ea2b4a40c2da6d506ffb9db094507956_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ea2b4a40c2da6d506ffb9db094507956_JaffaCakes118
Size

5.9MB
MD5

ea2b4a40c2da6d506ffb9db094507956
SHA1

b25cfc31d176fc49663e988667c84eb909e9fae0
SHA256

4d74800bdebef83426d573c96bafb273da29503ea03ee35edbba15c6bacacac7
SHA512

f0b4b32fa975dcf251ae6e2d75dccc2f85ee880d996b3c66d2c13af2dea5ded1d138fd41fb88db6fca7c6a9369256d17d77e0a67790e256004bb0814d18140a6
SSDEEP

98304:OupB7JGOY0kwUqakU0Gx7Yo1S9JixT8XxYlnVSopko00iVIUcDrEb2RxUBPEyjHB:RL7dYxtT8BM5ko4IUcU2W1EyjHmTIS6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ea2b4a40c2da6d506ffb9db094507956_JaffaCakes118

Files

ea2b4a40c2da6d506ffb9db094507956_JaffaCakes118
.exe windows:5 windows x86 arch:x86

75fc1e63be46af873fd8a50aaf1ff9c6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\VC_CODE\CDG_OUT_基线版\OutPut\ODMGuard\ODMGuard.pdb

Imports

kernel32

GetStringTypeExW
GetThreadLocale
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetFullPathNameW
GetShortPathNameW
GetFileAttributesExW
LocalFileTimeToFileTime
SystemTimeToFileTime
SetFileTime
GetFileSizeEx
GetFileTime
lstrcmpW
LoadLibraryA
CompareStringW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
FreeResource
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GlobalFree
GetModuleHandleA
SetThreadPriority
InterlockedExchange
CompareStringA
LoadLibraryExW
GetLocaleInfoW
lstrcmpA
EnumResourceLanguagesW
ConvertDefaultLocale
GetCurrentThread
CreateSemaphoreW
ReleaseSemaphore
ReleaseMutex
WaitForMultipleObjects
SetErrorMode
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
GlobalFlags
InterlockedIncrement
GlobalGetAtomNameW
GetAtomNameW
GetStartupInfoW
HeapFree
GetDriveTypeW
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
ExitProcess
MoveFileW
GetFileAttributesA
GetFileType
SetEnvironmentVariableW
HeapReAlloc
ExitThread
HeapSize
VirtualAlloc
VirtualQuery
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoA
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
FatalAppExitA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeFormatA
GetDateFormatA
LCMapStringA
LCMapStringW
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetConsoleCP
GetConsoleMode
GetProcessHeap
GetCurrentDirectoryA
SetCurrentDirectoryA
GetDriveTypeA
GetFullPathNameA
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
GetModuleFileNameA
CreateFileA
WaitForDebugEvent
GetThreadContext
SetThreadContext
FlushInstructionCache
ContinueDebugEvent
GetProcessVersion
ReadProcessMemory
VirtualProtectEx
SuspendThread
GetLogicalDriveStringsW
QueryDosDeviceW
GetLocalTime
PeekNamedPipe
GetFileInformationByHandle
FindFirstFileA
DefineDosDeviceW
MoveFileExW
DebugBreak
InterlockedCompareExchange
DeleteFileA
SetVolumeLabelW
lstrcpynA
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
lstrcmpiA
GetTempPathW
LocalAlloc
LocalFree
InterlockedDecrement
RemoveDirectoryW
GetSystemInfo
GetCommandLineW
GetWindowsDirectoryW
GetDiskFreeSpaceExW
GetSystemDefaultLangID
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
SetSystemTime
GetSystemTime
GetLogicalDrives
Process32FirstW
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetLongPathNameW
GetEnvironmentVariableW
UnmapViewOfFile
GetProcessTimes
GetSystemTimeAsFileTime
Module32FirstW
Module32NextW
FormatMessageW
GetVolumeInformationW
CreateMutexW
GetCurrentProcessId
GetCurrentDirectoryW
CreateDirectoryW
CopyFileW
SetFileAttributesW
GetPrivateProfileStringW
OpenThread
CreateToolhelp32Snapshot
Process32NextW
OpenProcess
OpenMutexW
CreateProcessW
CreateNamedPipeW
ConnectNamedPipe
DisconnectNamedPipe
GetVersionExA
CreateEventW
ResetEvent
WaitForSingleObject
CreateThread
GetCurrentThreadId
GetTickCount
OpenEventW
SetEvent
FreeLibrary
OutputDebugStringW
IsBadStringPtrW
IsBadStringPtrA
TerminateProcess
IsBadCodePtr
GetVersion
IsBadReadPtr
IsBadWritePtr
VirtualProtect
GetWindowsDirectoryA
lstrcatA
GetPrivateProfileIntW
WritePrivateProfileStringW
Sleep
ResumeThread
GetModuleHandleW
LoadLibraryW
GetProcAddress
ExpandEnvironmentStringsW
SearchPathW
SetLastError
GetFileAttributesW
lstrcmpiW
lstrcpynW
GetVersionExW
GetCurrentProcess
SetPriorityClass
LoadResource
LockResource
SizeofResource
FindResourceW
FileTimeToLocalFileTime
FileTimeToSystemTime
SetCurrentDirectoryW
FindFirstFileW
FindNextFileW
FindClose
lstrcpyW
GetModuleFileNameW
GetSystemDirectoryW
lstrcatW
DeleteFileW
GetDiskFreeSpaceW
lstrlenW
WideCharToMultiByte
GetLastError
SetFilePointer
lstrlenA
MultiByteToWideChar
GetFileSize
DeviceIoControl
CreateFileW
ReadFile
CloseHandle
HeapAlloc
WriteFile

