shdocvw.pdb
Static task
static1
Behavioral task
behavioral1
Sample
网易邮箱未注册账号批量检测V1.0/shdocvw.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
网易邮箱未注册账号批量检测V1.0/shdocvw.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
网易邮箱未注册账号批量检测V1.0/网易邮箱未注册账号批量检测V1.0.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
网易邮箱未注册账号批量检测V1.0/网易邮箱未注册账号批量检测V1.0.exe
Resource
win10v2004-20240709-en
General
-
Target
36a1aa4a3ab44351aec007ee7bfadb24_JaffaCakes118
-
Size
673KB
-
MD5
36a1aa4a3ab44351aec007ee7bfadb24
-
SHA1
fb71a10b40077c7a1a3329d367ba678620c1b774
-
SHA256
ba8aae5fedb6170fb0de8e209859c227102fbf5937ed524af80816aae08f3e51
-
SHA512
fb2a788d6e6f0a2ec8d85f8e95874e724ff1d6c479433fdebe0d5c0980a9a7b7a9cf928a74c85da8241af6870acda2e20bdb9d64032b26bcf3a464048b822dba
-
SSDEEP
12288:/QT+l39ooqOq+jQh91B1ZPlhqVGZY5me6nAoyAPP3/FUWjK03qLT59tF:4TE9+O8FZtEVpmfnlyAnPFUWF3qJ9tF
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/网易邮箱未注册账号批量检测V1.0/shdocvw.dll unpack001/网易邮箱未注册账号批量检测V1.0/网易邮箱未注册账号批量检测V1.0.exe
Files
-
36a1aa4a3ab44351aec007ee7bfadb24_JaffaCakes118.rar
-
网易邮箱未注册账号批量检测V1.0/ID.txt
-
网易邮箱未注册账号批量检测V1.0/shdocvw.dll.dll regsvr32 windows:5 windows x86 arch:x86
0d6677bd38343051a2b410e44d28157e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_onexit
__dllonexit
_adjust_fdiv
_initterm
_ftol
wcslen
free
_vsnprintf
_except_handler3
_wcsnicmp
wcsrchr
_ltow
memmove
malloc
realloc
_vsnwprintf
kernel32
GetSystemDefaultLCID
CreateThread
CompareFileTime
GetSystemTimeAsFileTime
IsDBCSLeadByte
CreateDirectoryA
SetCurrentDirectoryA
SetFilePointer
ReadFile
GetFileSize
WriteFile
FindClose
WaitForSingleObject
SetEvent
CreateFileA
ReleaseMutex
LocalFileTimeToFileTime
SystemTimeToFileTime
GetTempPathA
ExitProcess
GetCommandLineW
OpenMutexW
TlsGetValue
GetSystemTime
GetCurrentProcessId
GlobalFlags
lstrcmpiA
GlobalReAlloc
TlsSetValue
GetLocalTime
GetSystemInfo
OpenMutexA
ReleaseSemaphore
UnhandledExceptionFilter
SetErrorMode
GetCurrentDirectoryA
GetShortPathNameA
ResetEvent
HeapFree
GetProcessHeap
InterlockedExchange
TerminateThread
GetExitCodeThread
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
FileTimeToLocalFileTime
HeapAlloc
GetLocaleInfoW
LoadLibraryW
DosDateTimeToFileTime
GetModuleHandleW
CreateEventA
LoadLibraryA
VirtualFree
VirtualAlloc
lstrcpynW
GetModuleHandleA
GetProcAddress
LocalFree
LocalAlloc
MultiByteToWideChar
GetVersionExA
lstrcmpA
GetSystemDirectoryA
LocalReAlloc
GetDriveTypeW
CreateMutexA
lstrlenA
Sleep
WideCharToMultiByte
lstrcpynA
GetUserDefaultLCID
GlobalFree
LocalSize
GetTickCount
GetLastError
LoadLibraryExA
SetLastError
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
lstrlenW
GlobalAlloc
GlobalLock
GlobalUnlock
HeapDestroy
EnterCriticalSection
LeaveCriticalSection
MulDiv
DisableThreadLibraryCalls
