����
Overview
overview
7Static
static
7ע�...�).exe
windows7-x64
3ע�...�).exe
windows10-2004-x64
3ж�...60.exe
windows7-x64
5ж�...60.exe
windows10-2004-x64
5滻�...te.dll
windows7-x64
5滻�...te.dll
windows10-2004-x64
5滻�...IL.dll
windows7-x64
5滻�...IL.dll
windows10-2004-x64
5滻�...IL.dll
windows7-x64
5滻�...IL.dll
windows10-2004-x64
5Behavioral task
behavioral1
Sample
ע汾/ж(ע).exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ע汾/ж(ע).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
ж4060.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
ж4060.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
滻ļ汾1/Calculate.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
滻ļ汾1/Calculate.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
滻ļ汾1/DevIL.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
滻ļ汾1/DevIL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
滻ļ汾2/DevIL.dll
Resource
win7-20240903-en
General
-
Target
449ea471131890b9006824c206497ab1_JaffaCakes118
-
Size
2.7MB
-
MD5
449ea471131890b9006824c206497ab1
-
SHA1
d9fa73840e149c3df191b18594ff44d0b887ce8b
-
SHA256
9f41088caab09274f60680555a67f7a88fdb69ec962f2d4b5860e46d50352701
-
SHA512
745d3a99f3be9baa48a4d6a0f17397ce09b1cc7f4e349bf775cae7c02eb9c20a801899e51decea938027f0cb99cfe7ff7407232205ba9d4e9c0b9c18a6aeb245
-
SSDEEP
49152:eXxbbLHyORSpkBH4F/2xvCufIFis3zAOZbuNpNpr8W5etyhWgSiuFaLlbooh9e:ehbbzRSpkBYF/2x3IFisTCNh8W5SyhWd
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
resource yara_rule static1/unpack001/滻ļ汾1/Calculate.dll acprotect static1/unpack001/滻ļ汾1/DevIL.dll acprotect static1/unpack001/滻ļ汾2/DevIL.dll acprotect -
resource yara_rule static1/unpack001/ж4060.exe upx static1/unpack001/滻ļ汾1/Calculate.dll upx static1/unpack001/滻ļ汾1/DevIL.dll upx static1/unpack001/滻ļ汾2/DevIL.dll upx -
Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/ע汾/ж(ע).exe unpack001/ж4060.exe unpack001/滻ļ汾1/Calculate.dll unpack001/滻ļ汾1/DevIL.dll unpack001/滻ļ汾2/DevIL.dll
Files
-
449ea471131890b9006824c206497ab1_JaffaCakes118.zip
-
˵(ʹñض).txt
-
ע汾/ж(ע).exe.exe windows:4 windows x86 arch:x86
429f539d86f0aef997381ae522ea4ab4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLocalTime
GetSystemTime
GetTimeZoneInformation
RaiseException
RtlUnwind
GetStartupInfoA
GetOEMCP
GetCPInfo
GetProcessVersion
SetErrorMode
GlobalFlags
GetCurrentThread
TerminateProcess
GetFileTime
GetFileSize
TlsGetValue
LocalReAlloc
TlsSetValue
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
lstrcmpA
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpiA
GetThreadLocale
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
DuplicateHandle
lstrcpynA
SetLastError
FileTimeToLocalFileTime
FileTimeToSystemTime
FormatMessageA
LocalFree
InterlockedDecrement
InterlockedIncrement
HeapSize
GetACP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
SetEnvironmentVariableA
LCMapStringA
LCMapStringW
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
InterlockedExchange
Beep
LoadLibraryExA
WideCharToMultiByte
MultiByteToWideChar
GetCurrentProcess
GetWindowsDirectoryA
GetSystemDirectoryA
CreateSemaphoreA
ResumeThread
ReleaseSemaphore
EnterCriticalSection
LeaveCriticalSection
GetProfileStringA
WriteFile
ReadFile
GetLastError
WaitForMultipleObjects
CreateFileA
SetEvent
FindResourceA
LoadResource
LockResource
GetModuleFileNameA
GetCurrentThreadId
ExitProcess
GlobalSize
GlobalFree
DeleteCriticalSection
InitializeCriticalSection
lstrcatA
WinExec
lstrcpyA
FindNextFileA
GlobalReAlloc
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
GetFullPathNameA
FreeLibrary
LoadLibraryA
lstrlenA
GetVersionExA
WritePrivateProfileStringA
CreateThread
CreateEventA
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
GetTempPathA
FindFirstFileA
FindClose
GetFileAttributesA
DeleteFileA
SetCurrentDirectoryA
GetVolumeInformationA
GetModuleHandleA
GetProcAddress
MulDiv
GetCommandLineA
GetTickCount
WaitForSingleObject
CloseHandle
user32
CreateIconIndirect
GetIconInfo
CopyIcon
LoadStringA
SetWindowTextA
