fc28204bf0ec4af4ef648a144255c356_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fc28204bf0ec4af4ef648a144255c356_JaffaCakes118
Size

182KB
MD5

fc28204bf0ec4af4ef648a144255c356
SHA1

ee884e576085bb47eed028da0aa2d5a60431cc42
SHA256

c1c04e370834843f7509ba5423addb489a9fbc1deb3c67655635447187a2bf8a
SHA512

69841cd12b2531f6241000bd473973cce20433bf77b87756de4e390b755e0f35f010c95b06d1b1fd1304984236993af0e68802ef8e664af4c990a258b5192e14
SSDEEP

3072:UemtjfjsOy1nP1ntwqFkCWNYcpcp+5vN0DAwxivgCm+m2XTiXOBiJChx:CB4VnNCaX2Tpcoi4m2XTiXOBiJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fc28204bf0ec4af4ef648a144255c356_JaffaCakes118

Files

fc28204bf0ec4af4ef648a144255c356_JaffaCakes118
.exe windows:5 windows x86 arch:x86

fc24cf477990a4c67c307a8838ea9bb9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Administrator\Desktop\2.3源码\Server\svchost\Release\svchost.pdb

Imports

shlwapi

SHDeleteKeyA

msvcr90

_lock
__dllonexit
_unlock
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
__set_app_type
_encode_pointer
__p__fmode
memset
??2@YAPAXI@Z
__CxxFrameHandler3
_CxxThrowException
??3@YAXPAX@Z
_onexit
strstr
ceil
memmove
strchr
malloc
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
free
strrchr
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
strncpy
??_U@YAPAXI@Z
_decode_pointer
_invoke_watson
memcpy
_controlfp_s
_time64
printf
rand
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_except_handler4_common
calloc
_snprintf
_beginthreadex
atol
sprintf
mbstowcs
wcstombs
_errno
strncmp
atoi
realloc
strncat
srand
_strnicmp

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedCompareExchange
GetCurrentThreadId
GetModuleHandleA
Module32Next
Process32First
lstrcmpiA
Process32Next
Sleep
GetProcAddress
LoadLibraryA
WaitForSingleObject
SetEvent
CreateEventA
CloseHandle
TerminateThread
ResumeThread
CreateThread
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
VirtualAlloc
LeaveCriticalSection
EnterCriticalSection
InterlockedExchange
CancelIo
ResetEvent
lstrlenA
GetPrivateProfileSectionNamesA
lstrcatA
lstrcpyA
GetWindowsDirectoryA
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
lstrcmpA
GetPrivateProfileStringA
GetVersionExA
GetLastError
CreateDirectoryA
GetFileAttributesA
CreateProcessA
GetDriveTypeA
GetDiskFreeSpaceExA
GetVolumeInformationA
GetLogicalDriveStringsA
FindClose
LocalFree
FindNextFileA
LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
DeleteFileA
GetFileSize
CreateFileA
WriteFile
SetFilePointer
MoveFileA
ReadFile
GetModuleFileNameA
SetLastError
GetCurrentProcess
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
ExitThread
GetTickCount
ExitProcess
GetLocalTime
HeapFree
HeapAlloc
GetProcessHeap
LocalSize
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
DisconnectNamedPipe
TerminateProcess
PeekNamedPipe
WaitForMultipleObjects
GetStartupInfoA
CreatePipe
GlobalMemoryStatusEx
GetSystemInfo
MoveFileExA
OpenEventA
SetErrorMode
CreateMutexA
lstrcpyW
WinExec

user32

CreateWindowExA
IsWindow
CloseWindow
PostMessageA
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
CloseDesktop
ExitWindowsEx
EnumWindows
IsWindowVisible
GetWindowThreadProcessId
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation
GetCursorPos
GetMessageA
wsprintfA
CharNextA
GetWindowTextA
GetForegroundWindow
GetAsyncKeyState
LoadCursorA
MapVirtualKeyA
SetCapture
WindowFromPoint
SetCursorPos
SetClipboardData
EmptyClipboard
GetClipboardData
OpenClipboard
GetSystemMetrics
BlockInput
SendMessageA
SystemParametersInfoA
GetCursorInfo
ReleaseDC
GetDC
GetDesktopWindow
SetRect
DestroyCursor

