Static task
static1
Behavioral task
behavioral1
Sample
ha-123dvdconv-tem.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
ha-123dvdconv-tem.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20240709-en
General
-
Target
416fa1365cc2917382d55139bb7dd38e_JaffaCakes118
-
Size
4.9MB
-
MD5
416fa1365cc2917382d55139bb7dd38e
-
SHA1
c451b0f51449035ff6b4066ce0258155b5995c9b
-
SHA256
3259cea7a1a88c62db5e33b01ecd741842d1d496444ae256de621faba55c1902
-
SHA512
59391159724c3ed67b196cf25e9a1f5d7ba72e848167ce0d546d84100d0183d951f4e156f171f1fc6c0de6db1a36c1f67f0dd833a66186e6a2b62d302fe1a971
-
SSDEEP
98304:QGTdD3FfDMhzCOo10/SlVuU6dquxBgtK7ek9v6virvT4eXloZfB++b0g/rDK4E+f:TKzfo10/SlVfuXF7V9v6viwl5bTq45f
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ha-123dvdconv-tem.exe
Files
-
416fa1365cc2917382d55139bb7dd38e_JaffaCakes118.rar
-
ha-123dvdconv-tem.exe.exe windows:5 windows x86 arch:x86
82d1f3d0b4106ad2c25aedb56caf6935
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTempPathA
DeleteFileA
GetSystemDefaultLangID
GetFileSize
GetCurrentProcess
FormatMessageA
WriteFile
LeaveCriticalSection
ReadFile
FlushInstructionCache
SetCurrentDirectoryA
SetLastError
EnterCriticalSection
GetCurrentThreadId
GetVersionExA
GetModuleFileNameA
WaitForSingleObject
GetTickCount
GetExitCodeProcess
CreateProcessA
GetEnvironmentVariableA
GetCurrentDirectoryA
CompareStringA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
DebugBreak
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
Sleep
GetStdHandle
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapSize
HeapReAlloc
HeapCreate
GetStartupInfoA
GetCommandLineA
CloseHandle
OutputDebugStringA
GetModuleHandleA
FindNextFileA
GetDiskFreeSpaceA
ExitProcess
LoadLibraryA
FindClose
SetFileAttributesA
RemoveDirectoryA
GetProcAddress
GetLastError
FindFirstFileA
CreateDirectoryA
RaiseException
lstrlenW
MultiByteToWideChar
GetSystemDirectoryA
WideCharToMultiByte
GetWindowsDirectoryA
SetFileTime
InterlockedDecrement
InterlockedIncrement
FreeLibrary
lstrlenA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
DeleteCriticalSection
InitializeCriticalSection
CreateFileA
LCMapStringA
VirtualQuery
user32
LoadStringA
CharNextA
wvsprintfA
UnregisterClassA
GetWindow
MsgWaitForMultipleObjects
CharUpperA
SetCursor
SetTimer
GetWindowRect
SendDlgItemMessageA
FillRect
KillTimer
GetParent
wsprintfA
GetClientRect
GetWindowTextLengthA
SendMessageA
GetMonitorInfoA
TranslateMessage
GetWindowTextA
SetWindowLongA
MessageBoxA
InvalidateRect
GetWindowLongA
PeekMessageA
MonitorFromWindow
GetDlgItem
EndDialog
RedrawWindow
DestroyCursor
GetDesktopWindow
SetWindowPos
CheckDlgButton
EnumChildWindows
ShowWindow
GetSysColorBrush
IsDlgButtonChecked
IsWindow
DispatchMessageA
GetSystemMetrics
SetWindowTextA
LoadImageA
MapWindowPoints
EnableWindow
LoadCursorA
GetDlgCtrlID
GetDlgItemTextA
DialogBoxParamA
SetDlgItemTextA
gdi32
AddFontResourceA
BitBlt
SetTextColor
DeleteDC
CreateDIBSection
StretchBlt
CreateFontIndirectA
SetBkMode
DeleteObject
CreateCompatibleDC
SetStretchBltMode
GetObjectA
GetStockObject
CreateSolidBrush
SelectObject
advapi32
OpenSCManagerA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
CloseServiceHandle
CreateServiceW
RegCloseKey
shell32
SHGetMalloc
SHGetPathFromIDListA
ShellExecuteExA
SHGetSpecialFolderLocation
SHBrowseForFolderA
ole32
CLSIDFromProgID
StringFromGUID2
OleInitialize
OleUninitialize
CoCreateInstance
oleaut32
SysAllocString
SysAllocStringByteLen
VarBstrCmp
SysAllocStringLen
SysStringByteLen
SysFreeString
SysStringLen
BstrFromVector
VariantClear
VariantCopyInd
LoadTypeLi
VariantCopy
VariantInit
VariantChangeType
RegisterTypeLi
comctl32
ord17
Sections
.text Size: 113KB - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
新云软件.url.url