ac7075379758c22e93660d947af2c066_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

ac7075379758c22e93660d947af2c066_JaffaCakes118
Size

529KB
MD5

ac7075379758c22e93660d947af2c066
SHA1

33807a2f0981691d25fafa7d1e2d597a2c1d8202
SHA256

e4d899b71ba483dc9ccf5e66958e98a22efefb22f5c4980220f86679b366cdb4
SHA512

49f24b9bbdacc6f333d2a7c71a5aa7bac33c3bfb37548a2020ec9c0e89a25896ab19f6aef1d850cb268590a55a5b98d465974ae949b3516cb7fc03b1f5045d8c
SSDEEP

12288:qRzVOlXusgF2D7EFsILDLSjBRoibBgAC+NsW/ys7e44:ZrD7+XDLSjgibD7CW+H

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/lvxing360/国内机票查询.exe
unpack001/lvxing360/机票直通车更新程序.exe

Files

ac7075379758c22e93660d947af2c066_JaffaCakes118
.rar
lvxing360/data/agentinfo.html
.html .js polyglot
lvxing360/data/asc.gif
.gif
lvxing360/data/bg.gif
.gif
lvxing360/data/desc.gif
.gif
lvxing360/data/jquery-latest.js
.js
lvxing360/data/jquery.metadata.js
.js
lvxing360/data/jquery.tablesorter.min.js
.js
lvxing360/data/logo.html
.js
lvxing360/data/static_title.html
.html
lvxing360/data/style.css
lvxing360/data/ticket_static.html
.html
lvxing360/data/ticketinfo.html
.html .js polyglot
lvxing360/data/上海航空.gif
.gif
lvxing360/data/东方航空.gif
.gif
lvxing360/data/中国国航.gif
.gif
lvxing360/data/南方航空.gif
.gif
lvxing360/data/厦门航空.gif
.gif
lvxing360/data/吉祥航空.gif
.gif
lvxing360/data/四川航空.gif
.gif
lvxing360/data/天津航空.gif
.gif
lvxing360/data/奥凯航空.gif
.gif
lvxing360/data/山东航空.gif
.gif
lvxing360/data/春秋航空.gif
.gif
lvxing360/data/海南航空.gif
.gif
lvxing360/data/深圳航空.gif
.gif
lvxing360/data/祥鹏航空.gif
.gif
lvxing360/data/西部航空.gif
.gif
lvxing360/data/金鹿航空.gif
.gif
lvxing360/data/鲲鹏航空.gif
.gif
lvxing360/data/鹰联航空.gif
.gif
lvxing360/国内机票查询.exe
.exe windows:5 windows x86 arch:x86

fd5c7f9d715179ce955f32ff9b3acd66

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetErrorMode
HeapAlloc
HeapFree
RtlUnwind
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
HeapReAlloc
ExitProcess
ExitThread
SetStdHandle
GetFileType
HeapSize
GetACP
IsValidCodePage
VirtualFree
HeapCreate
GetStdHandle
GetOEMCP
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
GetUserDefaultLCID
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
GetCPInfo
GlobalFlags
InterlockedCompareExchange
GetProcessHeap
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GetFileTime
GetFileSizeEx
ReleaseMutex
CreateMutexA
LocalAlloc
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFullPathNameA
GetVolumeInformationA
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetThreadLocale
GetStringTypeExA
MoveFileA
WritePrivateProfileStringA
GetModuleFileNameW
SuspendThread
SetEvent
ResumeThread
SetThreadPriority
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
InterlockedExchange
GetCurrentProcessId
lstrcmpA
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
LoadLibraryA
lstrcmpW
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
SetLastError
FormatMessageA
LocalFree
WriteFile
GetFileAttributesA
ReadFile
CreateFileA
SetFilePointer
GetVersionExA
CreateThread
WaitForSingleObject
CreateEventA
CloseHandle
Sleep
DeleteFileA
GetSystemDefaultLCID
GetVersion
FindFirstFileA
FindClose
GetTickCount
GetModuleHandleW
LoadLibraryExA
FreeLibrary
GetModuleFileNameA
IsDBCSLeadByte
InterlockedDecrement
InterlockedIncrement
lstrcmpiA
lstrlenA
GetModuleHandleA
GetProcAddress
GetLastError
FindResourceA
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
WideCharToMultiByte
LCMapStringA
MultiByteToWideChar

