22cf641bf359106a250956234dbee273_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

22cf641bf359106a250956234dbee273_JaffaCakes118
Size

186KB
MD5

22cf641bf359106a250956234dbee273
SHA1

b28b0e320e46d4b30c08e65ceb96b7d9190115b0
SHA256

17882c32603dfb52093f3851a6804b14f8a5006be3731975e3cecc3a3eb85f07
SHA512

60587b70f5594416c6e9ea129c2604a0eab57c2f8b09895f5c837b081bce7edc076e49978faefb6014b96371faaedf8028bcb2206e35e73207e5b1103bb51da5
SSDEEP

3072:+vauMxcren75K1qg6KcrOFTi5aVwxMmqd1y67zn2IBnzoiOSg5eAh8Le2bWRa:nu5e7PleTi5aVwxpuCYzozSlAKURa

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/课件发布系统 v3.32 完整版/Aspupload/AspUpload.dll
unpack001/课件发布系统 v3.32 完整版/Lyfupload/LyfUpload.dll

Files

22cf641bf359106a250956234dbee273_JaffaCakes118
.rar
课件发布系统 v3.32 完整版/Aspupload/AspUpload.dll
.dll regsvr32 windows:4 windows x86 arch:x86

08b1c22a6b9b26fa9df2d2797995b935

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FileTimeToLocalFileTime
lstrcmpA
FileTimeToSystemTime
FindClose
FindNextFileW
FindFirstFileW
FindNextFileA
FindFirstFileA
LocalFree
FormatMessageA
GetFullPathNameA
GetFullPathNameW
GetFileAttributesA
GetFileAttributesW
SetFileAttributesA
SetFileAttributesW
MoveFileA
MoveFileW
HeapAlloc
GetProcessHeap
GetFileSize
CreateFileA
CreateFileW
DeleteFileA
DeleteFileW
CopyFileA
CopyFileW
GlobalReAlloc
GlobalFree
SetLastError
SetFileTime
WriteFile
GetFileTime
SystemTimeToFileTime
GetVersion
CreateDirectoryA
RemoveDirectoryA
HeapFree
lstrcatA
lstrcpyA
LoadLibraryA
GetProcAddress
HeapDestroy
IsDBCSLeadByte
lstrcpynA
lstrcmpiA
LoadLibraryExA
GetLastError
FindResourceA
LoadResource
SizeofResource
FreeLibrary
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
GetTickCount
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
GlobalAlloc
lstrlenW
WideCharToMultiByte
GlobalUnlock
GlobalLock
ReadFile
CloseHandle
MultiByteToWideChar
lstrlenA
GetCommandLineA
TerminateProcess
RaiseException
InterlockedExchange
LocalAlloc
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
SetFilePointer
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
HeapSize
GetCurrentProcess
GetOEMCP
GetACP
HeapReAlloc
GetCPInfo
ExitProcess
IsBadWritePtr
VirtualFree
HeapCreate
VirtualAlloc
GetEnvironmentVariableA
GetVersionExA
GetTimeZoneInformation
GetSystemTime
GetLocalTime
RtlUnwind
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue

user32

CharNextA
wsprintfA
LoadStringA
CharUpperA

advapi32

LookupAccountNameA
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
LookupAccountSidA
EqualSid
MakeAbsoluteSD
GetAce
InitializeSecurityDescriptor
GetLengthSid
CopySid
SetSecurityDescriptorOwner
InitializeAcl
AddAce
SetSecurityDescriptorDacl
MakeSelfRelativeSD
SetFileSecurityW
SetFileSecurityA
GetFileSecurityW
GetFileSecurityA
RegEnumValueA
RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
ImpersonateLoggedOnUser
LogonUserA
RevertToSelf

ole32

CoCreateInstance
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
OleCreateFromFile
CreateStreamOnHGlobal
OleConvertIStorageToOLESTREAM
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoDisconnectObject
ProgIDFromCLSID
CLSIDFromProgID

oleaut32

SystemTimeToVariantTime
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreate
CreateErrorInfo
SetErrorInfo
VariantInit
VariantCopy
VariantChangeType
VariantClear
SysAllocString
SysAllocStringLen
SysStringLen
LoadRegTypeLi
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysFreeString

odbc32

ord75
ord43
ord24
ord36
ord31
ord41
ord11
ord9
ord72
ord13

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
课件发布系统 v3.32 完整版/Lyfupload/LyfUpload.dll
.dll regsvr32 windows:4 windows x86 arch:x86