user32

GetMessageW
TranslateMessage
GetCursorPos
ValidateRect
GetActiveWindow
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
FillRect
GetMenuStringW
InsertMenuW
RemoveMenu
IsWindowEnabled
MoveWindow
SetWindowTextW
IsDialogMessageW
IsDlgButtonChecked
SetDlgItemTextW
SetDlgItemInt
GetDlgItemTextW
GetDlgItemInt
CheckRadioButton
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
RegisterWindowMessageW
LoadMenuW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetFocus
SetCapture
SendMessageW
EnableWindow
IsWindow
SystemParametersInfoW
GetWindowTextLengthW
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageW
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
UpdateWindow
GetSubMenu
GetMenuItemID
GetMenuItemCount
IsZoomed
SetRectEmpty
InvalidateRect
PostQuitMessage
SetCursor
ShowOwnedPopups
SetWindowContextHelpId
InflateRect
GetMenuItemInfoW
DestroyMenu
MsgWaitForMultipleObjects
GetSysColorBrush
LoadCursorW
GetDialogBaseUnits
UnregisterClassW
TranslateAcceleratorW
BringWindowToTop
CreatePopupMenu
InsertMenuItemW
LoadAcceleratorsW
ReleaseCapture
GetMenuBarInfo
ReuseDDElParam
UnpackDDElParam
SetRect
WindowFromPoint
SendDlgItemMessageW
DeleteMenu
GetClientRect
ScrollWindowEx
MapDialogRect
wsprintfW
LoadIconW
SetWindowLongW
GetWindowLongW
PostMessageW
GetDesktopWindow
GetWindow
GetDlgCtrlID
BroadcastSystemMessageW
GetDlgItem
SetForegroundWindow
DrawIcon
GetSystemMetrics
IsIconic
GetWindowRect
MessageBoxW
WaitMessage
DestroyIcon
CharNextW
CopyAcceleratorTableW
IsRectEmpty
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
SetParent
RegisterClipboardFormatW
UnionRect
GetDCEx
LockWindowUpdate
PostThreadMessageW
SetFocus
SetWindowsHookExW
CallNextHookEx
PeekMessageW
UnhookWindowsHookEx
EnumChildWindows
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
DefWindowProcW
CallWindowProcW
PtInRect
GetMenu
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
MapVirtualKeyW
GetKeyNameTextW
ReleaseDC
GetDC
CopyRect
CharUpperW
KillTimer
GetSystemMenu
AppendMenuW
SetTimer
ShowWindow
EnumWindows
GetWindowThreadProcessId
IsWindowVisible
wsprintfA
WaitForInputIdle
GetClassNameW
GetParent
GetWindowTextW

