01a4f0a1db0f773dac79d3c34b183bbf_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

01a4f0a1db0f773dac79d3c34b183bbf_JaffaCakes118
Size

11.2MB
MD5

01a4f0a1db0f773dac79d3c34b183bbf
SHA1

e8090b5e03f9f67357b7f155bf0031fa552eb24a
SHA256

ee721abcd24a786890aa4cdac91a2b8bfc1a3a49bc64dc3a0c3e47c712da3095
SHA512

e1deeeb06eb8b97ba86798c165ee9ea88efce18b1eaa74831eeabbf4bfb9e9ebfda62d275c8aebbd36c0cfd0e48392f48a17ddf6ccee5706b1d569f41c9d85f9
SSDEEP

196608:+uXVZO8c8ldRk4EdOsTSJkHz+Fp6EzibI:+uXrO8c8ldcdOsTSJcSFp6E

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01a4f0a1db0f773dac79d3c34b183bbf_JaffaCakes118

Files

01a4f0a1db0f773dac79d3c34b183bbf_JaffaCakes118
.exe windows:4 windows x86 arch:x86

78be6f9c2c3aeb73851136067a86f9c9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\vss-od\Silkroad\Client\Out\SRO_Client.pdb

Imports

gdi32

CreateFontIndirectA
SetTextColor
SetBkMode
SetPixel
GetPixel
SetDIBColorTable
CreateCompatibleDC
RealizePalette
SelectPalette
SetPaletteEntries
GetTextMetricsA
CreateDIBSection
CreateFontA
GetDeviceGammaRamp
GetTextExtentPoint32W
GetTextExtentPoint32A
GetStockObject
GetDIBits
GetObjectA
SetBkColor
CreateSolidBrush
RemoveFontResourceA
AddFontResourceA
BitBlt
DeleteObject
SetDeviceGammaRamp
SelectObject
CreatePalette
GetGlyphOutlineW
DeleteDC

advapi32

GetUserNameA
OpenProcessToken
GetTokenInformation
EqualSid
RegCloseKey
RegSetValueExA
RegCreateKeyExA
FreeSid
RegOpenKeyExA
RegOpenKeyA
RegQueryValueExA
AllocateAndInitializeSid

user32

CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
DestroyWindow
CreateWindowExA
IsCharAlphaW
IsCharAlphaNumericW
SetCursorPos
ScreenToClient
GetActiveWindow
CharNextW
GetCursorPos
PostMessageA
GetWindowThreadProcessId
EndDialog
SetRect
SetWindowPos
HideCaret
MessageBoxA
GetKeyState
SendMessageA
GetWindow
IsWindow
FindWindowA
SetFocus
SetCursor
GetWindowTextA
wsprintfA
DefWindowProcA
PostQuitMessage
ChangeDisplaySettingsA
SystemParametersInfoA
EnumDisplaySettingsA
ClipCursor
GetClassLongA
ShowCaret
SetMenu
DestroyAcceleratorTable
LoadMenuA
RegisterClassA
DestroyMenu
GetIconInfo
EnableWindow
CheckRadioButton
SetWindowTextA
AppendMenuA
CreatePopupMenu
CreateMenu
CharNextExA
CallNextHookEx
CallWindowProcA
UnhookWindowsHookEx
SetWindowLongA
GetWindowLongA
SetWindowsHookExA
GetWindowRect
AdjustWindowRect
GetClientRect
GetDesktopWindow
RegisterClassExA
PtInRect
LoadCursorA
LoadIconA
ShowWindow
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
GetMessageA
PeekMessageA
RegisterHotKey
LoadAcceleratorsA
SetForegroundWindow
LoadStringA
GetKeyboardLayout
GetFocus
GetMenu
GetDlgItem
GetDC
ReleaseDC
UpdateWindow
MessageBoxW
CharNextA
DialogBoxParamA
IsDlgButtonChecked
MoveWindow
SetWindowTextW
GetSystemMetrics

imm32

ImmGetCandidateWindow
ImmSetConversionStatus
ImmGetConversionStatus
ImmNotifyIME
ImmSetCandidateWindow
ImmGetCompositionStringW
ImmGetContext
ImmReleaseContext
ImmGetProperty
ImmAssociateContext