5b498544543d112033c55ad8f1e51186

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvbvm60

__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaAryMove
__vbaStrVarMove
__vbaFreeVarList
__vbaPut3
_adj_fdiv_m64
__vbaFreeObjList
__vbaVarIndexLoadRef
_adj_fprem1
__vbaRecAnsiToUni
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaVarForInit
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaBoolVarNull
_CIsin
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
ord528
__vbaStrCmp
ord529
__vbaVarTstEq
__vbaPutOwner3
__vbaObjVar
__vbaI2I4
DllFunctionCall
__vbaVarLateMemSt
_adj_fpatan
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord608
ord716
__vbaFPException
ord717
__vbaInStrVar
__vbaStrVarVal
__vbaGetOwner3
_CIlog
__vbaErrorOverflow
__vbaFileOpen
ord648
__vbaVar2Vec
ord570
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord101
__vbaVarSetVar
ord102
__vbaI4Var
ord103
__vbaVarCmpEq
ord104
ord105
__vbaLateMemCall
__vbaVarDup
__vbaStrComp
__vbaStrToAnsi
__vbaVarCopy
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaCastObj
ord619
_allmul
_CItan
__vbaVarForNext
_CIexp
__vbaFreeStr

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
课件发布系统 v3.32 完整版/MSSQL/kejian.sql
课件发布系统 v3.32 完整版/doc/Simplified Chinese/eula.txt
课件发布系统 v3.32 完整版/doc/Simplified Chinese/mssql.txt
课件发布系统 v3.32 完整版/doc/Simplified Chinese/newest.txt
课件发布系统 v3.32 完整版/doc/Simplified Chinese/readme.txt
课件发布系统 v3.32 完整版/doc/Traditional Chinese/eula.txt
课件发布系统 v3.32 完整版/doc/Traditional Chinese/mssql.txt
课件发布系统 v3.32 完整版/doc/Traditional Chinese/newest.txt
课件发布系统 v3.32 完整版/doc/Traditional Chinese/readme.txt
课件发布系统 v3.32 完整版/kejian/CONN.ASP
.asp .vbs polyglot
课件发布系统 v3.32 完整版/kejian/addtype.asp
课件发布系统 v3.32 完整版/kejian/addtypeok.asp
课件发布系统 v3.32 完整版/kejian/admincheck.asp
课件发布系统 v3.32 完整版/kejian/admindelcourseware.asp
课件发布系统 v3.32 完整版/kejian/admindelcoursewareok.asp
课件发布系统 v3.32 完整版/kejian/adminindex.asp
课件发布系统 v3.32 完整版/kejian/adminleft.asp
课件发布系统 v3.32 完整版/kejian/adminlogin.asp
课件发布系统 v3.32 完整版/kejian/adminmain.asp
课件发布系统 v3.32 完整版/kejian/adminsearchteacher.asp
课件发布系统 v3.32 完整版/kejian/adminsql.asp
课件发布系统 v3.32 完整版/kejian/adminsqlok.asp
课件发布系统 v3.32 完整版/kejian/adminteacher.asp
课件发布系统 v3.32 完整版/kejian/check.asp
课件发布系统 v3.32 完整版/kejian/config.asp
课件发布系统 v3.32 完整版/kejian/config.inc.asp
课件发布系统 v3.32 完整版/kejian/configok.asp
课件发布系统 v3.32 完整版/kejian/data/data.asp
课件发布系统 v3.32 完整版/kejian/delteacher.asp
课件发布系统 v3.32 完整版/kejian/delteacherok.asp
课件发布系统 v3.32 完整版/kejian/deltype.asp
课件发布系统 v3.32 完整版/kejian/deltypeok.asp
课件发布系统 v3.32 完整版/kejian/detail.asp
课件发布系统 v3.32 完整版/kejian/download.asp
课件发布系统 v3.32 完整版/kejian/edit.asp
.js
课件发布系统 v3.32 完整版/kejian/editinfo.asp
课件发布系统 v3.32 完整版/kejian/editinfook.asp
课件发布系统 v3.32 完整版/kejian/editok.asp
课件发布系统 v3.32 完整版/kejian/editteacher.asp
课件发布系统 v3.32 完整版/kejian/editteacherok.asp
课件发布系统 v3.32 完整版/kejian/edittype.asp
课件发布系统 v3.32 完整版/kejian/edittypeok.asp
课件发布系统 v3.32 完整版/kejian/foot.asp
课件发布系统 v3.32 完整版/kejian/getpwd.asp