InitializeCriticalSection
TlsAlloc
GetACP
CloseHandle
TlsFree
DeleteCriticalSection
FreeLibrary
InterlockedDecrement
FileTimeToSystemTime
InterlockedIncrement
RaiseException
GlobalSize
shlwapi
ord81
ord561
ord231
wnsprintfW
ord24
ord516
ord517
ord446
SHDeleteKeyW
ord491
ord176
ord204
ord509
ord172
ord199
ord164
StrCpyNW
ord117
SHRegGetBoolUSValueW
ord163
ord133
ord154
ord240
ord178
ord84
ord171
ord249
PathCreateFromUrlW
StrChrW
ord346
ord184
SHStrDupW
ord212
ord174
ord284
ord282
PathFileExistsW
ord384
ord287
ord83
ord318
SHRegGetUSValueW
StrCmpNIW
StrStrIW
StrDupW
ord15
SHQueryValueExW
ord120
ord302
ord192
ord303
ord139
ord558
ord564
ord436
ord128
ord125
ord123
ord193
PathQuoteSpacesW
ord75
PathCombineW
ord97
ord299
PathRemoveFileSpecW
ord60
ord116
ord394
ord538
ord149
ord135
ord74
ord104
ord389
ord426
ord427
ord425
ord106
ord108
ord401
ord402
StrCatBuffW
ord57
ord80
ord542
UrlCanonicalizeW
AssocQueryStringW
ord124
SHRegCloseUSKey
SHRegDeleteUSValueW
SHRegOpenUSKeyW
StrDupA
ord122
ord13
ord175
ord127
StrCmpW
StrCmpNW
ord158
ord562
ord146
ord40
PathUnquoteSpacesW
PathRemoveBlanksW
ord539
ord186
ord181
ord237
ord217
ord382
ord168
SHRegSetUSValueW
ord221
ord173
ord220
ord248
ord198
ord79
ord467
ord100
ord2
ord484
ord383
StrStrW
StrChrIW
UrlGetPartW
PathAppendW
ord559
ord138
StrFromTimeIntervalW
ord336
ord99
ord143
ord67
ord216
PathFindExtensionA
UrlCanonicalizeA
ord218
AssocIsDangerous
AssocCreate
ord130
PathUndecorateW
ord103
ord313
PathParseIconLocationW
ord52
ord165
ord16
PathCompactPathW
ord331
ord72
PathIsRelativeW
ord476
ord134
ord87
ord140
PathRemoveExtensionW
ord334
ord50
ord333
PathCommonPrefixW
UrlIsW
StrTrimW
ord36
PathAddBackslashW
SHQueryValueExA
StrCatBuffA
StrStrIA
PathFindFileNameA
StrCmpNIA
SHSetValueA
wnsprintfA
SHGetValueA
ord126
SHDeleteOrphanKeyA
PathRemoveFileSpecA
SHDeleteKeyA
SHDeleteValueA
ord433
SHDeleteValueW
ord294
ord90
ord129
StrToIntExW
ord372
ord373
ord371
ord286
UrlCombineW
ord376
UrlGetLocationW
StrToIntW
ord283
ord281
PathIsURLW
ord51
ord28
ord39
UrlHashW
StrRChrW
StrChrIA
ord41
ord351
ord350
wvnsprintfA
ord65
ord341
ord403
ord360
ord137
ord305
ord71
wvnsprintfW
SHOpenRegStream2W
ord187
ord471
ord270
ord263
PathIsPrefixW
PathSearchAndQualifyW
ord73
ord298
ord296
PathRenameExtensionW
ord12
ord112
ord89
ord236
ord96
ord354
ord370
ord274
ord460
ord76
StrTrimA
ord295
ord98
ord260
ord49
PathCombineA
PathGetArgsW
ord347
ord366
ord121
ord43
ord362
SHRegDuplicateHKey
ord551
ord195
ord197
ord61
ord91
ord53
ord312
StrRetToBufW
ord279
ord479
StrPBrkW
ord113
SHCreateStreamOnFileW
PathCompactPathExW
ord338
ord142
ord182
ord428
ord132
ord355
SHSkipJunction
ord269
ord342
AssocQueryKeyW
PathIsContentTypeW
UrlEscapeW
ord316
PathCanonicalizeW
UrlCreateFromPathW
ord206
ord242
ord243
ord167
