Static task
static1
Behavioral task
behavioral1
Sample
AnyDWGtoPDF_Pro_2005_WestKing_HAP.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
AnyDWGtoPDF_Pro_2005_WestKing_HAP.exe
Resource
win10v2004-20240704-en
General
-
Target
28bd5909c18f045eaa3155217fc3a334_JaffaCakes118
-
Size
5.1MB
-
MD5
28bd5909c18f045eaa3155217fc3a334
-
SHA1
1412f63c51ce094485f044306d58c5a1899ec6f3
-
SHA256
72f37e6dee4934facfdcace48226b74d72fd4c12d2178e8b12d1667cccc3f4c4
-
SHA512
c9591f42b4bf89f60e0d87082d8a1f4a17d5d7ec3ea56e75a91cab638de64f8821bc3fc85c32e64070f8be141a1a3870f22ad4a6de01dc1f296100f1f2d6d935
-
SSDEEP
98304:Pcg7z/MvOKNPHsYgE73JU67ZhJWwVEvbiqZpMYP1aI9NVS7WbBRQKPc2Wh1F76e:Pcg7zMvxBWEbO6fYwOWgpRpPiuNWUe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/AnyDWGtoPDF_Pro_2005_WestKing_HAP.exe
Files
-
28bd5909c18f045eaa3155217fc3a334_JaffaCakes118.rar
-
AnyDWGtoPDF_Pro_2005_WestKing_HAP.exe.exe windows:4 windows x86 arch:x86
22b1d33cc59791fd53b4a9983e84da85
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
SHGetValueA
SHSetValueA
kernel32
FreeResource
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
GetShortPathNameA
CreateDirectoryA
lstrlenA
InterlockedDecrement
GetVersionExA
GetModuleFileNameA
GetTempPathA
WinExec
DeleteFileA
WaitForSingleObject
GetWindowsDirectoryA
GetStartupInfoA
FindResourceA
LoadResource
SizeofResource
LockResource
GetEnvironmentVariableA
GetModuleHandleA
user32
GetPropA
RemovePropA
GetCursorPos
PtInRect
LoadCursorA
SetCursor
TrackMouseEvent
InvalidateRect
GetParent
PostMessageA
DefWindowProcA
ShowWindow
CopyRect
ClientToScreen
GetDC
DrawTextA
ReleaseDC
SetPropA
SetWindowLongA
UpdateWindow
DialogBoxParamA
SendMessageA
IsWindow
CheckDlgButton
BeginPaint
GetClientRect
FillRect
EndPaint
EndDialog
IsDlgButtonChecked
LoadStringA
GetDlgItem
GetWindowRect
ScreenToClient
GetWindowTextA
gdi32
GetStockObject
CreateFontIndirectA
GetObjectA
DeleteObject
SelectObject
SetTextColor
SetBkMode
GetDeviceCaps
shell32
ShellExecuteA
ShellExecuteExA
ole32
CreateStreamOnHGlobal
oleaut32
OleLoadPicture
msvcrt
strrchr
strncpy
_snprintf
fopen
fwrite
fclose
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
??3@YAXPAX@Z
__CxxFrameHandler
strstr
??2@YAPAXI@Z
_acmdln
free
malloc
_except_handler3
__dllonexit
_onexit
_exit
_XcptFilter
__set_app_type
__p__fmode
__p__commode
exit
_controlfp
Sections
.text Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
下载说明.htm.html .js polyglot
-
汉化新世纪.txt
-
汉化说明.txt