Overview
overview
7Static
static
3HGweb/Setup.exe
windows7-x64
7HGweb/Setup.exe
windows10-2004-x64
7HGweb/site...ad.htm
windows7-x64
3HGweb/site...ad.htm
windows10-2004-x64
3HGweb/site...1.html
windows7-x64
3HGweb/site...1.html
windows10-2004-x64
3HGweb/site...2.html
windows7-x64
3HGweb/site...2.html
windows10-2004-x64
1HGweb/site...3.html
windows7-x64
3HGweb/site...3.html
windows10-2004-x64
3HGweb/site...ex.htm
windows7-x64
3HGweb/site...ex.htm
windows10-2004-x64
3HGweb/site...1.html
windows7-x64
3HGweb/site...1.html
windows10-2004-x64
3HGweb/site...2.html
windows7-x64
3HGweb/site...2.html
windows10-2004-x64
3HGweb/site...3.html
windows7-x64
3HGweb/site...3.html
windows10-2004-x64
3HGweb/web.exe
windows7-x64
3HGweb/web.exe
windows10-2004-x64
3HGweb/新�...��.url
windows7-x64
1HGweb/新�...��.url
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
HGweb/Setup.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
HGweb/Setup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
HGweb/site/girl.cn/head.htm
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
HGweb/site/girl.cn/head.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
HGweb/site/girl.cn/sub1.html
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
HGweb/site/girl.cn/sub1.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
HGweb/site/girl.cn/sub2.html
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
HGweb/site/girl.cn/sub2.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
HGweb/site/girl.cn/sub3.html
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
HGweb/site/girl.cn/sub3.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
HGweb/site/healthy/index.htm
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
HGweb/site/healthy/index.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
HGweb/site/healthy/sub1.html
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
HGweb/site/healthy/sub1.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
HGweb/site/healthy/sub2.html
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
HGweb/site/healthy/sub2.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
HGweb/site/healthy/sub3.html
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
HGweb/site/healthy/sub3.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
HGweb/web.exe
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
HGweb/web.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
HGweb/新云软件.url
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
HGweb/新云软件.url
Resource
win10v2004-20240802-en
General
-
Target
96518819cf6a93c5bbf3f85f75f3c24d_JaffaCakes118
-
Size
1.2MB
-
MD5
96518819cf6a93c5bbf3f85f75f3c24d
-
SHA1
c8522b1e91a683ba7cf30c2a10d17623c7dfafb6
-
SHA256
baaab302f7baada2e6ad65dc87e61947a0cb77fe931efebde1035c7927863759
-
SHA512
b2db705c3207af12df74842fad30a19884f9a896e2f09c24725fb769e0c3f0b406a7f00a3b9fc1bc1e03d22a5e439e83362efac03cefee7dfa9a65de49898d4c
-
SSDEEP
24576:x3gTGMf0rHHbEP3C2kcSXbZtCx0gxSg7bxgLiN21mHbWiw:x3xM2HHbEvCnXb6xnxS0beLVEbWiw
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/HGweb/Setup.exe unpack001/HGweb/web.exe
Files
-
96518819cf6a93c5bbf3f85f75f3c24d_JaffaCakes118.rar
-
HGweb/Setup.exe.exe windows:4 windows x86 arch:x86
a24e57cfb1e35030a9b4252bf1fa8b4b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcmpiA
lstrcpyA
lstrlenA
_lclose
RemoveDirectoryA
DeleteFileA
GetModuleFileNameA
_lread
_llseek
_lopen