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
GetMenuItemCount
GetMenuItemID
GetMenuState
GetWindowTextA
GetClassNameA
GetForegroundWindow
SystemParametersInfoA
TranslateMessage
LoadIconA
DrawFrameControl
DrawEdge
DrawFocusRect
WindowFromPoint
GetMessageA
DispatchMessageA
SetRectEmpty
RegisterClipboardFormatA
CreateIconFromResourceEx
CreateIconFromResource
DrawIconEx
CreatePopupMenu
AppendMenuA
ModifyMenuA
CreateMenu
CreateAcceleratorTableA
GetDlgCtrlID
GetSubMenu
EnableMenuItem
ClientToScreen
EnumDisplaySettingsA
LoadImageA
ShowWindow
IsWindowEnabled
TranslateAcceleratorA
GetKeyState
CopyAcceleratorTableA
PostQuitMessage
IsZoomed
GetSystemMenu
DeleteMenu
GetClassInfoA
DefWindowProcA
GetMenu
SetMenu
PeekMessageA
IsIconic
SetFocus
GetActiveWindow
GetWindow
DestroyAcceleratorTable
SetWindowRgn
GetMessagePos
ScreenToClient
ChildWindowFromPointEx
CopyRect
LoadBitmapA
WinHelpA
KillTimer
SetTimer
ReleaseCapture
UnregisterClassA
SetCapture
GetScrollRange
SetScrollRange
SetScrollPos
InflateRect
SetRect
IntersectRect
DestroyIcon
PtInRect
OffsetRect
IsWindowVisible
EnableWindow
RedrawWindow
GetWindowLongA
SetWindowLongA
GetSysColor
SetActiveWindow
SetCursorPos
LoadCursorA
SetCursor
GetDC
FillRect
IsRectEmpty
ReleaseDC
IsChild
DestroyMenu
SetForegroundWindow
GetWindowRect
EqualRect
UpdateWindow
ValidateRect
InvalidateRect
GetClientRect
GetFocus
GetWindowTextLengthA
CharUpperA
GetWindowDC
BeginPaint
EndPaint
TabbedTextOutA
DrawTextA
GrayStringA
GetDlgItem
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetNextDlgTabItem
GetWindowPlacement
RegisterWindowMessageA
GetLastActivePopup
GetMessageTime
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
RegisterClassA
GetScrollPos
AdjustWindowRectEx
MapWindowPoints
SendDlgItemMessageA
ScrollWindowEx
IsDialogMessageA
MoveWindow
CheckMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
GetDesktopWindow
CharNextA
SetWindowContextHelpId
MapDialogRect
GetSysColorBrush
GetNextDlgGroupItem
PostThreadMessageA
GetParent
GetTopWindow
PostMessageA
IsWindow
SetParent
DestroyCursor
SendMessageA
SetWindowPos
MessageBeep
MessageBoxA
GetCursorPos
GetSystemMetrics
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
wsprintfA
GetCapture
gdi32
GetMapMode
Escape
ExtTextOutA
MoveToEx
LineTo
SetTextColor
GetTextMetricsA
OffsetRgn
FrameRgn
SetBkColor
CreateRectRgnIndirect
CreateDIBSection
SetStretchBltMode
GetClipRgn
CreatePolygonRgn
SelectClipRgn
DeleteObject
CreateDIBitmap
GetSystemPaletteEntries
CreatePalette
StretchBlt
SelectPalette
RealizePalette
GetDIBits
GetWindowExtEx
GetViewportOrgEx
GetWindowOrgEx
BeginPath
EndPath
PathToRegion
CreateEllipticRgn
CreateRoundRectRgn
GetTextColor
GetBkMode
GetBkColor
GetROP2
GetStretchBltMode
GetPolyFillMode
CreateCompatibleBitmap
CreateDCA
CreateBitmap
SelectObject
GetObjectA
CreatePen
PatBlt
FillRgn
CreateRectRgn
CombineRgn
CreateSolidBrush
GetStockObject
CreateFontIndirectA
EndPage
EndDoc
DeleteDC
StartDocA
ExcludeClipRect
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
StartPage
BitBlt
CreateCompatibleDC
Ellipse
Rectangle
LPtoDP
DPtoLP
GetCurrentObject
RoundRect
GetTextExtentPoint32A
GetDeviceCaps
TextOutA
RectVisible
PtVisible
GetViewportExtEx
ExtSelectClipRgn
winmm
midiOutReset
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
waveOutPause
waveOutReset
waveOutClose
waveOutGetNumDevs
midiStreamClose
waveOutOpen
midiOutUnprepareHeader
midiStreamOpen
midiStreamProperty
midiOutPrepareHeader
midiStreamOut
midiStreamStop
midiStreamRestart
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
advapi32
RegCreateKeyExA
RegQueryValueA
RegSetValueExA
RegOpenKeyExA
RegCloseKey
shell32
ShellExecuteA
Shell_NotifyIconA
SHGetSpecialFolderPathA
ole32
CreateILockBytesOnHGlobal
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
StgCreateDocfileOnILockBytes
CoTaskMemFree
CLSIDFromProgID
CLSIDFromString
OleInitialize
StgOpenStorageOnILockBytes
CoGetClassObject
CoTaskMemAlloc
OleUninitialize
oleaut32
SysStringLen
