Static task
static1
Behavioral task
behavioral1
Sample
HB_PDF2TXT31_ljh.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
HB_PDF2TXT31_ljh.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
pdf2txt_setup_200531.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
pdf2txt_setup_200531.exe
Resource
win10v2004-20240802-en
General
-
Target
bbe030163a76b1327c0a23b59ea0f129_JaffaCakes118
-
Size
1.4MB
-
MD5
bbe030163a76b1327c0a23b59ea0f129
-
SHA1
cd8e3d909dc1f8a0b2379a69f8ff6061035d0c17
-
SHA256
002ae97c8c9a1f18afadedfff7c944e481ba0e300b94cc608ed1eca473c41d85
-
SHA512
e44eb98e667e580164ee7987b095f9cbb4a2f5db0b96dac2d5e648ca5dce4af45bd33ad233850f15e1bd55cd2e05e34a8f57c0870e3022a2474a1b1d3737ad3a
-
SSDEEP
24576:x2lNzi1rn9hLvk00bOxG69QmkfSmElju87mPitR7kVFt9RWg8JKJNtIRW5TzfS4c:EFi1rn/Lvk+xD9QmPmaj7SPif7ut9R8B
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/HB_PDF2TXT31_ljh.EXE unpack001/pdf2txt_setup_200531.exe
Files
-
bbe030163a76b1327c0a23b59ea0f129_JaffaCakes118.rar
-
HB_PDF2TXT31_ljh.EXE.exe windows:4 windows x86 arch:x86
22b1d33cc59791fd53b4a9983e84da85
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
SHGetValueA
SHSetValueA
kernel32
FreeResource
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
GetShortPathNameA
CreateDirectoryA
lstrlenA
InterlockedDecrement
GetVersionExA
GetModuleFileNameA
GetTempPathA
WinExec
DeleteFileA
WaitForSingleObject
GetWindowsDirectoryA
GetStartupInfoA
FindResourceA
LoadResource
SizeofResource
LockResource
GetEnvironmentVariableA
GetModuleHandleA
user32
GetPropA
RemovePropA
GetCursorPos
PtInRect
LoadCursorA
SetCursor
TrackMouseEvent
InvalidateRect
GetParent
PostMessageA
DefWindowProcA
ShowWindow
CopyRect
ClientToScreen
GetDC
DrawTextA
ReleaseDC
SetPropA
SetWindowLongA
UpdateWindow
DialogBoxParamA
SendMessageA
IsWindow
CheckDlgButton
BeginPaint
GetClientRect
FillRect
EndPaint
EndDialog
IsDlgButtonChecked
LoadStringA
GetDlgItem
GetWindowRect
ScreenToClient
GetWindowTextA
gdi32
GetStockObject
CreateFontIndirectA
GetObjectA
DeleteObject
SelectObject
SetTextColor
SetBkMode
GetDeviceCaps
shell32
ShellExecuteA
ShellExecuteExA
ole32
CreateStreamOnHGlobal
oleaut32
OleLoadPicture
msvcrt
strrchr
strncpy
_snprintf
fopen
fwrite
fclose
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
??3@YAXPAX@Z
__CxxFrameHandler
strstr
??2@YAPAXI@Z
_acmdln
free
malloc
_except_handler3
__dllonexit
_onexit
_exit
_XcptFilter
__set_app_type
__p__fmode
__p__commode
exit
_controlfp
Sections
.text Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 916KB - Virtual size: 915KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
pdf2txt_setup_200531.exe.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
下载说明.htm.html .js polyglot
-
汉化新世纪.txt
-
汉化说明.txt