ord189
ord188
ord520
ord505
ord507
ord506
ord101
ord93
ord280
ord10
ord9
ord8
ord278
ord105
ord439
StrToIntExA
UrlUnescapeA
ord477
SHRegEnumUSValueW
UrlApplySchemeW
ord462
UrlIsNoHistoryW
StrCSpnW
StrSpnW
ord85
ord367
ord368
ord214
ord310
PathRemoveExtensionA
HashData
UrlUnescapeW
ord496
ord266
ord223
ord222
ord423
ord353
ord319
PathIsURLA
PathRemoveBackslashW
ord375
ord458
ord434
PathCreateFromUrlA
ord357
PathIsFileSpecW
PathIsDirectoryW
PathIsUNCW
SHAutoComplete
ord145
ord480
ord311
ord563
StrFormatKBSizeW
ChrCmpIW
ord229
ord560
SHRegGetValueW
ord157
StrRetToStrW
ord540
PathGetDriveNumberW
ord289
ord267
ord268
ord534
ord1
ord335
ord219
PathFindExtensionW
PathFindFileNameW
ord55
ord315
ord102
ord314
ord37
ord304
ord48
ord131
ord56
ord136
ord141
ord94
ord156
ord161
ord437
ord241
SHCreateShellPalette
ord239
ord461
ord309
SHSetValueW
SHGetValueW
StrCmpIW
ord68
ord95
ord340
ord418
ord549
ord276
ord406
ord416
ord398
ord414
ord107
ord378
ord431
ord215
StrFormatByteSizeW
PathIsUNCServerShareW
PathStripToRootW
ord59
AssocGetPerceivedType
ord352
gdi32
DeleteObject
DeleteDC
SetViewportOrgEx
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
GetDeviceCaps
CreateRectRgnIndirect
DeleteMetaFile
CloseMetaFile
SetWindowExtEx
SetPaletteEntries
GetPaletteEntries
RealizePalette
SelectPalette
GetStockObject
CreatePalette
SetBkColor
SetBkMode
SetTextColor
SelectObject
GetTextExtentPointW
IntersectClipRect
CreateDCA
CloseEnhMetaFile
CreateEnhMetaFileA
LineTo
MoveToEx
Rectangle
StretchBlt
CreateCompatibleDC
BitBlt
GetTextCharset
CreateCompatibleBitmap
GetTextExtentPoint32W
RestoreDC
user32
PtInRect
UnionRect
ReleaseDC
GetDC
SetWindowRgn
OffsetRect
EqualRect
IntersectRect
EndPaint
BeginPaint
IsChild
GetFocus
IsWindow
DestroyAcceleratorTable
GetKeyState
InvalidateRect
wsprintfW
SetFocus
GetParent
EndDialog
GetWindowLongA
IsWindowEnabled
SetCursor
SetForegroundWindow
SetRect
IsWindowVisible
GetLastActivePopup
GetCapture
GetMenuItemCount
TranslateMessage
ChildWindowFromPointEx
ScreenToClient
GetDlgCtrlID
IsDlgButtonChecked
EnableMenuItem
CheckMenuItem
GetMenuItemID
GetSubMenu
CheckDlgButton
CheckRadioButton
EnableWindow
GetDlgItem
GetDesktopWindow
RemoveMenu
GetMenuState
CreateMenu
MessageBeep
InflateRect
MoveWindow
PostQuitMessage
MapWindowPoints
WaitMessage
GetAsyncKeyState
GetSystemMenu
CreatePopupMenu
SetParent
GetWindow
AdjustWindowRect
GetSysColor
GetNextDlgTabItem
CheckMenuRadioItem
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
MsgWaitForMultipleObjects
IsIconic
SetWindowPlacement
GetWindowPlacement
DdeCreateDataHandle
DdeDisconnect
DdeClientTransaction
DdeConnect
DdeFreeStringHandle
DdeUninitialize
DdeNameService
GetForegroundWindow
DdeFreeDataHandle
DdeGetData
CharLowerBuffA
RegisterWindowMessageA
CharNextA