GetDiskFreeSpaceA
SetCurrentDirectoryA
CreateDirectoryA
GetFileAttributesA
lstrcatA
GetTempPathA
GetCurrentDirectoryA
_lwrite
_lcreat
CloseHandle
GetExitCodeProcess
CreateProcessA
ExitProcess
TerminateProcess
GetCurrentProcess
HeapFree
HeapAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
RtlUnwind
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
WriteFile
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
user32
TranslateMessage
DispatchMessageA
PeekMessageA
MsgWaitForMultipleObjects
wsprintfA
LoadCursorA
SetCursor
MessageBoxA
Sections
.text Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
HGweb/configure.txt
-
HGweb/site/girl.cn/0701d_bg.gif.gif
-
HGweb/site/girl.cn/0701d_i1.gif.gif
-
HGweb/site/girl.cn/0701d_i2.gif.gif
-
HGweb/site/girl.cn/0701d_i3.gif.gif
-
HGweb/site/girl.cn/0701d_l1.gif.gif
-
HGweb/site/girl.cn/0701d_l2.gif.gif
-
HGweb/site/girl.cn/0701d_ml.gif.gif
-
HGweb/site/girl.cn/0701d_tp.gif.gif
-
HGweb/site/girl.cn/9/0701d_b1.gif.gif
-
HGweb/site/girl.cn/head.htm
-
HGweb/site/girl.cn/sub1.html
-
HGweb/site/girl.cn/sub2.html
-
HGweb/site/girl.cn/sub3.html
-
HGweb/site/healthy/0708c_b1.gif.gif
-
HGweb/site/healthy/0708c_bg.gif.gif
-
HGweb/site/healthy/0708c_i1.gif.gif
-
HGweb/site/healthy/0708c_i2.gif.gif
-
HGweb/site/healthy/0708c_i3.gif.gif
-
HGweb/site/healthy/0708c_l1.gif.gif
-
HGweb/site/healthy/0708c_l2.gif.gif
-
HGweb/site/healthy/0708c_ml.gif.gif
-
HGweb/site/healthy/0708c_tp.gif.gif
-
HGweb/site/healthy/index.htm
-
HGweb/site/healthy/sub1.html
-
HGweb/site/healthy/sub2.html
-
HGweb/site/healthy/sub3.html
-
HGweb/web.exe.exe windows:4 windows x86 arch:x86
fe3945b81207088c28e75ff9ad50d6a1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarSub
__vbaVarTstGt
__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaVarVargNofree
__vbaAryMove
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
__vbaLateIdCall
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaRecAnsiToUni
ord518
__vbaCopyBytes
__vbaStrCat
__vbaLsetFixstr
ord660
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaAryVar
__vbaVarTstLe
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
ord593
__vbaOnError
__vbaObjSet
ord595
_adj_fdiv_m16i
_adj_fdivr_m16i
ord520
__vbaBoolVarNull
__vbaVarTstLt
__vbaFpR8
_CIsin
ord709
ord632
__vbaChkstk
ord526
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaVarAbs
__vbaStrCmp
__vbaAryConstruct2
__vbaVarTstEq
__vbaI2I4
DllFunctionCall
__vbaVarOr
__vbaFpUI1
__vbaRedimPreserve
_adj_fpatan
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaStrUI1
__vbaExceptHandler
ord711
__vbaStrToUnicode
ord712
_adj_fprem
_adj_fdivr_m64
ord607
ord608
__vbaFPException
ord717
__vbaInStrVar
__vbaUbound
__vbaStrVarVal
__vbaGetOwner3
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaInStr
ord570
__vbaNew2
__vbaVarInt
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord573
ord681
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord100
__vbaI4Var
__vbaAryLock
__vbaVarAdd
__vbaStrToAnsi
__vbaVarDup
__vbaFpI2
__vbaVarCopy
__vbaFpI4
ord617
__vbaR8IntI2
_CIatan
__vbaStrMove
__vbaAryCopy
__vbaI2ErrVar
__vbaStrVarCopy
ord619
_allmul
__vbaLateIdSt
_CItan
ord546
__vbaUI1Var
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaMidStmtBstr
__vbaFreeStr
__vbaFreeObj
ord581
Sections
.text Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
HGweb/使用前必看.txt
-
HGweb/新云软件.url.url
-
HGweb/界面图片.JPG.jpg