SysAllocStringLen
VariantCopy
VariantClear
VariantChangeType
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayUnaccessData
SafeArrayAccessData
SysAllocString
SafeArrayCreate
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
OleCreateFontIndirect
SysFreeString
SafeArrayGetElemsize
SysAllocStringByteLen
VariantTimeToSystemTime
comctl32
ImageList_GetImageInfo
ImageList_GetImageCount
ord17
ImageList_Destroy
ImageList_Read
ImageList_Duplicate
ImageList_GetIcon
oledlg
ord8
ws2_32
closesocket
WSAAsyncSelect
recvfrom
ioctlsocket
recv
WSACleanup
getpeername
accept
inet_ntoa
comdlg32
GetFileTitleA
GetSaveFileNameA
GetOpenFileNameA
ChooseColorA
Sections
.text Size: 592KB - Virtual size: 588KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 456KB - Virtual size: 454KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 72KB - Virtual size: 218KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 60KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
下载说明.htm.html .js polyglot
-
ж4060.exe.exe windows:4 windows x86 arch:x86
d85e97d1b549ba6f26b7db0525e5bf91
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
winmm
waveOutClose
ws2_32
closesocket
kernel32
GetStringTypeW
GetModuleHandleA
LoadLibraryA
VirtualAlloc
GetModuleFileNameA
ExitProcess
user32
UnregisterClassA
MessageBoxA
gdi32
Escape
winspool.drv
DocumentPropertiesA
comdlg32
GetSaveFileNameA
advapi32
RegQueryValueA
shell32
SHGetSpecialFolderPathA
ole32
StgCreateDocfileOnILockBytes
oleaut32
VariantClear
comctl32
ImageList_GetImageCount
oledlg
ord8
Sections
.text Size: - Virtual size: 803KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 740KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 386KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 458KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
滻ļ汾1/Calculate.dll.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 580KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 245KB - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
滻ļ汾1/DevIL.dll.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
_icalloc@8
iBindImageTemp
iConvertImage
iConvertPal
iCopyPal
iGetFlipped
ialloc
ifree
ilActiveImage
ilActiveLayer
ilActiveMipmap
ilApplyPal
ilApplyProfile
ilBindImage
ilBlit
ilClearColour
ilClearImage
ilClearImage_
ilCloneCurImage
ilCloseImage
ilClosePal
ilCompressFunc
ilConvertBuffer
ilConvertImage
ilConvertPal
ilCopyImage
ilCopyImageAttr
ilCopyImage_
ilCopyPixels
ilCreateSubImage
ilDefaultImage
ilDeleteImages
ilDisable
ilEnable
ilFormatFunc
ilGenImages
ilGetAlpha
ilGetBoolean
ilGetBooleanv
ilGetBppFormat
ilGetBppPal
ilGetBppType
ilGetClear
ilGetCurImage
ilGetCurName
ilGetDXTCData
ilGetData
ilGetError
ilGetInteger
ilGetIntegerv
ilGetLumpPos
ilGetPalBaseType
ilGetPalette
ilGetString
ilGetTypeBpc
ilHint
ilInit
ilIsDisabled
ilIsEnabled
ilIsImage
ilIsValid
ilIsValidF
ilIsValidL
ilIsValidPal
ilKeyColour
ilLoad
ilLoadData
ilLoadDataF
ilLoadDataL
ilLoadF
ilLoadFromJpegStruct
ilLoadImage
ilLoadL
ilLoadPal
ilNewImage
ilNextPower2
ilOriginFunc
ilOverlayImage
ilPopAttrib
ilPushAttrib
ilRegisterFormat
ilRegisterLoad
ilRegisterMipNum
ilRegisterNumImages
ilRegisterOrigin
ilRegisterPal
ilRegisterSave
ilRegisterType
ilRemoveLoad
ilRemoveSave
ilReplaceCurImage
ilResetMemory
ilResetRead
ilResetWrite
ilResizeImage
ilSave
ilSaveData
ilSaveF
ilSaveFromJpegStruct
ilSaveImage
ilSaveL
ilSavePal
ilSetCurImage
ilSetData
ilSetDuration
ilSetError
ilSetInteger
ilSetMemory
ilSetPal
ilSetPixels
ilSetRead
ilSetString
ilSetWrite
ilShutDown
ilTexImage
ilTexImage_
ilTexSubImage_
ilTypeFromExt
ilTypeFunc
Sections
UPX0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 242KB - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
滻ļ汾1/˵.txt
-
滻ļ汾2/DevIL.dll.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
ilInit
ilShutDown
Sections
UPX0 Size: - Virtual size: 580KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 245KB - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
滻ļ汾2/˵.txt