gdi32

DeleteDC
GetDIBits
CreateCompatibleBitmap
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteObject

advapi32

SetSecurityDescriptorDacl
RegSetKeySecurity
FreeSid
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenEventLogA
ClearEventLogA
CloseEventLog
RegOpenKeyA
RegQueryValueExA
SetEntriesInAclA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetNamedSecurityInfoA
RegCreateKeyA
RegSetValueExA
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
CloseServiceHandle
RegOpenKeyExA
RegQueryValueA
RegCloseKey
LsaFreeMemory
LsaOpenPolicy
LsaRetrievePrivateData
LookupAccountNameA
IsValidSid
AbortSystemShutdownA
ChangeServiceConfigA
QueryServiceConfigA
RegQueryInfoKeyA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid

shell32

SHGetFileInfoA
SHGetSpecialFolderPathA

winmm

waveOutPrepareHeader
waveOutGetNumDevs
waveInAddBuffer
waveOutClose
waveOutUnprepareHeader
waveOutReset
waveInClose
waveInUnprepareHeader
waveInReset
waveInStop
waveOutWrite
waveInStart
waveInPrepareHeader
waveInOpen
waveInGetNumDevs
waveOutOpen

ws2_32

WSACleanup
send
sendto
socket
recv
htons
connect
setsockopt
closesocket
WSAStartup
select
ioctlsocket
listen
accept
getpeername
__WSAFDIsSet
recvfrom
bind
ntohs
getsockname
WSAGetLastError
htonl
WSAIoctl
inet_ntoa
gethostbyname
inet_addr
gethostname

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

wininet

InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle

msvfw32

ICSeqCompressFrameEnd
ICCompressorFree
ICSeqCompressFrameStart
ICSendMessage
ICOpen
ICSeqCompressFrame
ICClose

netapi32

NetUserDel
NetApiBufferFree
NetUserEnum
NetUserGetLocalGroups
NetUserGetInfo
NetUserSetInfo
NetUserAdd
NetLocalGroupAddMembers

psapi

EnumProcessModules
GetModuleFileNameExA

wtsapi32

WTSQuerySessionInformationW
WTSEnumerateSessionsA
WTSLogoffSession
WTSDisconnectSession
WTSFreeMemory
WTSQuerySessionInformationA

Sections

.text
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

KKIJ
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

HHJM
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

NNB
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BBGJ
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

CAODAN
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fc24cf477990a4c67c307a8838ea9bb9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

msvcr90

kernel32

user32

gdi32

advapi32

shell32

winmm

ws2_32

msvcp90

wininet

msvfw32

netapi32

psapi

wtsapi32

Sections

.text Size: 104KB - Virtual size: 103KB

KKIJ Size: 2KB - Virtual size: 1KB

HHJM Size: 3KB - Virtual size: 2KB

NNB Size: 5KB - Virtual size: 5KB

BBGJ Size: 2KB - Virtual size: 1KB

CAODAN Size: 24KB - Virtual size: 23KB

.rdata Size: 23KB - Virtual size: 22KB

.data Size: 8KB - Virtual size: 24KB

.rsrc Size: 1024B - Virtual size: 792B

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 104KB - Virtual size: 103KB

KKIJ
Size: 2KB - Virtual size: 1KB

HHJM
Size: 3KB - Virtual size: 2KB

NNB
Size: 5KB - Virtual size: 5KB

BBGJ
Size: 2KB - Virtual size: 1KB

CAODAN
Size: 24KB - Virtual size: 23KB

.rdata
Size: 23KB - Virtual size: 22KB

.data
Size: 8KB - Virtual size: 24KB

.rsrc
Size: 1024B - Virtual size: 792B

.reloc
Size: 8KB - Virtual size: 8KB