b0b9f327d1b73add3ad7bc60fa093ac5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b0b9f327d1b73add3ad7bc60fa093ac5_JaffaCakes118
Size

392KB
MD5

b0b9f327d1b73add3ad7bc60fa093ac5
SHA1

ce85914d432652502e2092be95dcb53592588ec5
SHA256

eea4591b376906b58e4b01b45fd9c62f7a1aefa4b33f1efccd19690b927b265f
SHA512

c647d07b09230ed56b29e3cfd904458a138598b8657eafe5bb45e4d4cc1c2ec209bfaa55ce37652728520cb4e390ee0ab78440e49f4517cc460750fb6db10781
SSDEEP

6144:BGPEhKHoN12qENdwUgOv48WSrMZDxcziU/ybCEV4WupseZRB4V2DSOe9hPoe8KkC:ybYiN+d44+rOquU/ybCEypqwDJ4hN8KJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/WQ-zhuofan2.0/WQ-zhuofan2.0/Menu.ocx
unpack001/WQ-zhuofan2.0/WQ-zhuofan2.0/syssxf.exe
unpack001/WQ-zhuofan2.0/WQ-zhuofan2.0/桌面幻影2.0.exe

Files

b0b9f327d1b73add3ad7bc60fa093ac5_JaffaCakes118
.rar
WQ-zhuofan2.0/WQ-zhuofan2.0/Menu.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

2226db604b0dd5250ca0cbee62acd505

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvbvm60

EVENT_SINK_GetIDsOfNames
ord588
MethCallEngine
EVENT_SINK_Invoke
Zombie_GetTypeInfo
EVENT_SINK2_Release
ord300
ord301
ord595
ord596
ord599
ord306
ord307
ord631
ord632
ord526
EVENT_SINK_AddRef
ord527
ord561
ord562
DllFunctionCall
Zombie_GetTypeInfoCount
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord606
ord714
ord608
ord717
ord319
ProcCallEngine
ord644
ord537
ord572
ord573
EVENT_SINK2_AddRef
ord681
ord685
ord101
ord102
ord103
ord104
ord105
ord320
ord321
ord616
ord617
ord618
ord619
ord581

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WQ-zhuofan2.0/WQ-zhuofan2.0/Thumbs.db
WQ-zhuofan2.0/WQ-zhuofan2.0/URL.cur
WQ-zhuofan2.0/WQ-zhuofan2.0/an.ini
WQ-zhuofan2.0/WQ-zhuofan2.0/syssxf.exe
.exe windows:4 windows x86 arch:x86

2a3ca3492530620af79fce84fc8bad77

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaStrVarMove
_adj_fdiv_m64
_adj_fprem1
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
ord593
ord594
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
__vbaVarTstEq
DllFunctionCall
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
ord535
_CIlog
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
ord610
__vbaStrToAnsi
__vbaFpI4
_CIatan
__vbaStrMove
ord619
__vbaR8IntI4
_allmul
_CItan
__vbaFPInt
_CIexp
__vbaFreeObj
__vbaFreeStr
ord581

