221f00007e89702130999a0f83cc6a56_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

221f00007e89702130999a0f83cc6a56_JaffaCakes118
Size

2.6MB
MD5

221f00007e89702130999a0f83cc6a56
SHA1

42b42f6981350f73ca79a12bbc0a566ce95f6d64
SHA256

583aec99ee277a0f20d2993a2dd43ae1f9cc4fb3a506477f4ffa2b218820771b
SHA512

9dda6a8b484e2c25ddec2cfac7b18538621847e40f2a8701cfe69481fc97ca23c3d9479c5c4c5a1ea0702a2f4a2fbbc9dbe6d3cb935fc8b71ae61009ffe4671a
SSDEEP

49152:goS9LJULUR6VuChQGypNGWhZOtYnj4amiy+dVoCNQkW2wn42jGD2Zgx01EG:5SxJULIhCh+GBO0Hiy+dVFWJ2w42jfZD

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/龙文双码五笔输入法安装文件 3.98 版 060308/供龙文平台用专有字符安装文件051119/ImeInst.exe
unpack001/龙文双码五笔输入法安装文件 3.98 版 060308/龙文双码五笔输入法输入法(免费版）3.98 版 060308.exe

Files

221f00007e89702130999a0f83cc6a56_JaffaCakes118
.rar
龙文双码五笔输入法安装文件 3.98 版 060308/WB86用环保词语.txt
龙文双码五笔输入法安装文件 3.98 版 060308/WB86用电脑（网络）专业词语051011.txt
龙文双码五笔输入法安装文件 3.98 版 060308/供龙文平台用专有字符安装文件051119/ImeInst.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 433KB - Virtual size: 432KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 71KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
龙文双码五笔输入法安装文件 3.98 版 060308/供龙文平台用专有字符安装文件051119/data1.dat
龙文双码五笔输入法安装文件 3.98 版 060308/常用字符及专业词语的编码输入法060102.doc
.doc windows office2003
龙文双码五笔输入法安装文件 3.98 版 060308/汉语拼音学习资料.doc
.doc windows office2003
龙文双码五笔输入法安装文件 3.98 版 060308/软件说明.doc
.doc windows office2003
龙文双码五笔输入法安装文件 3.98 版 060308/龙文双码五笔输入法输入法(免费版）3.98 版 060308.exe
.exe windows:4 windows x86 arch:x86

a6d1f237a38b6e7d3a48b606fa0d7939

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
SetFileSecurityA
SetFileSecurityW

kernel32

CloseHandle
CompareStringA
CreateDirectoryA
CreateDirectoryW
CreateFileA
CreateFileW
DeleteFileA
DeleteFileW
DosDateTimeToFileTime
ExitProcess
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
FindResourceA
FreeLibrary
GetCPInfo
GetCommandLineA
GetCurrentDirectoryA
GetCurrentProcess
GetDateFormatA
GetFileAttributesA
GetFileAttributesW
GetFileType
GetFullPathNameA
GetLastError
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetNumberFormatA
GetProcAddress
GetProcessHeap
GetStdHandle
GetTempPathA
GetTickCount
GetTimeFormatA
GetVersionExA
GlobalAlloc
HeapAlloc
HeapFree
HeapReAlloc
IsDBCSLeadByte
LoadLibraryA
LocalFileTimeToFileTime
MoveFileA
MoveFileExA
MultiByteToWideChar
ReadFile
SetCurrentDirectoryA
SetEndOfFile
SetEnvironmentVariableA
SetFileAttributesA
SetFileAttributesW
SetFilePointer
SetFileTime
SetLastError
Sleep
SystemTimeToFileTime
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcmpiA
lstrlenA

comctl32

ord17

comdlg32

CommDlgExtendedError
GetOpenFileNameA

gdi32

DeleteObject

shell32

SHBrowseForFolderA
SHChangeNotify
SHFileOperationA
SHGetFileInfoA
SHGetMalloc
SHGetSpecialFolderLocation
ShellExecuteExA
SHGetPathFromIDListA

user32

CharToOemBuffA
CharUpperA
CopyRect
CreateWindowExA
DefWindowProcA
DestroyIcon
DestroyWindow
DialogBoxParamA
DispatchMessageA
EnableWindow
EndDialog
FindWindowExA
GetClassNameA
GetClientRect
GetDlgItem
GetDlgItemTextA
GetMessageA
GetParent
GetSysColor
GetSystemMetrics
GetWindow
GetWindowLongA
GetWindowRect
GetWindowTextA
IsWindow
IsWindowVisible
LoadBitmapA
LoadCursorA
LoadIconA
LoadStringA
MapWindowPoints
MessageBoxA
OemToCharA
OemToCharBuffA
PeekMessageA
PostMessageA
RegisterClassExA
SendDlgItemMessageA
SendMessageA
SetDlgItemTextA
SetFocus
SetMenu
SetWindowLongA
SetWindowPos
SetWindowTextA
ShowWindow
TranslateMessage
UpdateWindow
WaitForInputIdle
wsprintfA
wvsprintfA

ole32

CLSIDFromString
CoCreateInstance
CreateStreamOnHGlobal
OleInitialize
OleUninitialize

Sections

.text
Size: 73KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
龙文双码五笔输入法安装文件 3.98 版 060308/龙文智能五笔（专有字符）输入法安装方法060102.doc
.doc windows office2003
龙文双码五笔输入法安装文件 3.98 版 060308/龙文智能输入法平台简介051208.doc
.doc windows office2003

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

CODE Size: 433KB - Virtual size: 432KB

DATA Size: 10KB - Virtual size: 10KB

BSS Size: - Virtual size: 71KB

.idata Size: 9KB - Virtual size: 9KB

.tls Size: - Virtual size: 16B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 29KB - Virtual size: 28KB

.rsrc Size: 30KB - Virtual size: 30KB

a6d1f237a38b6e7d3a48b606fa0d7939

Headers

File Characteristics

Imports

advapi32

kernel32

comctl32

comdlg32

gdi32

shell32

user32

ole32

Sections

.text Size: 73KB - Virtual size: 76KB

.data Size: 2KB - Virtual size: 28KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 15KB - Virtual size: 16KB

CODE
Size: 433KB - Virtual size: 432KB

DATA
Size: 10KB - Virtual size: 10KB

BSS
Size: - Virtual size: 71KB

.idata
Size: 9KB - Virtual size: 9KB

.tls
Size: - Virtual size: 16B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 29KB - Virtual size: 28KB

.rsrc
Size: 30KB - Virtual size: 30KB

.text
Size: 73KB - Virtual size: 76KB

.data
Size: 2KB - Virtual size: 28KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 15KB - Virtual size: 16KB