Static task
static1
Behavioral task
behavioral1
Sample
异域数码杂志 2005 第五期/yys_magazine0505.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
异域数码杂志 2005 第五期/yys_magazine0505.exe
Resource
win10v2004-20240802-en
General
-
Target
d0a8ebf796e316511125d510bc4a25eb_JaffaCakes118
-
Size
14.9MB
-
MD5
d0a8ebf796e316511125d510bc4a25eb
-
SHA1
3b01fcdd4a22c9fcc4b0a332f778c370c5c9a443
-
SHA256
1beb4e1666815dc2422122b4ae98c71ee21b88559642bb547c991586cdfa8166
-
SHA512
1eeb8cc4935c4fae053bdb5d9199bf827e2f398029b5b976c00bfe4a054e3be7a25a418306612afdf9630a2e619ca8a4de7e631c6bca099185493a945da73b40
-
SSDEEP
393216:KW0CXJVOx3ztTw8cZ8NzcOdZMcRi6npW2SqYnluYUco/9pMykrB6DxZtXJZ2F:KWF7M3ztTkLmRi6npWXnkYZ6DMHoJZ8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/异域数码杂志 2005 第五期/yys_magazine0505.exe
Files
-
d0a8ebf796e316511125d510bc4a25eb_JaffaCakes118.rar
-
异域数码杂志 2005 第五期/yys_magazine0505.exe.exe windows:4 windows x86 arch:x86
1afbb772a9d24eec8a6a23faa43caa09
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemDirectoryA
CloseHandle
WinExec
WritePrivateProfileStringA
CreateFileA
WriteFile
GetTempFileNameA
GetFileSize
FindClose
FindFirstFileA
GetExitCodeProcess
WaitForSingleObject
OpenProcess
CreateProcessA
GetWindowsDirectoryA
GetModuleFileNameA
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
CreateDirectoryA
GetCurrentDirectoryA
GetCurrentProcess
LocalFree
LocalAlloc
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
GetTempPathA
OutputDebugStringA
DeleteFileA
SetFilePointer
ReadFile
MoveFileA
GetShortPathNameA
GetProcAddress
FreeLibrary
GetLastError
InitializeCriticalSection
GetVersionExA
GetCPInfo
HeapFree
HeapAlloc
InterlockedDecrement
InterlockedIncrement
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
FreeEnvironmentStringsW
FreeEnvironmentStringsA
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
LCMapStringA
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
SetLastError
TlsGetValue
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetCurrentThreadId
TlsSetValue
TlsAlloc
user32
wsprintfA
SystemParametersInfoA
ExitWindowsEx
MessageBoxA
advapi32
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegFlushKey
RegCloseKey
shell32
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ole32
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
RegisterTypeLi
LoadTypeLi
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Sections
.text Size: 56KB - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
异域数码杂志 2005 第五期/下载说明.htm.html .js polyglot