboard BlockInput GetMessageW LockWindowUpdate DispatchMessageW TranslateMessage GetCursorPos PeekMessageW MessageBoxW DefWindowProcW MoveWindow SetFocus PostQuitMessage KillTimer CreatePopupMenu RegisterWindowMessageW SetTimer ShowWindow CreateWindowExW RegisterClassExW LoadIconW LoadCursorW GetSysColorBrush GetForegroundWindow MessageBoxA DestroyIcon FindWindowW CharLowerBuffW GetWindowTextW

gdi32

SetPixel DeleteObject GetTextExtentPoint32W ExtCreatePen StrokeAndFillPath StrokePath GetDeviceCaps CloseFigure LineTo AngleArc CreateCompatibleBitmap CreateCompatibleDC MoveToEx Ellipse PolyDraw BeginPath SelectObject StretchBlt GetDIBits DeleteDC GetPixel CreateDCW GetStockObject Rectangle SetViewportOrgEx GetObjectW SetBkMode RoundRect SetBkColor CreatePen CreateSolidBrush SetTextColor CreateFontW GetTextFaceW EndPath

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

GetAclInformation RegEnumValueW RegDeleteValueW RegDeleteKeyW RegEnumKeyExW RegSetValueExW RegCreateKeyExW GetUserNameW RegOpenKeyExW RegCloseKey RegQueryValueExW RegConnectRegistryW InitializeSecurityDescriptor InitializeAcl AdjustTokenPrivileges OpenThreadToken OpenProcessToken LookupPrivilegeValueW DuplicateTokenEx CreateProcessAsUserW CreateProcessWithLogonW GetLengthSid CopySid InitiateSystemShutdownExW LogonUserW AllocateAndInitializeSid CheckTokenMembership FreeSid GetTokenInformation GetSecurityDescriptorDacl SetSecurityDescriptorDacl AddAce GetAce

shell32

DragQueryPoint ShellExecuteExW DragQueryFileW SHEmptyRecycleBinW SHBrowseForFolderW SHGetFolderPathW SHFileOperationW SHGetPathFromIDListW SHGetDesktopFolder SHGetMalloc ExtractIconExW Shell_NotifyIconW ShellExecuteW DragFinish

ole32

CoTaskMemAlloc CoTaskMemFree CLSIDFromString ProgIDFromCLSID CLSIDFromProgID OleSetMenuDescriptor MkParseDisplayName OleSetContainedObject CoCreateInstance IIDFromString StringFromGUID2 CreateStreamOnHGlobal CoInitialize CoUninitialize GetRunningObjectTable CoGetInstanceFromFile CoGetObject CoInitializeSecurity CoCreateInstanceEx CoSetProxyBlanket

oleaut32

RegisterTypeLi LoadTypeLibEx VariantCopyInd SysReAllocString SysFreeString SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayUnaccessData SafeArrayAccessData SafeArrayAllocData UnRegisterTypeLi SafeArrayCreateVector SysAllocString SysStringLen VariantTimeToSystemTime VarR8FromDec SafeArrayGetVartype OleLoadPicture QueryPathOfRegTypeLi VariantCopy VariantClear CreateDispTypeInfo CreateStdDispatch DispCallFunc VariantChangeType SafeArrayAllocDescriptorEx VariantInit

Sharing

General

Malware Config

Signatures

File Explorer

914010e32ee84718f2ff113b1f2f4a15_JaffaCakes118

Gamersky-Hearts.of.Iron.IV.CHS.Patch.v7.0/Hearts.of.Iron.IV.CHS.Patch.v7.0.exe

wsock32

version

winmm

comctl32

mpr

wininet

psapi

iphlpapi

userenv

uxtheme

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

generic

Gamersky-Hearts.of.Iron.IV.CHS.Patch.v7.0/下载说明.txt

Gamersky-Hearts.of.Iron.IV.CHS.Patch.v7.0/游民星空 Gamersky.com.url