General

Malware Config

Signatures

Files

• f9e938e4cef7df9c20c9f831eedd1726_JaffaCakes118

  .cab
• PLAY_M~1.EXE

  .exe windows:4 windows x86 arch:x86

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Sections

  CODE

  Size: 54KB - Virtual size: 54KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  DATA

  Size: 41KB - Virtual size: 40KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  BSS

  Size: - Virtual size: 269B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 1024B - Virtual size: 738B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 512B - Virtual size: 320B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 10KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• PLAY_M~2.EXE

  .exe windows:5 windows x86 arch:x86

  6174b8e95c2d75962cb667091c0db5e3

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  C:\qEjn\jutBwxdL\PDylgVge\lkiNg\sBtWi.pdb

  Imports

  kernel32

  CloseHandle

  GetTickCount

  GetStringTypeW

  DeleteAtom

  QueryPerformanceCounter

  lstrcmpA

  VirtualQueryEx

  TransactNamedPipe

  FileTimeToSystemTime

  SetNamedPipeHandleState

  FindResourceA

  SearchPathW

  user32

  SetActiveWindow

  GetMessageExtraInfo

  CopyAcceleratorTableW

  PtInRect

  SendInput

  ScrollWindow

  CharPrevW

  CopyRect

  MessageBoxExW

  GetDCEx

  EndPaint

  MapVirtualKeyW

  shlwapi

  StrSpnA

  gdi32

  CreateDIBSection

  GetTextExtentPoint32A

  GetCurrentObject

  AddFontResourceW

  GetROP2

  CreateDiscardableBitmap

  GetMapMode

  comctl32

  PropertySheetW

  ImageList_GetIcon

  PropertySheetA

  Exports

  Exports

  ?ArsJzLgv@@YGFPAI@Z

  ?gphZzplhQ@@YGXF@Z

  ?vdiPeblifraqajjllzusji@@YGXE@Z

  ?OHobdzbu@@YGXGPAE@Z

  ?mWxJnvkjhOawsUpomgu@@YGGD@Z

  ?ncCyeluKfRiFy@@YGDPA_N@Z

  Sections

  .text

  Size: 9KB - Virtual size: 8KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 92KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .crt

  Size: 10KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 132KB - Virtual size: 132KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