user32

InvalidateRgn
SetRect
CopyAcceleratorTableA
UnregisterClassA
WindowFromPoint
GetSysColorBrush
DestroyMenu
GetMenuItemInfoA
RegisterClipboardFormatA
SetWindowContextHelpId
MapDialogRect
GetDesktopWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
SetRectEmpty
ReleaseCapture
SetCapture
IsRectEmpty
ShowOwnedPopups
GetMessageA
TranslateMessage
GetActiveWindow
GetCursorPos
ValidateRect
PostQuitMessage
InflateRect
GetWindowThreadProcessId
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
TranslateAcceleratorA
GetClassLongA
GetFocus
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
SetActiveWindow
DispatchMessageA
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
UpdateWindow
PostMessageA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetScrollInfo
SetScrollInfo
GetDlgCtrlID
DefWindowProcA
CharNextA
SendMessageA
LoadStringA
PtInRect
GetMenu
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindow
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
ScreenToClient
GrayStringA
DrawTextExA
DrawTextA
PostThreadMessageA
MessageBeep
GetNextDlgGroupItem
UnpackDDElParam
TabbedTextOutA
FillRect
ReuseDDElParam
LoadMenuA
LoadAcceleratorsA
InsertMenuItemA
CreatePopupMenu
CallNextHookEx
BringWindowToTop
GetParent
EnableWindow
GetSysColor
SetCursor
LoadCursorA
CharUpperA
IsIconic
FindWindowA
GetLastActivePopup
SetForegroundWindow
CharNextW
DrawIcon
AppendMenuA
GetSystemMenu
GetClientRect
InvalidateRect
SetTimer
KillTimer
LoadIconA
GetDlgItem
GetSystemMetrics
MessageBoxA
GetWindowRect
IsWindow
AdjustWindowRectEx
IsMenu
GetWindowLongA
CallWindowProcA
SetWindowLongA
RemovePropA
GetPropA
IsZoomed
SetWindowRgn
SetPropA
EqualRect
DeferWindowPos
EndDeferWindowPos
BeginDeferWindowPos
GetClassNameA
GetWindowRgn
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
CopyRect
IsWindowVisible

gdi32

CreateSolidBrush
CreateFontIndirectA
GetMapMode
CreateEllipticRgn
LPtoDP
Ellipse
GetTextMetricsA
GetTextExtentPoint32A
GetCharWidthA
StretchDIBits
CreateCompatibleBitmap
GetRgnBox
GetBkColor
GetTextColor
CreateCompatibleDC
GetStockObject
CreateBitmap
CreatePatternBrush
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
CreateFontA
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
GetObjectA
DeleteObject
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetTextColor
SetBkMode
SetBkColor
RestoreDC
SaveDC
GetDeviceCaps
DPtoLP
OffsetRgn
CombineRgn
SetRectRgn
CreateRectRgnIndirect
CreateRectRgn
SelectObject

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

advapi32

RegQueryValueExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA

shell32

DragQueryFileA
SHChangeNotify
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteExA
ShellExecuteA
DragFinish

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameA
PathStripToRootA
PathIsUNCA
UrlUnescapeA
PathFindExtensionA

oledlg

ord8

ole32

CoTaskMemRealloc
CoTaskMemFree
CoRegisterClassObject
StringFromGUID2
CoCreateInstance
CoGetClassObject
OleRun
CoUninitialize
CoInitialize
CLSIDFromProgID
CLSIDFromString
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoTaskMemAlloc
CoRevokeClassObject

oleaut32

SysStringLen
VarUI4FromStr
LoadRegTypeLi
LoadTypeLi
SysAllocString
UnRegisterTypeLi
RegisterTypeLi
VariantTimeToSystemTime
VariantInit
VariantClear
VariantChangeType
SysAllocStringLen
SysAllocStringByteLen
SysStringByteLen
VariantCopy
SystemTimeToVariantTime
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
SafeArrayDestroy
OleCreateFontIndirect
GetErrorInfo
SysFreeString

urlmon

CoInternetGetSession

ws2_32

WSAGetLastError
WSARecv
WSAWaitForMultipleEvents
WSAEventSelect
shutdown
closesocket

wininet

InternetCrackUrlA
HttpOpenRequestA
InternetOpenUrlA
InternetConnectA
HttpSendRequestA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetOpenA
InternetGetLastResponseInfoA
InternetCloseHandle
HttpQueryInfoA
HttpAddRequestHeadersA
InternetQueryDataAvailable
InternetCanonicalizeUrlA
InternetQueryOptionA

