fd611f1d8b716c7389c603bfa6ea5866_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fd611f1d8b716c7389c603bfa6ea5866_JaffaCakes118
Size

101KB
MD5

fd611f1d8b716c7389c603bfa6ea5866
SHA1

40efb1a17f78abe517ce7797a6110c7f9701134c
SHA256

5b253c626ebbbb585322ed3f5fd739de33cf9894cd08037c292bddede824e7d8
SHA512

452f14ca32d412ac543442c5d282087be934c2657107465d5ea369f91d63992549276801fd2c711cf4308cf7a5abf00e250cc98d590273380fca7b8ee0733da0
SSDEEP

1536:n7CiVF/Khfqspyss1Lo7vNbjXcy+hfaISz7+Ab/ZIo1oA6dx:mikqsxuU7vNbjXB+RaISW+/ZIo1oA6j

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fd611f1d8b716c7389c603bfa6ea5866_JaffaCakes118

Files

fd611f1d8b716c7389c603bfa6ea5866_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b11bfcb6720d2c2306ac2efffdd4c3aa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
GetFileSize
WriteFile
MoveFileA
GetSystemDirectoryA
GetCurrentProcess
WriteProcessMemory
VirtualAllocEx
OpenProcess
MoveFileExA
GetTickCount
GetLocalTime
HeapFree
GetProcessHeap
MapViewOfFile
CreateFileMappingA
HeapAlloc
UnmapViewOfFile
GlobalUnlock
GlobalLock
GlobalSize
GlobalFree
FindNextFileA
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
TerminateProcess
WaitForMultipleObjects
PeekNamedPipe
LocalSize
Process32First
CreateToolhelp32Snapshot
SizeofResource
LoadResource
FindResourceA
DeviceIoControl
LoadLibraryExA
GetModuleHandleA
SetFileAttributesA
ReleaseMutex
OpenEventA
SetErrorMode
CreateMutexA
SetUnhandledExceptionFilter
FreeConsole
lstrcmpiA
GetCurrentThreadId
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
CreateProcessA
GetFileAttributesA
CreateDirectoryA
LocalFree
GetLastError
GetModuleFileNameA
CreateFileA
SetFilePointer
ReadFile
DeleteFileA
SetLastError
Sleep
CancelIo
InterlockedExchange
ResetEvent
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
InitializeCriticalSection
CreateThread
ResumeThread
SetEvent
WaitForSingleObject
TerminateThread
CloseHandle
CreateEventA
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
WideCharToMultiByte
MultiByteToWideChar
GetWindowsDirectoryA
lstrcpyA
lstrcatA
LoadLibraryA
GetProcAddress
FreeLibrary
GetPrivateProfileSectionNamesA
GlobalAlloc
lstrlenA

user32

OpenDesktopA
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
SetProcessWindowStation
IsWindow
CloseWindow
CreateWindowExA
IsWindowVisible
GetWindowThreadProcessId
ExitWindowsEx
EnumWindows
GetCursorPos
GetCursorInfo
ReleaseDC
GetDesktopWindow
PostMessageA
GetSystemMetrics
EmptyClipboard
SetClipboardData
mouse_event
SetCursorPos
WindowFromPoint
SetCapture
MapVirtualKeyA
keybd_event
SendMessageA
SystemParametersInfoA
BlockInput
OpenClipboard
GetClipboardData
CloseClipboard
DestroyCursor
wsprintfA
GetDC
DispatchMessageA
TranslateMessage
GetMessageA
CharNextA
GetWindowTextA
GetActiveWindow
GetKeyNameTextA
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
LoadCursorA
SetRect

advapi32

RegDeleteKeyA
SetServiceStatus
LookupAccountSidA
GetTokenInformation
StartServiceA
RegEnumKeyExA
RegEnumValueA
RegCreateKeyExA
LsaClose
LsaRetrievePrivateData
LsaOpenPolicy
IsValidSid
RegCloseKey
RegQueryValueExA
RegOpenKeyA
CloseServiceHandle
DeleteService
ControlService
QueryServiceStatus
OpenServiceA
RegSetValueExA
RegCreateKeyA
RegQueryValueA
RegOpenKeyExA
CloseEventLog
ClearEventLogA
OpenEventLogA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
FreeSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
InitializeSecurityDescriptor
RegDeleteValueA
RegisterServiceCtrlHandlerA

msvcrt

_except_handler3
free
strrchr
strncat
realloc
atoi
wcstombs
strncpy
calloc
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
_strcmpi
_CxxThrowException
__CxxFrameHandler
strstr
_ftol
ceil
memmove
malloc
strchr
??3@YAXPAX@Z
_beginthreadex
_strnicmp
??2@YAPAXI@Z

winmm

waveOutGetNumDevs
waveOutPrepareHeader
waveInGetNumDevs
waveInOpen
waveInPrepareHeader
waveInAddBuffer
waveInStart
waveOutWrite
waveInStop
waveInReset
waveInUnprepareHeader
waveInClose
waveOutReset
waveOutUnprepareHeader
waveOutClose
waveOutOpen

msvcp60

?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z

msvfw32

ICSendMessage

Exports

Exports

DoResetSsdt
FuckRuixing
ServiceMain

Sections

.text
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b11bfcb6720d2c2306ac2efffdd4c3aa

Headers

File Characteristics

Imports

kernel32

user32

advapi32

msvcrt

winmm

msvcp60

msvfw32

Exports

Exports

Sections

.text Size: 70KB - Virtual size: 70KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 8KB - Virtual size: 9KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 70KB - Virtual size: 70KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 8KB - Virtual size: 9KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 5KB - Virtual size: 4KB