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/008.GIF
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/1.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/10.GIF
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/11.GIF
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/13.GIF
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/14.GIF
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/15.GIF
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/16.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/17.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/18.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/19.bmp
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/2.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/20.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/21.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/22.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/23.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/24.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/25.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/26.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/27.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/28.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/29.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/3.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/30.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/4.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/5.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/6.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/7.gif
.gif
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/8.GIF
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/9.GIF
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/Barney.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/Blood.exe1.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/FACE05.ICO
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/StarCraft.exe1.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/TRFFC01.ICO
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/TRFFC02.ICO
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/TRFFC03.ICO
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/TRFFC04.ICO
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/TRFFC05.ICO
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/Thumbs.db
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/VB6.EXE1.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/VFP6.EXE1.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/War3.exe1.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/War3.exe2.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/War3.exe3.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/_SAVE.BMP1.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/adsd.ICO
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/czero.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/tubiao/windows.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/xuantu/1.gif
.gif
WQ-zhuofan2.0/WQ-zhuofan2.0/xuantu/10.gif
.gif
WQ-zhuofan2.0/WQ-zhuofan2.0/xuantu/2.gif
.gif
WQ-zhuofan2.0/WQ-zhuofan2.0/xuantu/3.gif
.gif
WQ-zhuofan2.0/WQ-zhuofan2.0/xuantu/4.gif
.gif
WQ-zhuofan2.0/WQ-zhuofan2.0/xuantu/5.gif
.gif
WQ-zhuofan2.0/WQ-zhuofan2.0/xuantu/6.gif
.gif
WQ-zhuofan2.0/WQ-zhuofan2.0/xuantu/7.gif
.gif
WQ-zhuofan2.0/WQ-zhuofan2.0/xuantu/8.gif
.gif
WQ-zhuofan2.0/WQ-zhuofan2.0/xuantu/9.gif
.gif
WQ-zhuofan2.0/WQ-zhuofan2.0/xuantu/Thumbs.db
WQ-zhuofan2.0/WQ-zhuofan2.0/zhoubao.ico
WQ-zhuofan2.0/WQ-zhuofan2.0/使用前必读.txt
WQ-zhuofan2.0/WQ-zhuofan2.0/备用/桌面宝贝.exe.lnk
.lnk
WQ-zhuofan2.0/WQ-zhuofan2.0/桌面幻影2.0.exe
.exe windows:4 windows x86 arch:x86

afea406322d1ef3440826301bb917151

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaFreeVar
__vbaLateIdCall
__vbaLenBstr
__vbaStrVarMove
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
ord516
_adj_fprem1
__vbaRecAnsiToUni
__vbaResume
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaVarXor
__vbaExitProc
__vbaVarForInit
__vbaI4Abs
ord301
__vbaObjSet
ord595
__vbaOnError
_adj_fdiv_m16i
ord303
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaBoolVar
ord520
ord307
ord309
__vbaBoolVarNull
_CIsin
ord632
__vbaChkstk
ord526
EVENT_SINK_AddRef
__vbaGenerateBoundsError
ord529
__vbaStrCmp
__vbaVarTstEq
__vbaObjVar
__vbaI2I4
DllFunctionCall
__vbaCastObjVar
_adj_fpatan
__vbaR4Var
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaStrR8
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
ord606
_adj_fprem
_adj_fdivr_m64
ord531
ord716
__vbaFPException
ord532
__vbaStrVarVal
__vbaVarCat
ord537
_CIlog
__vbaErrorOverflow
__vbaNew2
__vbaR8Str
_adj_fdiv_m32i
_adj_fdivr_m32i
ord573
__vbaStrCopy
__vbaFreeStrList
ord576
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
ord610
__vbaLateMemCall
__vbaVarAdd
__vbaStrToAnsi
__vbaVarDup
ord613
__vbaFpI2
__vbaFpI4
__vbaVarCopy
ord617
_CIatan
__vbaStrMove
__vbaCastObj
ord619
_allmul
ord651
__vbaLateIdSt
_CItan
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
ord581

Sections

.text
Size: 364KB - Virtual size: 361KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WQ-zhuofan2.0/WQ-zhuofan2.0/背景/Thumbs.db

Sharing

General

Malware Config

Signatures

Files

2226db604b0dd5250ca0cbee62acd505

Headers

File Characteristics

Imports

msvbvm60

Exports

Exports

Sections

.text Size: 160KB - Virtual size: 159KB

.data Size: - Virtual size: 11KB

.rsrc Size: 40KB - Virtual size: 36KB

.reloc Size: 12KB - Virtual size: 10KB

2a3ca3492530620af79fce84fc8bad77

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 1KB

afea406322d1ef3440826301bb917151

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 364KB - Virtual size: 361KB

.data Size: 4KB - Virtual size: 12KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 160KB - Virtual size: 159KB

.data
Size: - Virtual size: 11KB

.rsrc
Size: 40KB - Virtual size: 36KB

.reloc
Size: 12KB - Virtual size: 10KB

.text
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 1KB

.text
Size: 364KB - Virtual size: 361KB

.data
Size: 4KB - Virtual size: 12KB

.rsrc
Size: 4KB - Virtual size: 1KB