gdi32

DPtoLP
GetRgnBox
GetMapMode
GetTextColor
GetBkColor
CombineRgn
SetRectRgn
CreateCompatibleBitmap
StretchDIBits
CreateFontW
GetCharWidthW
GetTextMetricsW
CreateHatchBrush
CreateSolidBrush
ExtCreatePen
CreatePen
PlayMetaFile
EnumMetaFile
GetObjectType
PlayMetaFileRecord
SelectPalette
GetStockObject
CreateCompatibleDC
CreatePatternBrush
CreateDIBPatternBrushPt
DeleteDC
TextOutW
ExtSelectClipRgn
PolyBezierTo
PolylineTo
PolyDraw
ArcTo
RectVisible
PtVisible
StartDocW
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
DeleteObject
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
SetMapMode
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
CreateDCW
CopyMetaFileW
GetDeviceCaps
CreateBitmap
GetObjectW
SetBkColor
SetTextColor
GetClipBox
GetDCOrgEx
PatBlt
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
GetTextExtentPoint32W
CreateRectRgnIndirect
CreateFontIndirectW
ExtTextOutW

comdlg32

GetOpenFileNameW
GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegCreateKeyW
DeregisterEventSource
RegisterEventSourceW
QueryServiceConfigW
ControlService
QueryServiceStatusEx
ChangeServiceConfigW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
RegQueryValueW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExW
RegDeleteValueW
ReportEventW
RegSetValueW
RegOpenKeyW
RegDeleteKeyW
RegEnumKeyExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryInfoKeyW
RegEnumKeyW
RegEnumValueW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey

shell32

ExtractIconW
SHGetFileInfoW
SHGetSpecialFolderLocation
SHGetMalloc
SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteExW
FindExecutableW
SHChangeNotify
ShellExecuteW
ord680
DragFinish
SHGetSpecialFolderPathW
DragQueryFileW

shlwapi

StrStrIW
StrStrIA
SHSetValueW
PathFileExistsW
PathFindFileNameW
SHGetValueW
SHDeleteValueW
PathStripToRootW
PathIsUNCW
PathFindExtensionW
PathRemoveExtensionW
PathRemoveFileSpecW

oledlg

OleUIBusyW

ole32

CLSIDFromString
CLSIDFromProgID
CoRegisterClassObject
CoDisconnectObject
CoRevokeClassObject
OleSetClipboard
StringFromGUID2
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoInitializeEx
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
OleIsCurrentClipboard
CoTreatAsClass
StringFromCLSID
CoTaskMemAlloc
ReleaseStgMedium
CreateBindCtx
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
OleRun
CoCreateGuid
CoCreateInstance
CoUninitialize
CoInitialize
OleFlushClipboard
CoRegisterMessageFilter
CreateStreamOnHGlobal
OleDuplicateData

oleaut32

SysAllocString
SysFreeString
SysAllocStringByteLen
SysStringByteLen
SafeArrayGetElement
VariantClear
VariantInit
VariantCopy
SafeArrayPutElement
SafeArrayCreate
SysAllocStringLen
VariantChangeType
SysStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayRedim
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayCopy
SafeArrayPtrOfIndex
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
VarDateFromStr
SysReAllocStringLen
VarCyFromStr
VarBstrFromCy
VarBstrFromDec
VarDecFromStr
VarBstrFromDate
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
GetErrorInfo
SetErrorInfo
CreateErrorInfo

iphlpapi

GetAdaptersInfo

ntdll

NtClose
RtlNtStatusToDosError
NtCreateFile
ZwQueryObject
RtlUnicodeStringToAnsiString
RtlFreeAnsiString

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

imagehlp

ImageLoad
ImageUnload

psapi

GetMappedFileNameW
GetModuleFileNameExW
EnumProcessModules
GetModuleInformation

winmm

timeGetTime

setupapi

SetupDiGetDeviceInstallParamsW
SetupDiCallClassInstaller
SetupDiSetClassInstallParamsW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
CM_Get_DevNode_Status
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiChangeState

ws2_32

htons
inet_addr
select
connect
send
gethostbyname
socket
htonl
ntohl
WSAStartup
WSACleanup
recv
closesocket

Exports

Exports

FormatNTFS

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 318KB - Virtual size: 317KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

75fc1e63be46af873fd8a50aaf1ff9c6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

oledlg

ole32

oleaut32

iphlpapi

ntdll

version

imagehlp

psapi

winmm

setupapi

ws2_32

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 318KB - Virtual size: 317KB

.data Size: 34KB - Virtual size: 74KB

.rsrc Size: 4.2MB - Virtual size: 4.2MB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 318KB - Virtual size: 317KB

.data
Size: 34KB - Virtual size: 74KB

.rsrc
Size: 4.2MB - Virtual size: 4.2MB