kernel32

LCMapStringA
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
GetCPInfo
HeapSize
LCMapStringW
HeapCreate
HeapDestroy
HeapReAlloc
VirtualAlloc
VirtualFree
FatalAppExitA
SetHandleCount
GetFileType
GetConsoleCP
GetConsoleMode
SetConsoleCtrlHandler
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStdHandle
InterlockedExchange
Sleep
CloseHandle
WriteFile
CreateFileW
ReadFile
GetFileSize
CreateFileA
lstrlenA
GetLastError
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetFilePointer
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
ResetEvent
CreateEventA
DeleteFileA
CreateDirectoryA
SetCurrentDirectoryA
MultiByteToWideChar
SetEvent
WaitForSingleObject
CreateThread
OutputDebugStringA
GetTickCount
GetModuleFileNameA
VirtualQuery
lstrcmpW
GetACP
GetVersion
GlobalUnlock
GlobalLock
Beep
GetProcAddress
GetModuleHandleA
CreateMutexA
WinExec
GetCurrentProcess
GetCurrentProcessId
GetLocalTime
SetUnhandledExceptionFilter
CompareStringA
FindClose
FindFirstFileA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
GetSystemDirectoryA
FindNextFileA
SetFileAttributesA
GetCommandLineA
FreeLibrary
LoadLibraryA
GetLocaleInfoA
GetThreadLocale
GetVersionExA
lstrcmpA
GetSystemInfo
IsProcessorFeaturePresent
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
LockResource
LoadResource
SizeofResource
FindResourceA
FindResourceW
GetFullPathNameA
lstrcmpiA
HeapAlloc
GetProcessHeap
HeapFree
GetCurrentThread
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsDebuggerPresent
TerminateProcess
GetStartupInfoA
UnhandledExceptionFilter
ExitProcess
GetSystemTimeAsFileTime
RaiseException
RtlUnwind
GlobalFree
GlobalAlloc
GlobalMemoryStatus
SetLastError
Process32First
Process32Next
CreateToolhelp32Snapshot
Module32First
Module32Next
CopyFileA
GetFileAttributesA
GetCurrentDirectoryA
QueryPerformanceCounter
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
GetLocaleInfoW
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
CompareStringW
SetEnvironmentVariableA
TerminateThread
SetThreadPriority
ExitThread
lstrcpyA
lstrcatA
GetExitCodeThread
VirtualProtect
GetSystemDefaultLangID
_lwrite
QueryPerformanceFrequency
MulDiv
lstrcpynA
ResumeThread
GetWindowsDirectoryA
SuspendThread
FlushViewOfFile
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
ReleaseSemaphore
SleepEx
FlushInstructionCache
GetCurrentThreadId

shell32

ShellExecuteW
ShellExecuteA
SHGetSpecialFolderPathA
ExtractIconExA

wininet

InternetCloseHandle
InternetGetLastResponseInfoA
FtpSetCurrentDirectoryA
FtpCreateDirectoryA
FtpRemoveDirectoryA
FtpDeleteFileA
FtpRenameFileA
InternetOpenA
FtpOpenFileA
FtpGetFileA
FtpGetCurrentDirectoryA
InternetFindNextFileA
FtpFindFirstFileA
DeleteUrlCacheEntry
FtpPutFileA
InternetCrackUrlA
InternetConnectA
InternetWriteFile

urlmon

URLDownloadToFileA

ws2_32

inet_ntoa
WSACloseEvent
gethostname
WSASetEvent
WSAGetOverlappedResult
gethostbyaddr
ntohs
inet_addr
WSACleanup
closesocket
bind
htonl
htons
socket
WSAResetEvent
WSASendTo
WSARecvFrom
WSAStartup
getsockname
select
WSAGetLastError
connect
ioctlsocket
send
setsockopt
gethostbyname
sendto
recvfrom
WSACreateEvent
accept
getpeername
getsockopt
WSASend
listen
WSASocketA
shutdown
WSAIoctl
WSARecv
WSAWaitForMultipleEvents

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

ddraw

DirectDrawCreateEx

iphlpapi

GetAdaptersInfo
GetTcpTable

winmm

timeGetTime
mmioAscend
mmioRead
mmioDescend
mmioGetInfo
mmioCreateChunk
mmioSeek
mmioSetInfo
mmioAdvance
mmioWrite
mmioClose
mmioOpenA
timeSetEvent
timeKillEvent

d3d9

Direct3DCreate9

ole32

CoCreateGuid
CoUninitialize
CoInitialize

dsound

ord11

Exports

Exports

fcEXP

Sections

.text
Size: 9.7MB - Virtual size: 9.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 236KB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

78be6f9c2c3aeb73851136067a86f9c9

Headers

File Characteristics

PDB Paths

Imports

gdi32

advapi32

user32

imm32

kernel32

shell32

wininet

urlmon

ws2_32

version

ddraw

iphlpapi

winmm

d3d9

ole32

dsound

Exports

Exports

Sections

.text Size: 9.7MB - Virtual size: 9.7MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 236KB - Virtual size: 2.7MB

.rsrc Size: 48KB - Virtual size: 46KB

.text
Size: 9.7MB - Virtual size: 9.7MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 236KB - Virtual size: 2.7MB

.rsrc
Size: 48KB - Virtual size: 46KB