Overview
overview
3Static
static
3CorelDRAW_...��.url
windows7-x64
1CorelDRAW_...��.url
windows10-2004-x64
1CorelDRAW_...21.exe
windows7-x64
3CorelDRAW_...21.exe
windows10-2004-x64
3CorelDRAW_...��.url
windows7-x64
1CorelDRAW_...��.url
windows10-2004-x64
1CorelDRAW_...��.url
windows7-x64
1CorelDRAW_...��.url
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
CorelDRAW_66868.com/2345网址导航.url
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
CorelDRAW_66868.com/2345网址导航.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
CorelDRAW_66868.com/CorelDRAW+X5+v15.2.0.661+官方简体中文版++-+一款矢量图形制作工具软件@162_40721.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
CorelDRAW_66868.com/CorelDRAW+X5+v15.2.0.661+官方简体中文版++-+一款矢量图形制作工具软件@162_40721.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
CorelDRAW_66868.com/U盘启动盘制作工具 - U盘装系统,一键制作U盘.url
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
CorelDRAW_66868.com/U盘启动盘制作工具 - U盘装系统,一键制作U盘.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
CorelDRAW_66868.com/软件下载-软件下载第一门户.url
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
CorelDRAW_66868.com/软件下载-软件下载第一门户.url
Resource
win10v2004-20240802-en
General
-
Target
d2b64f1718cd774de61ae823d6292d0e_JaffaCakes118
-
Size
399KB
-
MD5
d2b64f1718cd774de61ae823d6292d0e
-
SHA1
e9008b4d51da63f35b6c591ff2150a81ae63e2f8
-
SHA256
7e5adbaeb2ecc70a6e9aed5f3257ccd1ceb599ee01c4f5162dac04a1158cd635
-
SHA512
263d0bdc1ba0f3ae359aa6bfb52d32457937e2f4c0bf6d3d2ec8aaa02357109082c38fee9a0fea669c60ede1a069545d8e986bbe6bcee673f4df3f94b0ffc0b1
-
SSDEEP
6144:NPKOYWAcXjMka85RfHML1kalhgOSbzm+VIwWkvmhbC7H5Hpm1sx2+raYnLt:DYWAczJ5/CKzm+Vib8+1sxaYnLt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/CorelDRAW_66868.com/CorelDRAW+X5+v15.2.0.661+官方简体中文版++-+一款矢量图形制作工具软件@162_40721.exe
Files
-
d2b64f1718cd774de61ae823d6292d0e_JaffaCakes118.rar
-
CorelDRAW_66868.com/2345网址导航.url.url
-
CorelDRAW_66868.com/CorelDRAW+X5+v15.2.0.661+官方简体中文版++-+一款矢量图形制作工具软件@162_40721.exe.exe windows:5 windows x86 arch:x86
92f3d51985fa8e7301dbabc3cc91c7cb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeviceIoControl
GetModuleFileNameA
WideCharToMultiByte
MultiByteToWideChar
ExitProcess
FindFirstFileW
MapViewOfFile
UnmapViewOfFile
GetCurrentProcess
SetEvent
GetSystemDirectoryW
TerminateProcess
GetSystemDirectoryA
WritePrivateProfileStringW
FindClose
GetLocalTime
Process32FirstW
CreateFileMappingW
CreateEventW
Process32NextW
FindNextFileW
CreateToolhelp32Snapshot
SetFileAttributesW
CreateMutexW
SetUnhandledExceptionFilter
GetComputerNameW
GetModuleFileNameW
SetCurrentDirectoryW
GetCurrentThreadId
GetCurrentProcessId
LoadLibraryW
GetTempPathW
GetProcAddress
MoveFileW
DeleteFileW
InterlockedIncrement
DosDateTimeToFileTime
SystemTimeToFileTime
ReadFile
CreateFileW
GetCurrentDirectoryW
GetFileType
GetVersionExW
lstrlenA
FlushFileBuffers
WriteConsoleW
SetStdHandle
LoadLibraryExW
LCMapStringW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
QueryPerformanceCounter