课件发布系统 v3.32 完整版/kejian/getpwd2.asp
课件发布系统 v3.32 完整版/kejian/getpwdok.asp
课件发布系统 v3.32 完整版/kejian/head.asp
课件发布系统 v3.32 完整版/kejian/images/arrow.gif
.gif
课件发布系统 v3.32 完整版/kejian/images/bar1.gif
.gif
课件发布系统 v3.32 完整版/kejian/images/bar2.gif
.gif
课件发布系统 v3.32 完整版/kejian/images/bar3.gif
.gif
课件发布系统 v3.32 完整版/kejian/images/bar4.gif
.gif
课件发布系统 v3.32 完整版/kejian/images/bar5.gif
.gif
课件发布系统 v3.32 完整版/kejian/images/close.gif
.gif
课件发布系统 v3.32 完整版/kejian/images/dot.gif
.gif
课件发布系统 v3.32 完整版/kejian/images/download.gif
.gif
课件发布系统 v3.32 完整版/kejian/images/i1.gif
.gif
课件发布系统 v3.32 完整版/kejian/images/logo.gif
.gif
课件发布系统 v3.32 完整版/kejian/index.asp
课件发布系统 v3.32 完整版/kejian/isadmin.asp
课件发布系统 v3.32 完整版/kejian/isteacher.asp
课件发布系统 v3.32 完整版/kejian/language.asp
课件发布系统 v3.32 完整版/kejian/lenmix.asp
课件发布系统 v3.32 完整版/kejian/licence.dat
课件发布系统 v3.32 完整版/kejian/list.asp
课件发布系统 v3.32 完整版/kejian/login.asp
课件发布系统 v3.32 完整版/kejian/logout.asp
课件发布系统 v3.32 完整版/kejian/md5.asp
课件发布系统 v3.32 完整版/kejian/newest.asp
.js
课件发布系统 v3.32 完整版/kejian/num.asp
.vbs
课件发布系统 v3.32 完整版/kejian/numbody.inc
课件发布系统 v3.32 完整版/kejian/numhead.inc
课件发布系统 v3.32 完整版/kejian/pub.asp
.js
课件发布系统 v3.32 完整版/kejian/pubok.asp
课件发布系统 v3.32 完整版/kejian/register.asp
.js
课件发布系统 v3.32 完整版/kejian/registerok.asp
课件发布系统 v3.32 完整版/kejian/score.asp
课件发布系统 v3.32 完整版/kejian/search.asp
课件发布系统 v3.32 完整版/kejian/teacherdelcourseware.asp
课件发布系统 v3.32 完整版/kejian/teacherdelcoursewareok.asp
课件发布系统 v3.32 完整版/kejian/teacherindex.asp
课件发布系统 v3.32 完整版/kejian/teacherinfo.asp
课件发布系统 v3.32 完整版/kejian/teacherleft.asp
课件发布系统 v3.32 完整版/kejian/teacherlist.asp
课件发布系统 v3.32 完整版/kejian/teachermain.asp
课件发布系统 v3.32 完整版/kejian/titlelist.asp
课件发布系统 v3.32 完整版/kejian/unlock.asp
课件发布系统 v3.32 完整版/kejian/unlockok.asp
课件发布系统 v3.32 完整版/kejian/upfile.asp
课件发布系统 v3.32 完整版/kejian/upload.asp
课件发布系统 v3.32 完整版/kejian/upload.inc
.vbs
课件发布系统 v3.32 完整版/language/Simplified Chinese/language.asp
课件发布系统 v3.32 完整版/language/Traditional Chinese/language.asp
课件发布系统 v3.32 完整版/tools/fix123.asp
.vbs
课件发布系统 v3.32 完整版/下载说明.htm
.html .js polyglot

Sharing

General

Malware Config

Signatures

Files

08b1c22a6b9b26fa9df2d2797995b935

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

odbc32

Exports

Exports

Sections

.text Size: 112KB - Virtual size: 111KB

.rdata Size: 16KB - Virtual size: 14KB

.data Size: 20KB - Virtual size: 25KB

.rsrc Size: 20KB - Virtual size: 18KB

.reloc Size: 12KB - Virtual size: 10KB

5b498544543d112033c55ad8f1e51186

Headers

File Characteristics

Imports

msvbvm60

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 19KB

.data Size: 4KB - Virtual size: 980B

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 112KB - Virtual size: 111KB

.rdata
Size: 16KB - Virtual size: 14KB

.data
Size: 20KB - Virtual size: 25KB

.rsrc
Size: 20KB - Virtual size: 18KB

.reloc
Size: 12KB - Virtual size: 10KB

.text
Size: 20KB - Virtual size: 19KB

.data
Size: 4KB - Virtual size: 980B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 1KB