Static task
static1
Behavioral task
behavioral1
Sample
HB_Rescue9850831_ljh.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
HB_Rescue9850831_ljh.exe
Resource
win10v2004-20240704-en
General
-
Target
29dd48a358fc7be93c82a54d1ff41cf0_JaffaCakes118
-
Size
752KB
-
MD5
29dd48a358fc7be93c82a54d1ff41cf0
-
SHA1
90f0a7bba84e2f5581482ac5b222bd376d3e9ecd
-
SHA256
12683afbc8fd525a111302881fdc97aaa596c29b942fd9804a57aa26ae2e650c
-
SHA512
341a510a0592b20c2c3c43ad92e63e4d8b708e7d42247283f6ea1060b70b7af387936b24441de100f2fe9282c4d2a82bb7646d862a012b302219a621963f2b89
-
SSDEEP
12288:tx6/jgo3hgNYxvC6PdiZZU89dsYrEkLCqKcyX73jDo1PxfZm94hnOJhZYOWRf2zx:P6/co3LvXda28LsOLscyzj8PxfS2nOJ5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/HB_Rescue9850831_ljh.EXE
Files
-
29dd48a358fc7be93c82a54d1ff41cf0_JaffaCakes118.rar
-
HB_Rescue9850831_ljh.EXE.exe windows:4 windows x86 arch:x86
bb6386a61989cc313bd6d98078dbe58a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
UuidCreate
RpcStringFreeA
UuidToStringA
urlmon
URLDownloadToFileA
kernel32
WriteFile
SetFilePointer
GetLastError
ReadFile
CreateFileA
FlushFileBuffers
InterlockedIncrement
InterlockedDecrement
lstrlenA
IsBadReadPtr
CloseHandle
CreateEventA
GetTempPathA
RemoveDirectoryA
FindClose
FindNextFileA
DeleteFileA
FindFirstFileA
GetPrivateProfileStringA
GetPrivateProfileIntA
WaitForSingleObject
SetEvent
SetStdHandle
GetCurrentThreadId
GetCommandLineA
lstrlenW
MultiByteToWideChar
GetShortPathNameA
GetModuleHandleA
GetModuleFileNameA
WideCharToMultiByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcpynA
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
GetProcAddress
LoadLibraryA
lstrcpyA
lstrcatA
DebugBreak
SetHandleCount
IsBadCodePtr
lstrcmpiA
SetUnhandledExceptionFilter
CreateProcessA
CreateDirectoryA
OutputDebugStringA
RtlUnwind
GetACP
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
GetVersionExA
GetEnvironmentVariableA
LCMapStringW
LCMapStringA
GetOEMCP
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetFileType
GetStdHandle
GetCPInfo
HeapReAlloc
HeapAlloc
HeapSize
RaiseException
GetStringTypeA
GetStringTypeW
HeapFree
GetStartupInfoA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
user32
CharNextA
LoadStringA
CharLowerA
wvsprintfA
advapi32
RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegEnumValueA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
ole32
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoInitialize
CoUninitialize
oleaut32
RegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
VarUI4FromStr
Sections
.text Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
下载说明.htm.html .js polyglot
-
汉化新世纪.txt
-
汉化说明.txt