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
RtlUnwind
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
UnhandledExceptionFilter
GetStdHandle
AreFileApisANSI
GetModuleHandleExW
SetLastError
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetCommandLineW
GetModuleHandleW
CreateThread
DeleteFileA
GetTempPathA
CloseHandle
WaitForMultipleObjects
CreateDirectoryA
CreateProcessA
Sleep
InitializeCriticalSection
WriteFile
GetTickCount
WaitForSingleObject
InterlockedDecrement
SetEndOfFile
SetFilePointer
HeapReAlloc
CreateFileA
DeleteCriticalSection
DecodePointer
EnterCriticalSection
HeapSize
GetLastError
InterlockedExchange
RaiseException
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapFree
IsProcessorFeaturePresent
ResumeThread
ExitThread
EncodePointer
VirtualQuery
VirtualProtect
VirtualAlloc
GetSystemInfo
OutputDebugStringW
IsDebuggerPresent
HeapAlloc
LocalFree
user32
MessageBoxW
DispatchMessageW
CopyRect
DefWindowProcW
SendMessageW
SetWindowTextA
GetSystemMetrics
PtInRect
IsWindow
FillRect
GetCursorPos
SetWindowPos
GetDesktopWindow
SetWindowLongW
EnableMenuItem
ReleaseDC
GetWindowTextW
TrackPopupMenu
PostQuitMessage
GetDC
GetWindowLongW
LoadMenuW
CreateWindowExW
KillTimer
SetRect
GetMessageW
SetTimer
LoadIconW
RegisterClassExW
TranslateMessage
DrawTextA
GetSubMenu
LoadCursorW
GetSystemMenu
CharNextA
SetRectEmpty
BeginPaint
ShowWindow
DestroyWindow
EnableWindow
SetForegroundWindow
EndPaint
SetCursor
gdi32
SetTextColor
CreateCompatibleBitmap
FrameRgn
GetTextExtentPoint32A
EnumFontsW
StretchBlt
SetBkMode
CreateFontW
GetDIBColorTable
CreateRoundRectRgn
CreateSolidBrush
TextOutA
BitBlt
DeleteDC
CreateDIBSection
SetDIBColorTable
DeleteObject
SelectObject
CreateCompatibleDC
GetObjectW
advapi32
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
shell32
Shell_NotifyIconW
SHGetPathFromIDListW
ord165
ShellExecuteA
SHGetPathFromIDListA
SHGetSpecialFolderPathA
SHGetSpecialFolderLocation
ole32
CoInitialize
CoCreateInstance
CreateStreamOnHGlobal
CoUninitialize
CLSIDFromString
oleaut32
VariantClear
VariantInit
SysAllocString
GetErrorInfo
SysFreeString
ws2_32
htons
gethostbyname
closesocket
recv
setsockopt
send
WSAStartup
recvfrom
sendto
connect
inet_ntoa
inet_addr
socket
shlwapi
PathFileExistsA
PathIsDirectoryW
PathRemoveFileSpecW
PathFileExistsW
PathAppendW
StrStrIW
StrStrIA
gdiplus
GdiplusShutdown
GdipFree
GdiplusStartup
GdipGetImageWidth
GdipCloneImage
GdipBitmapLockBits
GdipGetImagePaletteSize
GdipDisposeImage
GdipAlloc
GdipDrawImageI
GdipBitmapUnlockBits
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImageHeight
msimg32
TransparentBlt
AlphaBlend
iphlpapi
GetAdaptersInfo
setupapi
SetupIterateCabinetW
urlmon
URLDownloadToFileW
dbghelp
MiniDumpWriteDump
Sections
.text Size: 228KB - Virtual size: 227KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 412KB - Virtual size: 422KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
CorelDRAW_66868.com/U盘启动盘制作工具 - U盘装系统,一键制作U盘.url.url
-
CorelDRAW_66868.com/软件下载-软件下载第一门户.url.url