Sections

.text
Size: 579KB - Virtual size: 579KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 876KB - Virtual size: 876KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
lvxing360/新云软件.url
.url
lvxing360/机票直通车更新程序.exe
.exe windows:4 windows x86 arch:x86

878191cc432fe2522296bd7968c7c463

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord922
ord939
ord940
ord2763
ord4277
ord4202
ord4129
ord2764
ord6877
ord3811
ord551
ord2784
ord4278
ord823
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord815
ord924
ord765
ord2514
ord2621
ord1134
ord5265
ord4376
ord4853
ord4998
ord6052
ord1775
ord5280
ord4425
ord3597
ord6055
ord4078
ord1776
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5290
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord3402
ord4627
ord3698
ord1146
ord1168
ord567
ord324
ord2302
ord4234
ord535
ord4710
ord2379
ord755
ord470
ord6199
ord3092
ord1105
ord2614
ord2818
ord6282
ord6283
ord926
ord858
ord941
ord3790
ord354
ord5186
ord665
ord5683
ord5710
ord2393
ord1979
ord6385
ord5583
ord5645
ord6153
ord825
ord540
ord860
ord800
ord641
ord537
ord1576

msvcrt

_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
_mbsstr
calloc
free
malloc
_mbscmp
atoi
__CxxFrameHandler
_setmbcp
_controlfp

kernel32

Sleep
CloseHandle
CreateEventA
GetLastError
GetExitCodeThread
WaitForSingleObject
CreateThread
GetVersionExA
SetFilePointer
CreateFileA
ReadFile
SystemTimeToFileTime
GetCurrentDirectoryA
LocalFileTimeToFileTime
CreateDirectoryA
GetFileAttributesA
SetFileTime
WriteFile
GetCommandLineA
GetModuleFileNameA
GetVersion
GetModuleHandleA
GetStartupInfoA
lstrlenA

user32

SetTimer
DrawIcon
GetClientRect
MessageBoxA
IsWindow
KillTimer
EnableWindow
LoadIconA
GetSystemMetrics
wsprintfA
SendMessageA
IsIconic

shell32

ShellExecuteA
ShellExecuteExA

ws2_32

ntohs
htons
WSACleanup
WSAStartup
WSAGetLastError
ntohl
WSASocketA
closesocket
WSAWaitForMultipleEvents
WSAEventSelect
shutdown
WSARecv
WSAEnumNetworkEvents
WSASend
WSAConnect
inet_addr
inet_ntoa
gethostbyname
htonl
setsockopt

Sections

.text
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd5c7f9d715179ce955f32ff9b3acd66

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

urlmon

ws2_32

wininet

Sections

.text Size: 579KB - Virtual size: 579KB

.rdata Size: 140KB - Virtual size: 139KB

.data Size: 16KB - Virtual size: 31KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 876KB - Virtual size: 876KB

878191cc432fe2522296bd7968c7c463

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

shell32

ws2_32

Sections

.text Size: 44KB - Virtual size: 41KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 4KB - Virtual size: 2KB

.tls Size: 4KB - Virtual size: 12B

.rsrc Size: 12KB - Virtual size: 8KB

.text
Size: 579KB - Virtual size: 579KB

.rdata
Size: 140KB - Virtual size: 139KB

.data
Size: 16KB - Virtual size: 31KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 876KB - Virtual size: 876KB

.text
Size: 44KB - Virtual size: 41KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 2KB

.tls
Size: 4KB - Virtual size: 12B

.rsrc
Size: 12KB - Virtual size: 8KB