GetActiveWindow
EnumWindows
ChildWindowFromPoint
SetMenuDefaultItem
GetMenuDefaultItem
GetSystemMetrics
SystemParametersInfoA
DrawIconEx
ChangeClipboardChain
SetClipboardViewer
CopyRect
IsRectEmpty
UpdateWindow
GetMessagePos
GetDoubleClickTime
SetRectEmpty
CallNextHookEx
UnhookWindowsHookEx
GetWindowThreadProcessId
SetWindowLongA
SendMessageTimeoutA
LoadMenuA
LoadMenuW
InsertMenuA
InsertMenuW
DrawFocusRect
ShowWindowAsync
GetShellWindow
ReleaseCapture
SetCapture
GetWindowDC
TrackMouseEvent
GetCursorPos
CharNextW
RegisterClipboardFormatW
DrawTextExW
SendMessageW
SetWindowTextW
SetTimer
GetSysColorBrush
FillRect
GetWindowRect
RedrawWindow
DestroyWindow
GetClientRect
AdjustWindowRectEx
SetWindowPos
KillTimer
ShowWindow
DestroyIcon
LoadStringA
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegOpenKeyExW
RegQueryValueExW
RegEnumValueA
crypt32
CryptQueryObject
CryptMsgGetParam
CertCloseStore
CryptMsgClose
cryptui
CryptUIDlgViewSignerInfoW
Exports
Exports
AddUrlToFavorites
DllCanUnloadNow
DllGetClassObject
DllGetVersion
DllInstall
DllRegisterServer
DllRegisterWindowClasses
DllUnregisterServer
DoAddToFavDlg
DoAddToFavDlgW
DoFileDownload
DoFileDownloadEx
DoOrganizeFavDlg
DoOrganizeFavDlgW
DoPrivacyDlg
HlinkFindFrame
HlinkFrameNavigate
HlinkFrameNavigateNHL
IEWriteErrorLog
ImportPrivacySettings
OpenURL
SHAddSubscribeFavorite
SHGetIDispatchForFolder
SetQueryNetSessionCount
SetShellOfflineState
SoftwareUpdateMessageBox
URLQualifyA
URLQualifyW
Sections
.text Size: 855KB - Virtual size: 855KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 904KB - Virtual size: 903KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
网易邮箱未注册账号批量检测V1.0/使用说明.txt
-
网易邮箱未注册账号批量检测V1.0/已被注册的ID.txt
-
网易邮箱未注册账号批量检测V1.0/网易邮箱未注册账号批量检测V1.0.exe.exe windows:4 windows x86 arch:x86
f379d4c6b6dfda7c2b46c6993e7eb0dc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaLineInputStr
__vbaLateIdCall
__vbaStrVarMove
__vbaFreeVarList
_adj_fdiv_m64
_adj_fprem1
__vbaStrCat
__vbaVarCmpNe
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaLateMemSt
ord595
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaBoolVarNull
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
ord527
__vbaStrCmp
__vbaVarTstEq
__vbaObjVar
_adj_fpatan
__vbaLateIdCallLd
EVENT_SINK_Release
ord600
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaPrintFile
_adj_fprem
_adj_fdivr_m64
__vbaFPException
__vbaInStrVar
__vbaStrVarVal
__vbaVarCat
__vbaI2Var
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaNew2
__vbaVarLateMemCallLdRf
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaLateMemCall
__vbaVarDup
__vbaVarLateMemCallLd
__vbaLateMemCallLd
_CIatan
__vbaStrMove
ord619
_allmul
_CItan
_CIexp
__vbaFreeObj
__vbaFreeStr
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