Static task
static1
Behavioral task
behavioral1
Sample
hvc2.7_cn_060515.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
hvc2.7_cn_060515.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
非常世纪资源网.url
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
非常世纪资源网.url
Resource
win10v2004-20240709-en
General
-
Target
44b7372bc2b527c84889983a8c9243a6_JaffaCakes118
-
Size
12.9MB
-
MD5
44b7372bc2b527c84889983a8c9243a6
-
SHA1
e2e82f1c229dc48607344ef575eeb618ccf2289c
-
SHA256
e2194fa337543fa0a7985cd32ecbeb772b94509ccf765fb738e03303822622e1
-
SHA512
eb058d95d857fc3ce984102d81ed1dc2a989dbced870d428aba02112e9c8aa396063e8eb7df4792d05f27d02a941c01820d42e3349274a06e68cb7e1bda9fd2c
-
SSDEEP
393216:XE7U8UjU+w/Y4RfyWfEheAxt81n+rNLlY:Xv8UEQ4R7fEhrv8Ard+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/hvc2.7_cn_060515.exe
Files
-
44b7372bc2b527c84889983a8c9243a6_JaffaCakes118.rar
-
hvc2.7_cn_060515.exe.exe windows:4 windows x86 arch:x86
774de2cf8feef846bca7568f7cbdd5aa
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
_lcreat
GetTempPathA
GetCurrentDirectoryA
_lwrite
GetFullPathNameA
LoadLibraryExW
CreateDirectoryA
SetCurrentDirectoryA
LoadLibraryExA
LoadLibraryW
Sleep
WideCharToMultiByte
DeleteCriticalSection
IsBadReadPtr
WriteProcessMemory
GetCurrentProcess
LoadLibraryA
InitializeCriticalSection
MultiByteToWideChar
SetFileAttributesA
FindNextFileA
WritePrivateProfileStringA
RemoveDirectoryA
GetTickCount
GetDiskFreeSpaceA
CreateThread
CloseHandle
ResumeThread
SuspendThread
FlushFileBuffers
WinExec
GetVersion
GetACP
CreateEventA
OpenEventA
GetSystemDirectoryA
FindFirstFileA
FindClose
GetModuleFileNameA
_lclose
_llseek
_lread
_lopen
GetFileSize
lstrcmpiA
lstrlenA
lstrcpyA
GetWindowsDirectoryA
lstrcatA
LocalFree
DeleteFileA
GetPrivateProfileIntA
FreeLibrary
GetProcAddress
GetModuleHandleA
OpenFile
VirtualAlloc
SetUnhandledExceptionFilter
WriteFile
VirtualFree
LocalAlloc
HeapDestroy
GetStdHandle
HeapCreate
SetHandleCount
GetOEMCP
GetFileType
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCPInfo
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetEnvironmentStrings
ExitProcess
HeapAlloc
TerminateProcess
GetCommandLineA
GetStartupInfoA
HeapFree
IsBadWritePtr
IsBadCodePtr
RtlUnwind
HeapReAlloc
HeapSize
user32
SetDlgItemTextA
GetCursorPos
ScreenToClient
EnableWindow
ShowWindow
GetDlgItem
GetWindowRect
SetWindowPos
PostMessageA
MoveWindow
ReleaseDC
DrawIcon
GetDC
IsDlgButtonChecked
KillTimer
LoadCursorA
GetClassLongA
LoadIconA
SendMessageA
LoadStringA
wsprintfA
UpdateWindow
RegisterClassA
CreateWindowExA
BeginPaint
GetClientRect
DefWindowProcA
GetMessageA
EndPaint
PostQuitMessage
TranslateMessage
IsWindow
IsDialogMessageA
DialogBoxParamA
DispatchMessageA
EndDialog
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
MessageBoxA
SetClassLongA
GetDesktopWindow
GetDlgItemTextA
CheckDlgButton
gdi32
DeleteObject
StretchDIBits
RealizePalette
SelectPalette
CreatePalette
SetStretchBltMode
advapi32
RegSetValueA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyA
RegOpenKeyA
RegQueryValueA
RegDeleteKeyA
RegEnumKeyA
shell32
SHGetSpecialFolderLocation
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
ole32
CoInitialize
CoUninitialize
CoCreateInstance
comctl32
ImageList_LoadImageA
ord17
winmm
ord2
Sections
.text Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
下载说明.htm.html .js polyglot
-
安装说明.txt
-
非常世纪资源网.url.url