Static task
static1
Behavioral task
behavioral1
Sample
使用帮助.chm
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
使用帮助.chm
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
软件加弹窗工具V5.0.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
软件加弹窗工具V5.0.exe
Resource
win10v2004-20240709-en
General
-
Target
3c113aa49aa79029828e73a936571718_JaffaCakes118
-
Size
4.3MB
-
MD5
3c113aa49aa79029828e73a936571718
-
SHA1
8cb22bd2444aa77ecde6f43e270d2168dea2e601
-
SHA256
a43d9b17e3ce5c7a1c6865ca7f03e79392d862542b08953640359e2485e0b30d
-
SHA512
b770064a711c13c0818917f99865bbabc88b431c276f1cb5b425658bc84764d45a850cb344fa154ec028402728905af2b0669e8d2aa44d578a4e5e742fafd5f0
-
SSDEEP
98304:F9CqHYEX+DqKp716V2DsvJQN4QSc3rtQiS/qNsJUgGMptytGwyrsI:FgiKpwV2YJQNS2rSiS/OmdGMpoByrF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/软件加弹窗工具V5.0.exe
Files
-
3c113aa49aa79029828e73a936571718_JaffaCakes118.rar
-
使用帮助.chm.chm
-
新云软件.url.url
-
软件加弹窗工具V5.0.exe.exe windows:4 windows x86 arch:x86
41eb7ade5f04e4606cccf9b8840c0770
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
TerminateProcess
GetTimeZoneInformation
GetSystemTime
GetStartupInfoA
GetCommandLineA
HeapFree
HeapAlloc
RaiseException
GetACP
HeapReAlloc
HeapSize
SetStdHandle
GetFileType
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetEnvironmentVariableA
RtlUnwind
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetDriveTypeA
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetTickCount
GetProfileStringA
InterlockedExchange
SetErrorMode
GetOEMCP
GetCPInfo
GetProcessVersion
WritePrivateProfileStringA
GlobalFlags
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LocalAlloc
EnterCriticalSection
FileTimeToLocalFileTime
FileTimeToSystemTime
FormatMessageA
LocalFree
GetThreadLocale
GetFullPathNameA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
GetCurrentProcess
DuplicateHandle
GetFileTime
GetFileSize
GetFileAttributesA
lstrcpynA
FindNextFileA
FindFirstFileA
GetLastError
FindClose
MulDiv
SetLastError
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
InterlockedIncrement
InterlockedDecrement
LoadLibraryA
FreeLibrary
GetVersion
lstrcatA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
lstrcpyA
GetModuleHandleA
GetProcAddress
WaitForSingleObject
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
GetCurrentThreadId
GetModuleFileNameA
GlobalLock
GlobalUnlock
GlobalAlloc
GlobalFree
GetVolumeInformationA
GetLocalTime
Sleep
GetCurrentDirectoryA
FindResourceA
LoadResource
LockResource
CreateFileA
SizeofResource
WriteFile
CloseHandle
GetTempPathA
DeleteFileA
GetVersionExA
WinExec
user32
CopyAcceleratorTableA
SetRect
GetNextDlgGroupItem
MessageBeep
InvalidateRect
InflateRect
RegisterClipboardFormatA
PostThreadMessageA
CopyRect
GetTopWindow
IsChild
GetCapture
WinHelpA
wsprintfA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetWindowTextLengthA
GetWindowTextA
GetDlgCtrlID
CreateWindowExA
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
CharNextA
RegisterWindowMessageA
OffsetRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
MapDialogRect
SetWindowPos
GetWindow
SetWindowContextHelpId
EndDialog
SetActiveWindow
IsWindow
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
PeekMessageA
GetCursorPos
SetWindowsHookExA
GetParent
GetLastActivePopup
IsWindowEnabled
LoadIconA
SendMessageA
AppendMenuA
UnregisterClassA
HideCaret
ShowCaret
ExcludeUpdateRgn
DrawFocusRect
GetWindowLongA
MessageBoxA
SetCursor
PostQuitMessage
PostMessageA
EnableWindow
IsIconic
GetSysColorBrush
PtInRect
GetClassNameA
SetWindowLongA
GetSystemMetrics
GetClientRect
DefDlgProcA
IsWindowUnicode
GetSystemMenu
DrawIcon
LoadCursorA
GetDesktopWindow
CharUpperA
ScreenToClient
DrawTextA
TabbedTextOutA
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
DestroyMenu
LoadStringA
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
UpdateWindow
SendDlgItemMessageA
MapWindowPoints
GetSysColor
GetMenuState
SetFocus
IntersectRect
AdjustWindowRectEx
GrayStringA
gdi32
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
IntersectClipRect
DeleteObject
GetDeviceCaps
GetViewportExtEx
GetWindowExtEx
CreateSolidBrush
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetTextColor
GetBkColor
DPtoLP
LPtoDP
GetMapMode
PatBlt
SetBkMode
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
GetObjectA
SetBkColor
SetTextColor
GetClipBox
CreateDIBitmap
GetTextExtentPointA
BitBlt
CreateCompatibleDC
CreateBitmap
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
DocumentPropertiesA
OpenPrinterA
advapi32
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegSetValueExA
comctl32
ord17
oledlg
ord8
ole32
OleInitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
OleUninitialize
CoGetClassObject
olepro32
ord253
oleaut32
SysAllocStringLen
VariantClear
VariantCopy
SysAllocString
SysAllocStringByteLen
VariantChangeType
VariantTimeToSystemTime
SysStringLen
SysFreeString
Sections
.text Size: 160KB - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
软件加弹窗工具使用教程.mp4