Static task
static1
Behavioral task
behavioral1
Sample
155绿色软件站.url
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
155绿色软件站.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
MsiTools.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
MsiTools.exe
Resource
win10v2004-20240802-en
General
-
Target
a894e834fe732f0a16d529c9258fd77b_JaffaCakes118
-
Size
133KB
-
MD5
a894e834fe732f0a16d529c9258fd77b
-
SHA1
fc9de6093c4a2da9c81a0de38ac98bbd9f825f4b
-
SHA256
c047c0b9210481adaf9b1f21efb4560bc1fd83636d2d204a2f5c73e85489d2ab
-
SHA512
3b0b9979d43b43bfbfe465a681b9c008f116ddd186f926fdbb7af30a890bcebff974c01b7e8235328f4fd8f4b4fdeda55409e01bf7910f8fd6fb9072fc5c4009
-
SSDEEP
3072:bDC4hzDO4PMls2CJPy/FnNQMJc/U6Wp89kUOUddcI:JDhuslJPCtaYxN4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/MsiTools.exe
Files
-
a894e834fe732f0a16d529c9258fd77b_JaffaCakes118.rar
-
155绿色软件站.url.url
-
MsiTools.exe.exe windows:4 windows x86 arch:x86
de14ce48b1c51c77587ffd1820bf40ff
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
InitializeAcl
ImpersonateSelf
OpenThreadToken
OpenProcessToken
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetLengthSid
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
IsValidSecurityDescriptor
AccessCheck
RevertToSelf
FreeSid
comctl32
ImageList_Create
ImageList_Destroy
InitCommonControls
ImageList_Draw
ImageList_GetImageInfo
ImageList_Add
InitCommonControlsEx
gdi32
DeleteObject
CreateFontIndirectA
GetObjectA
GetStockObject
SelectObject
CreatePen
CreateSolidBrush
SetTextColor
SetBkColor
LineTo
MoveToEx
GetTextExtentPoint32A
RestoreDC
SetBkMode
GetBkMode
GetTextColor
SaveDC
LineDDA
SetPixel
DeleteDC
CreateCompatibleBitmap
CreateCompatibleDC
GetDeviceCaps
BitBlt
PatBlt
SetBrushOrgEx
CreatePatternBrush
CreateBitmap
GetBkColor
GetTextCharacterExtra
kernel32
GetFileTime
CompareFileTime
ReadFile
DeleteFileA
LocalFree
LocalAlloc
GetCurrentProcess
GetCurrentThread
CompareStringW
CompareStringA
FlushFileBuffers
IsBadCodePtr
IsBadReadPtr
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapDestroy
UnhandledExceptionFilter
HeapSize
HeapReAlloc
GetOEMCP
GetACP
GetCPInfo
TerminateProcess
SetEndOfFile
GetStdHandle
LockResource
SetStdHandle
SetUnhandledExceptionFilter
SetLastError
TlsAlloc
ExitProcess
GetCommandLineA
GetStartupInfoA
GetCurrentThreadId
FileTimeToLocalFileTime
FindClose
FindNextFileA
FindFirstFileA
InterlockedIncrement
InterlockedDecrement
GetSystemTimeAsFileTime
GetLocalTime
GetSystemTime
GetTimeZoneInformation
ExitThread
TlsGetValue
TlsSetValue
CreateThread
GetFileType
RaiseException
RtlUnwind
LeaveCriticalSection
DeleteCriticalSection
InterlockedExchange
InitializeCriticalSection
EnterCriticalSection
GetFileAttributesA
SetFileAttributesA
GetVersion
WinExec
SetErrorMode
GetLocaleInfoA
WaitForSingleObject
FindResourceA
LoadResource
SizeofResource
FreeResource
LockResource
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
GlobalFree
ResetEvent
ResumeThread
SetFilePointer
GetPrivateProfileIntA
GetPrivateProfileStringA
SetEnvironmentVariableA
_lopen
_hread
_lclose
Sleep
WritePrivateProfileStringA
SetEvent
GetModuleFileNameA
GetLongPathNameA
GetEnvironmentVariableA
CreateEventA
GetTempPathA
GetWindowsDirectoryA
CreateFileA
WriteFile
GetFileSize
FileTimeToSystemTime
GetModuleHandleA
GetVersionExA
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
OpenProcess
GetFileAttributesW
DosDateTimeToFileTime
CreateDirectoryW
GetLastError
CreateFileW
LocalFileTimeToFileTime
SetFileTime
CloseHandle
WideCharToMultiByte
DeleteFileW
SetFileAttributesW
FreeLibrary
GetTempPathW
MultiByteToWideChar
LoadLibraryW
HeapCreate
GetProcAddress
oleaut32
OleLoadPicture
shell32
DragAcceptFiles
SHGetFolderPathA
SHBrowseForFolder
SHGetMalloc
SHGetPathFromIDList
DragQueryFile
DragFinish
ShellExecuteA
shlwapi
SHAutoComplete
user32
IsIconic
wsprintfA
MessageBeep
CharNextA
GetClassNameA
SetWindowsHookExA
GetWindowThreadProcessId
CallNextHookEx
UnhookWindowsHookEx
GetWindowPlacement
RegisterClassExA
LoadBitmapA
SendMessageA
SetParent
SetWindowLongA
LoadImageA
CreateWindowExA
PostMessageA
DialogBoxParamA
SetFocus
SetScrollPos
GetWindow
GetDialogBaseUnits
MoveWindow
ReleaseCapture
SetCapture
BeginPaint
CreateDialogParamA
DefWindowProcA
SetCursor
ScreenToClient
GetCursorPos
GetWindowLongA
SetDlgItemTextA
ShowWindow
GetDlgItem
DestroyCursor
DestroyCursor
MessageBoxA
RegisterClassA
IsChild
LoadCursorA
LoadIconA
GetSysColor
GetSystemMetrics
EndPaint
GetWindowDC
UpdateWindow
GetParent
GetClassLongA
GetClassInfoA
OffsetRect
GetSystemMenu
DeleteMenu
AppendMenuA
GetMenuStringA
GetMenuState
CallWindowProcA
GetWindowTextA
LoadStringA
GetDC
ReleaseDC
GetWindowTextLengthA
IsWindowEnabled
DrawIconEx
InflateRect
GetMenu
GetSubMenu
GetWindowRect
EnableWindow
GetClientRect
EndDialog
GetMenuItemCount
CheckMenuItem
GetDlgItemTextA
IsDlgButtonChecked
CheckDlgButton
ClientToScreen
PtInRect
EnableMenuItem
InvalidateRect
CopyRect
SetWindowTextA
SetWindowPos
BringWindowToTop
FillRect
DrawTextA
DrawIcon
DestroyWindow
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
comdlg32
GetSaveFileNameA
GetOpenFileNameA
msi
MsiDatabaseOpenViewA
MsiViewExecute
MsiRecordReadStream
MsiRecordGetStringA
MsiViewClose
MsiSummaryInfoGetPropertyA
MsiOpenDatabaseA
MsiGetSummaryInformationA
MsiCloseHandle
MsiFormatRecordA
MsiGetLastErrorRecord
MsiViewFetch
ole32
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
Sections
.text Size: 236KB - Virtual size: 232KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 36KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 92KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mackt Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE