Overview
overview
4Static
static
3Inkecn.exe
windows7-x64
3Inkecn.exe
windows10-2004-x64
3Update.exe
windows7-x64
3Update.exe
windows10-2004-x64
3icon/新云软件.url
windows7-x64
1icon/新云软件.url
windows10-2004-x64
1pic/make/�....0.doc
windows7-x64
4pic/make/�....0.doc
windows10-2004-x64
1大众印�....0.doc
windows7-x64
4大众印�....0.doc
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
Inkecn.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Inkecn.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Update.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
Update.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
icon/新云软件.url
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
icon/新云软件.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
pic/make/大众印客精灵-使用说明V1.0.0.doc
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
pic/make/大众印客精灵-使用说明V1.0.0.doc
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
大众印客精灵-使用说明V1.0.0.doc
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
大众印客精灵-使用说明V1.0.0.doc
Resource
win10v2004-20240802-en
General
-
Target
bd6dc7cbeaaeb59e00206035bd4d3fb6_JaffaCakes118
-
Size
9.1MB
-
MD5
bd6dc7cbeaaeb59e00206035bd4d3fb6
-
SHA1
be1ed626c08a9598e1c4d56eff45bdc2880c0593
-
SHA256
533380663aa1c6fd5804258826538c31d6b34a9b9c4437c259b71c8dd76f7f41
-
SHA512
4506e47c38fba561f5f49a700c7a06b789765d7f8659fd4d7456f71e8fc431e1678ef588e7d707a6e2944a02dc5df2da3958bb8173676b277421367f0764efc8
-
SSDEEP
196608:wM3iJnTPlaWS6l/RG5OwWPIf21UQ5BhBvYKCgeYPx4Bc+G7:/KTNwK45OwWPFR5dvhnsc+G7
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Inkecn.exe unpack001/Update.exe
Files
-
bd6dc7cbeaaeb59e00206035bd4d3fb6_JaffaCakes118.rar
-
Inkecn.exe.exe windows:4 windows x86 arch:x86
0c59c888dda8da85dc6010bb0b5cc3e2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
oleaut32
SysFreeString
advapi32
RegQueryValueExA
user32
GetKeyboardType
gdi32
UpdateColors
version
VerQueryValueA
ole32
CreateStreamOnHGlobal
comctl32
_TrackMouseEvent
shell32
SHFileOperationA
winspool.drv
OpenPrinterA
comdlg32
ChooseFontA
winmm
timeGetTime
gdiplus
GdipDrawImageRectI
avifil32
AVISaveOptionsFree
msvfw32
DrawDibRealize
Sections
.text Size: 2.6MB - Virtual size: 7.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Update.exe.exe windows:4 windows x86 arch:x86
fe6c518ddcfd4d4e5d1c8cf44160d4f7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
oleaut32
SysFreeString
advapi32
RegQueryValueExA
user32
GetKeyboardType
gdi32
UnrealizeObject
version
VerQueryValueA
ole32
CoTaskMemFree
comctl32
_TrackMouseEvent
Sections
.text Size: 338KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 167KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
data.bak
-
data.mdb
-
fzkt.ttf
-
icon/Pic_Warn.BMP
-
icon/Pic_Warn1.bmp
-
icon/Thumbs.db
-
icon/blank.bmp
-
icon/pic_icon.bmp
-
icon/新云软件.url.url
-
pic/Thumbs.db
-
pic/about.jpg.jpg
-
pic/bjpic/Thumbs.db
-
pic/bk.png.png
-
pic/bk/003.jpg.jpg
-
pic/bk/Thumbs.db
-
pic/category/0000.png.png
-
pic/category/00002000.png.png
-
pic/category/0000200000.png.png
-
pic/category/0001.png.png
-
pic/category/00012100.png.png
-
pic/category/0001210000.png.png
-
pic/category/00012500.png.png
-
pic/category/0001250000.png.png
-
pic/category/0002.png.png
-
pic/category/00022002.png.png
-
pic/category/00022201.png.png
-
pic/category/0002220100.png.png
-
pic/category/00042004.png.png
-
pic/category/0100.png.png
-
pic/category/01002001.png.png
-
pic/category/0100200200.png.png
-
pic/category/0101.png.png
-
pic/category/01012200.png.png
-
pic/category/0101220000.png.png
-
pic/category/01022501.png.png
-
pic/category/0102250100.png.png
-
pic/category/02002600.png.png
-
pic/category/0200260000.png.png
-
pic/category/08002002.png.png
-
pic/category/08002003.png.png
-
pic/category/Thumbs.db
-
pic/category/bj.png.png
-
pic/category/mb.png.png
-
pic/category/mbgg.png.png
-
pic/home/000.png.png
-
pic/home/001.png.png
-
pic/home/002.png.png
-
pic/home/010.png.png
-
pic/home/011.png.png
-
pic/home/012.png.png
-
pic/home/020.png.png
-
pic/home/021.png.png
-
pic/home/022.png.png
-
pic/home/030.png.png
-
pic/home/031.png.png
