RemoveHook
SetHook
Behavioral task
behavioral1
Sample
WDAspbd.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
WDAspbd.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
zhaoxin.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
zhaoxin.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
ź.url
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
ź.url
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
ʵʹ˵2004.html
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
ʵʹ˵2004.html
Resource
win10v2004-20241007-en
Target
2fd8dd2118b75fd61c57f478f2f426d3_JaffaCakes118
Size
916KB
MD5
2fd8dd2118b75fd61c57f478f2f426d3
SHA1
1b006b11478030f6d70f4de7333d3cf2e420733e
SHA256
60bf916eb6577a5382d3fd61cc64a14605931dfbb56b530de8a1196869a45c05
SHA512
224f8fa770ea904c9bfb6cca3a702c6690b1c66eadb3cbcf3fedb337325dde196bc72268f12e37dc71dd435fdd9495e8c6f67a409d305b5f2c00613790776011
SSDEEP
24576:s14SF7H3Fk7Imm7rn3vPL7jYTESEt6t5fxYft9k+RIeeiLq:s14SF7i+z3XL7jYES061YF9pIeeiLq
resource | yara_rule |
---|---|
static1/unpack002/out.upx | vmprotect |
resource | yara_rule |
---|---|
static1/unpack001/zhaoxin.exe | upx |
Checks for missing Authenticode signature.
resource |
---|
unpack001/WDAspbd.dll |
unpack001/zhaoxin.exe |
unpack002/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PlaySoundA
FileTimeToSystemTime
GetCPInfo
GetOEMCP
FileTimeToLocalFileTime
GetFileAttributesA
GetFileSizeEx
GetFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
CreateThread
GetCommandLineA
RtlUnwind
RaiseException
VirtualAlloc
HeapReAlloc
ExitProcess
HeapSize
GetACP
IsValidCodePage
GetStringTypeA
GetStringTypeW
GlobalFlags
GetConsoleMode
VirtualFree
HeapCreate
HeapDestroy
GetStdHandle
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetModuleFileNameW
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
InterlockedExchange
GetCurrentProcessId
GetModuleFileNameA
GetFullPathNameA
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
lstrcmpA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
FreeLibrary
CompareStringA
LoadLibraryA
lstrcmpW
GetVersionExA
GlobalAlloc
LocalFree
MulDiv
lstrlenA
GlobalLock
SetStdHandle
GlobalUnlock
GlobalFree
FreeResource
GetVolumeInformationA
HeapAlloc
SetLastError
WriteFile
IsDBCSLeadByteEx
SetFilePointer
ReadFile
GetFileSize
CreateFileA
MultiByteToWideChar
HeapFree
GetProcessHeap
FormatMessageA
GetLastError
CloseHandle
Module32Next
Module32First
CreateToolhelp32Snapshot
GetCurrentProcess
WriteProcessMemory
VirtualProtect
GetModuleHandleA
GetProcAddress
Sleep
GetLocalTime
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
WaitForSingleObject
GetTickCount
FindClose
FindFirstFileA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
FindResourceA
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
GetModuleHandleW
GetConsoleCP
DestroyMenu
LoadCursorA
GetSysColorBrush
UnregisterClassA
SetCursor
GetMessageA
TranslateMessage
ValidateRect
WaitMessage
PostQuitMessage
EndPaint
BeginPaint
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
ReleaseDC
GetDC
CharUpperA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
MoveWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
SetFocus
GetWindowTextLengthA
GetLastActivePopup
DispatchMessageA
GetTopWindow
GetMessageTime
PeekMessageA
MapWindowPoints
GetKeyState
SetMenu
UpdateWindow
GetClientRect
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
SystemParametersInfoA
GetWindowPlacement
GetSystemMetrics
GetWindow
GetMenuState
LoadIconA
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetWindowLongA
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
MessageBoxA
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
IsWindowVisible
ScreenToClient
GetCursorPos
PostMessageA
SetForegroundWindow
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
GetWindowRect
SetWindowPos
ShowWindow
IsIconic
GetWindowTextA
KillTimer
SetTimer
SendMessageA
GetParent
EnableWindow
GetMessagePos
DeleteDC
GetStockObject
TextOutA
RectVisible
PtVisible
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
GetDeviceCaps
DeleteObject
SetMapMode
RestoreDC
SaveDC
CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetClipBox
ExtTextOutA
GetFileTitleA
DocumentPropertiesA
OpenPrinterA
ClosePrinter
RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
PathFindExtensionA
PathFindFileNameA
PathStripToRootA
PathIsUNCA
CoCreateGuid
CoTaskMemFree
VariantClear
VariantChangeType
VariantInit
FindMimeFromData
send
recv
WSAAsyncSelect
recvfrom
sendto
connect
WSASetLastError
WSAGetLastError
bind
ioctlsocket
htons
htonl
gethostbyname
select
socket
accept
closesocket
WSACleanup
WSAStartup
HttpEndRequestA
InternetConnectA
InternetOpenA
InternetReadFile
InternetSetOptionA
HttpQueryInfoA
HttpOpenRequestA
InternetWriteFile
HttpSendRequestExA
HttpSendRequestA
HttpAddRequestHeadersA
InternetCloseHandle
GetAdaptersInfo
RemoveHook
SetHook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