Static task
static1
Behavioral task
behavioral1
Sample
PerfectSoundRecorder_6b6_WestKing_HAP.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
PerfectSoundRecorder_6b6_WestKing_HAP.exe
Resource
win10v2004-20240704-en
General
-
Target
306e777a6abb18be2b5752fc93d3fe53_JaffaCakes118
-
Size
2.0MB
-
MD5
306e777a6abb18be2b5752fc93d3fe53
-
SHA1
707202184788f183d1f4990a12ef764aea3ae0b2
-
SHA256
c899495e30dfe5f90a9272c60ed1eb147f7fcb448e5de3980c34ec012650df60
-
SHA512
bbbc33ae56c4e16be742386344e096e3de84de2a59abd0d898926a33c06a5ea11be5193bfb40c777e38ffe306ac4e6e9fe6f3156c7b894e7b11ac3241e7e1305
-
SSDEEP
49152:avP9M5OLgKGFSpsjxxBlOvjzm3Od+4NBHjRmKeyvLhj5H/jnreOG:avlCOLCFSpaxxPOvGoTHHjRmlYjF31G
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/PerfectSoundRecorder_6b6_WestKing_HAP.exe
Files
-
306e777a6abb18be2b5752fc93d3fe53_JaffaCakes118.rar
-
PerfectSoundRecorder_6b6_WestKing_HAP.exe.exe windows:4 windows x86 arch:x86
22b1d33cc59791fd53b4a9983e84da85
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
SHGetValueA
SHSetValueA
kernel32
FreeResource
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
GetShortPathNameA
CreateDirectoryA
lstrlenA
InterlockedDecrement
GetVersionExA
GetModuleFileNameA
GetTempPathA
WinExec
DeleteFileA
WaitForSingleObject
GetWindowsDirectoryA
GetStartupInfoA
FindResourceA
LoadResource
SizeofResource
LockResource
GetEnvironmentVariableA
GetModuleHandleA
user32
GetPropA
RemovePropA
GetCursorPos
PtInRect
LoadCursorA
SetCursor
TrackMouseEvent
InvalidateRect
GetParent
PostMessageA
DefWindowProcA
ShowWindow
CopyRect
ClientToScreen
GetDC
DrawTextA
ReleaseDC
SetPropA
SetWindowLongA
UpdateWindow
DialogBoxParamA
SendMessageA
IsWindow
CheckDlgButton
BeginPaint
GetClientRect
FillRect
EndPaint
EndDialog
IsDlgButtonChecked
LoadStringA
GetDlgItem
GetWindowRect
ScreenToClient
GetWindowTextA
gdi32
GetStockObject
CreateFontIndirectA
GetObjectA
DeleteObject
SelectObject
SetTextColor
SetBkMode
GetDeviceCaps
shell32
ShellExecuteA
ShellExecuteExA
ole32
CreateStreamOnHGlobal
oleaut32
OleLoadPicture
msvcrt
strrchr
strncpy
_snprintf
fopen
fwrite
fclose
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
??3@YAXPAX@Z
__CxxFrameHandler
strstr
??2@YAPAXI@Z
_acmdln
free
malloc
_except_handler3
__dllonexit
_onexit
_exit
_XcptFilter
__set_app_type
__p__fmode
__p__commode
exit
_controlfp
Sections
.text Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
下载说明.htm.html .js polyglot
-
汉化新世纪.txt
-
汉化说明.txt