-
pic/home/032.png.png
-
pic/home/040.png.png
-
pic/home/041.png.png
-
pic/home/042.png.png
-
pic/home/050.png.png
-
pic/home/051.png.png
-
pic/home/052.png.png
-
pic/home/060.png.png
-
pic/home/061.png.png
-
pic/home/062.png.png
-
pic/home/070.png.png
-
pic/home/071.png.png
-
pic/home/072.png.png
-
pic/home/080.png.png
-
pic/home/081.png.png
-
pic/home/082.png.png
-
pic/home/200.png.png
-
pic/home/201.png.png
-
pic/home/202.png.png
-
pic/home/210.png.png
-
pic/home/211.png.png
-
pic/home/212.png.png
-
pic/home/220.png.png
-
pic/home/221.png.png
-
pic/home/222.png.png
-
pic/home/230.png.png
-
pic/home/231.png.png
-
pic/home/232.png.png
-
pic/home/240.png.png
-
pic/home/241.png.png
-
pic/home/242.png.png
-
pic/home/250.png.png
-
pic/home/251.png.png
-
pic/home/252.png.png
-
pic/home/260.png.png
-
pic/home/261.png.png
-
pic/home/262.png.png
-
pic/home/Pictures.ico
-
pic/home/Thumbs.db
-
pic/home/about.jpg.jpg
-
pic/home/aboutqd.png.png
-
pic/home/an1.png.png
-
pic/home/an2.png.png
-
pic/home/bj1.png.png
-
pic/home/bk.jpg.jpg
-
pic/home/bk.png.png
-
pic/home/bk1.jpg.jpg
-
pic/home/bkb.jpg.jpg
-
pic/home/cjwt.gif.gif
-
pic/home/dgzp.gif.gif
-
pic/home/esc.ico
-
pic/home/fxzp.gif.gif
-
pic/home/glxp.gif.gif
-
pic/home/gxcz.gif.gif
-
pic/home/gy.gif.gif
-
pic/home/ie4.0buf.ico
-
pic/home/ie4power.ico
-
pic/home/info.png.png
-
pic/home/infoedit.gif.gif
-
pic/home/jt01-1.png.png
-
pic/home/jt01-2.png.png
-
pic/home/jt01.png.png
-
pic/home/jt02-1.png.png
-
pic/home/jt02-2.png.png
-
pic/home/jt02.png.png
-
pic/home/kjms.png.png
-
pic/home/kjms1.png.png
-
pic/home/pos.gif.gif
-
pic/home/pos.png.png
-
pic/home/price.gif.gif
-
pic/home/ssjg.gif.gif
-
pic/home/vline.png.png
-
pic/home/wh.gif.gif
-
pic/home/winter.png.png
-
pic/home/wyly.gif.gif
-
pic/home/xzmb.gif.gif
-
pic/home/zdyms.png.png
-
pic/home/zdyms1.png.png
-
pic/home/zpyl.gif.gif
-
pic/icon/Pic_Warn.BMP
-
pic/icon/Pic_Warn1.bmp
-
pic/icon/Thumbs.db
-
pic/icon/blank.bmp
-
pic/icon/pic_icon.bmp
-
pic/make/HELP2.ico
-
pic/make/Thumbs.db
-
pic/make/bc0.png.png
-
pic/make/bc1.png.png
-
pic/make/bc2.png.png
-
pic/make/bk.jpg.jpg
-
pic/make/cf0.png.png
-
pic/make/cf1.png.png
-
pic/make/cf2.png.png
-
pic/make/dk0.png.png
-
pic/make/dk1.png.png
-
pic/make/dk2.png.png
-
pic/make/drtp0.png.png
-
pic/make/drtp1.png.png
-
pic/make/fd0.png.png
-
pic/make/fd1.png.png
-
pic/make/fd2.png.png
-
pic/make/font.ico
-
pic/make/ftp.ico
-
pic/make/left01.png.png
-
pic/make/left011.png.png
-
pic/make/left02.png.png
-
pic/make/left022.png.png
-
pic/make/left03.png.png
-
pic/make/left033.png.png
-
pic/make/ly.png.png
-
pic/make/save.ico
-
pic/make/sc0.png.png
-
pic/make/sc1.png.png
-
pic/make/sc2.png.png
-
pic/make/sctc.png.png
-
pic/make/sctc0.png.png
-
pic/make/sctp.png.png
-
pic/make/scwb.png.png
-
pic/make/scwb0.png.png
-
pic/make/scy0.png.png
-
pic/make/scy1.png.png
-
pic/make/scy2.png.png
-
pic/make/sf0.png.png
-
pic/make/sf1.png.png
-
pic/make/sf2.png.png
-
pic/make/sx0.png.png
-
pic/make/sx1.png.png
-
pic/make/sx2.png.png
-
pic/make/tc0.png.png
-
pic/make/tc1.png.png
-
pic/make/tc2.png.png
-
pic/make/top01.png.png
-
pic/make/top011.png.png
-
pic/make/top02.png.png
-
pic/make/top022.png.png
-
pic/make/top03.png.png
-
pic/make/top033.png.png
-
pic/make/top04.png.png
-
pic/make/top044.png.png
-
pic/make/top05.png.png
-
pic/make/top055.png.png
-
pic/make/top06.png.png
-
pic/make/top066.png.png
-
pic/make/wdtp0.png.png
-
pic/make/wdtp1.png.png
-
pic/make/yl0.png.png
-
pic/make/yl1.png.png
-
pic/make/yl2.png.png
-
pic/make/yx0.png.png
-
pic/make/yx1.png.png
-
pic/make/yx2.png.png
-
pic/make/zjtc.png.png
-
pic/make/zjtc0.png.png
-
pic/make/zjwb.png.png
-
pic/make/zjwb0.png.png
-
pic/make/zjy0.png.png
-
pic/make/zjy1.png.png
-
pic/make/zjy2.png.png
-
pic/make/zx0.png.png
-
pic/make/zx1.png.png
-
pic/make/zx2.png.png
-
pic/make/大众印客精灵-使用说明V1.0.0.doc.doc windows office2003
-
pic/mb/Thumbs.db
-
preview/Thumbs.db
-
preview/preview.swf
-
preview/preview.xml.xml
-
qd.mdb
-
sample/00001.swf
-
sample/00002.swf
-
setting.ini
-
大众印客精灵-使用说明V1.0.0.doc.doc windows office2003