bb24a2d97d84f53cfa675019cf18b6ee_JaffaCakes118
- SHA256 18e4a06236ace3be3e1aa2c43b548c4b0b4e783890681e4685e8d12330567b64
Overview
overview
10Static
static
3Bilibilizh....2.exe
windows7-x64
1Bilibilizh....2.exe
windows10-2004-x64
1Bilibilizh...pk.dll
windows7-x64
10Bilibilizh...pk.dll
windows10-2004-x64
7Bilibilizh...��.url
windows7-x64
1Bilibilizh...��.url
windows10-2004-x64
1Bilibilizh...��.url
windows7-x64
1Bilibilizh...��.url
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Bilibilizhubozhushou/Bilibili主播助手2.6.2.exe
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Bilibilizhubozhushou/Bilibili主播助手2.6.2.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
Bilibilizhubozhushou/lpk.dll
Resource
win7-20240611-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral4
Sample
Bilibilizhubozhushou/lpk.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral5
Sample
Bilibilizhubozhushou/更多软件下载.url
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Bilibilizhubozhushou/更多软件下载.url
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Bilibilizhubozhushou/飘荡软件.url
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Bilibilizhubozhushou/飘荡软件.url
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target bb24a2d97d84f53cfa675019cf18b6ee_JaffaCakes118
- Size 894KB
- Sample240618-hfzfcsvhmq
- SHA256 18e4a06236ace3be3e1aa2c43b548c4b0b4e783890681e4685e8d12330567b64
- MD5 bb24a2d97d84f53cfa675019cf18b6ee
- SHA1 17b7e9f0b91daa6f22b1c09e8ef105a12098fef4
- SHA512 9b01e3c51ba1fa28f00768162c3a7e10323552d6734639792f830c91e449814e628e43c9d2ad11e294f4a486a1436d058365b1b71dc021815a1574823cd4bc69
- SSDEEP 12288:KPzEC6sH2G9YlXtrruoKiQ7CQeKd562LErGV/aSLErliTFywoaH674nhv:NXsH94YoK37CQ56UBLmiBBH674hv
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Bilibilizhubozhushou/Bilibili主播助手2.6.2.exe unpack001/Bilibilizhubozhushou/lpk.dll
File Explorer
-
bb24a2d97d84f53cfa675019cf18b6ee_JaffaCakes118.rar 894KB
-
Bilibilizhubozhushou/Bilibili主播助手2.6.2.exe.exe 915KB
-
Bilibilizhubozhushou/lpk.dll.dll 136KB
-
Bilibilizhubozhushou/更多软件下载.url204B
-
Bilibilizhubozhushou/飘荡软件.url.url 320B
Bilibilizhubozhushou/Bilibili主播助手2.6.2.exe
- IMPHASH bf5a4aa99e5b160f8521cadd6bfe73b8
- SHA256 0b042645bddd096738f7f5608f86a9cc03c6f8eaa81dced121b3fbd9835e9f8d
- MD5 4dae89c1355966213fe0a94ee8716348
- SHA1 774dd20a0613bbcf88f9bcb38ebe96c41d135334
- SHA512 c9e9dc3b46fff5d0b4b9836335cf0a90acea9dd2be1999161a8312a6563ff15ba322b614a0737f58345449c9f15e81ce4c926243c0c2f3f21a5d86285c2440fa
- SSDEEP 12288:Kh1Lk70Tnvjcx5pP210Nls776PROr7WiKoqyJ4trKQP8yfqFCxt9Cgs7BsK7jr1m:uk70Trcxe1qHEYY4lPNfqFmujpbC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
843776
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
RaiseException
GetLastError
MultiByteToWideChar
lstrlenA
InterlockedDecrement
GetProcAddress
LoadLibraryA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleHandleA
Module32Next
CloseHandle
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
SetEndOfFile
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
HeapFree
GetProcessHeap
HeapAlloc
GetCommandLineA
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
ReadFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
FlushFileBuffers
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
ole32
OleInitialize
oleaut32
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayCreateVector
VariantClear
VariantInit
SysFreeString
SysAllocString
Name
.text
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
671KB
Virtual Size
670KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.text
Size
108KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=19, id=149, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=112, id=1, productName=Unmarked objects,
count=48, id=132, productName=VS2008 build 21022, version=21022,
count=142, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Bilibilizhubozhushou/lpk.dll
- IMPHASH e23b2990e58346a0a026310d32a82b0a
- SHA256 a901c3ba8fa3bdf95db6aa5b777dddedbdeaa253e95a1d52bfe461e0894128fb
- MD5 7528ed9d9ce35d671ae123ed4bac9309
- SHA1 7f1c4037346bfdb9b55fbbfaee09fbd6c9485e5b
- SHA512 93b92250f1d864370244edf37f7a25d9a96d8fe644c13c3b76dee1d8c6dc7d19dadd7813124f2b3d6edbe43d84171f815d515ce4052b66b82adfb2bef5ea3bba
- SSDEEP 3072:MJgFzYWIVDG280kuG5wRUE1hGte9P4PA/nd9vwZbRZ:MJqIVDGgjUE10gP4Y/n7vwZr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
45056
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
ExitProcess
GetProcAddress
lstrcpynA
LockResource
LoadResource
SizeofResource
FindResourceA
CreateProcessA
CloseHandle
WriteFile
CreateFileA
GetTempFileNameA
GetTempPathA
GetLastError
CreateMutexA
lstrcmpiA
GetModuleFileNameA
WaitForSingleObject
GetTickCount
GetLogicalDrives
FindClose
FindNextFileA
SetFileAttributesA
CopyFileA
GetFileAttributesA
FindFirstFileA
lstrcpyA
WaitForMultipleObjects
TerminateThread
ResumeThread
SetThreadPriority
CreateThread
FreeLibrary
SetEvent
CreateEventA
DisableThreadLibraryCalls
LoadLibraryA
lstrcatA
GetSystemDirectoryA
shell32
ord64
shlwapi
PathFindExtensionA
PathAppendA
PathFindFileNameA
LpkDllInitialize
LpkDrawTextEx
LpkEditControl
LpkExtTextOut
LpkGetCharacterPlacement
LpkGetTextExtentExPoint
LpkInitialize
LpkPSMTextOut
LpkTabbedTextOut
LpkUseGDIWidthCache
ftsWordBreak
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
700B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
522B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.text
Size
108KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=14, version=7299,
count=45, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
Bilibilizhubozhushou/更多软件下载.url
- SHA256 357214eb50712a5c8663ef263c458cb4ebbbc27e64d73ab5e32c82f60a7b80c8
- MD5 94e540428ac8f3545fec78c2b3dd8c0e
- SHA1 cd46c366b68af03fc8fa4fa097f9815d43e4c2e8
- SHA512 3c7876c3a18e1ba98329392ac1b940c479552b361386ce3776622ae557e4d3d8cee045d162a614a302a603cb4615024258703e0652f41541e043fcf7ecdff539
- MD5 SHA1 SHA512
Bilibilizhubozhushou/飘荡软件.url
- SHA256 8dc8673d85feb2d358e80a498ca7e649b46b8af119ebaf32126099df3cc5fea3
- MD5 c404bacb30424b525bf6dfcab807f461
- SHA1 4fdc923fbbeafcb4ee150f4f82597ae72d1f4df6
- SHA512 48b370b8a2a81ae5f3f57752b06f119b8bea0efc19b2ccf31683b5a9456ece68200ee2fb7826bc24c598311be925829be8084e1535f61330d8b91ba4b8d5f74a
- MD5 SHA1 SHA512