21c61496326a71f45887f0f29996ff29_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

21c61496326a71f45887f0f29996ff29_JaffaCakes118
Size

1.5MB
MD5

21c61496326a71f45887f0f29996ff29
SHA1

e2fb4515f6afe606163cc5fa16ce60f895e329d4
SHA256

20a3aa834708f61cd89261343bc0af0d5c036a71db3a3ec12056692cde8c6df2
SHA512

05377893560a24e9517812c6782ea2bbd5df9545923a1b3672988ffc8033f1f39cb511da243bbb8f2870aac930e55f962a6d0f4788b75d41964edbe66ef07a1c
SSDEEP

24576:OQpA/SpgPYJECj49Jcw+jQfm3cp7VErhF4HiY01gs+J1:nArYJ4ffmiVEtusO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
21c61496326a71f45887f0f29996ff29_JaffaCakes118

Files

21c61496326a71f45887f0f29996ff29_JaffaCakes118
.exe windows:5 windows x86 arch:x86

04142aafecb837eec2a8163eaf27db6e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\code_svn\360SoftMgr\branches\SML_From_3.1.0.1060\OutputEx\Bin\Release\SoftMgrLite.pdb

Imports

kernel32

Process32FirstW
Process32NextW
OpenProcess
GetLongPathNameW
GetStartupInfoW
CreateProcessW
GetDiskFreeSpaceExW
WaitForMultipleObjects
FreeResource
SetUnhandledExceptionFilter
ExitProcess
IsBadReadPtr
VirtualProtect
lstrlenA
GetSystemInfo
LocalAlloc
LocalFree
GetThreadLocale
SetThreadLocale
CreateSemaphoreW
ReleaseSemaphore
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CreateMutexW
CreateDirectoryW
GetVersion
SetFileTime
GetFileTime
SetEndOfFile
GetStdHandle
SystemTimeToFileTime
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
GetLocaleInfoA
CreateToolhelp32Snapshot
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
GetConsoleMode
GetConsoleCP
SetStdHandle
LCMapStringA
QueryPerformanceCounter
GetStartupInfoA
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
HeapCreate
RtlUnwind
GetFileAttributesW
IsDebuggerPresent
UnhandledExceptionFilter
GetFileType
LocalFileTimeToFileTime
GetFileSizeEx
SetFilePointerEx
GetEnvironmentVariableW
SetEnvironmentVariableW
TlsFree
TlsAlloc
OpenThread
TlsSetValue
TlsGetValue
ReleaseMutex
CreateFileA
GetSystemTimeAsFileTime
FormatMessageW
GetSystemTime
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
FindNextFileW
FindClose
FindFirstFileW
GetWindowsDirectoryW
GetLocalTime
GetSystemDirectoryW
GetVersionExW
MoveFileExW
ReadFile
DeleteFileW
SetFileAttributesW
GetFileSize
GetDriveTypeW
GetLogicalDriveStringsW
SetProcessWorkingSetSize
lstrcmpW
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
WideCharToMultiByte
TerminateThread
FlushInstructionCache
SetLastError
ExpandEnvironmentStringsW
GetTempFileNameW
GetTempPathW
WritePrivateProfileStringW
CopyFileW
GetTickCount
CreateThread
CreateEventW
WaitForSingleObject
SetEvent
Sleep
WriteFile
OutputDebugStringW
SetFilePointer
GetPrivateProfileStringW
GetPrivateProfileIntW
CreateFileW
DeviceIoControl
CloseHandle
GetCurrentProcessId
LoadLibraryW
FindResourceExW
LockResource
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
FreeLibrary
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameW
LoadLibraryExW
MultiByteToWideChar
GetLastError
EnterCriticalSection
RaiseException
LeaveCriticalSection
lstrcmpiW
GetModuleHandleW
lstrlenW
GetProcAddress
FindResourceW
LoadResource
SizeofResource

user32

SetWindowPos
ShowWindow
IsWindowVisible
IsWindow
DestroyWindow
UpdateWindow
MessageBoxW
GetAncestor
GetShellWindow
GetWindowInfo
EnumChildWindows
OffsetRect
ChildWindowFromPointEx
DestroyIcon
PrivateExtractIconsW
LoadImageW
IntersectRect
DrawTextW
EqualRect
IsIconic
MapWindowPoints
SetWindowRgn
SetLayeredWindowAttributes
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
DefWindowProcW
UnregisterClassA
CharNextW
SetCursor
wsprintfW
DestroyMenu
MonitorFromPoint
GetMonitorInfoW
LoadMenuW
GetSubMenu
CheckMenuItem
DeleteMenu
GetWindowThreadProcessId
UnregisterHotKey
RegisterHotKey
GetDC
AttachThreadInput
AppendMenuW
TrackPopupMenu
CreatePopupMenu
LockWorkStation
IsRectEmpty
DrawIconEx
GetWindowRect
UpdateLayeredWindow
ReleaseDC
GetDlgItem
SendMessageW
SetWindowLongW
GetWindowLongW
CallWindowProcW
GetSystemMetrics
MoveWindow
WindowFromPoint
FindWindowExW
FindWindowW
SendMessageTimeoutW
GetClientRect
PrintWindow
RegisterWindowMessageW
RegisterClassExW
GetClassInfoExW
LoadCursorW
CreateWindowExW
GetCursorPos
PtInRect
PostMessageW
CopyRect
SetFocus
TrackMouseEvent
MonitorFromWindow
GetIconInfo
GetDoubleClickTime
GetActiveWindow
ExitWindowsEx
SetForegroundWindow
GetForegroundWindow
PostQuitMessage
SetActiveWindow
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
BeginPaint
EndPaint
GetWindow
GetClassNameW
GetSysColor
RedrawWindow
CreateAcceleratorTableW
ClientToScreen
ScreenToClient
ReleaseCapture
FillRect
InvalidateRgn
InvalidateRect
GetDesktopWindow
DestroyAcceleratorTable
IsChild
GetFocus
GetKeyNameTextW
MapVirtualKeyW
EnableWindow
GetLastInputInfo
LockSetForegroundWindow
GetParent
SystemParametersInfoW
SetRectEmpty
MsgWaitForMultipleObjects
SetCapture
KillTimer
SetTimer

gdi32

SetBkColor
SetTextCharacterExtra
GetTextColor
StretchBlt
SetStretchBltMode
SetPixel
CombineRgn
CreateRectRgn
CreateRoundRectRgn
CreateDIBSection
DeleteObject
CreateCompatibleDC
SelectObject
GetBitmapBits
SetBitmapBits
CreateCompatibleBitmap
GetDeviceCaps
GetObjectW
GetStockObject
BitBlt
CreateSolidBrush
GetCurrentObject
CreateFontW
SaveDC
CreateRectRgnIndirect
ExtSelectClipRgn
RestoreDC
CreatePen
Rectangle
CreateFontIndirectW
SetBkMode
SetTextColor
DeleteDC

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

RegQueryValueExA
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegEnumKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegQueryValueExW
RegOpenKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyW

shell32

ord165
ExtractIconExW
ord155
ord18
SHBindToParent
SHParseDisplayName
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetSpecialFolderPathW
ShellExecuteExW
SHAppBarMessage
SHGetFolderPathW
ShellExecuteW

ole32

CoInitializeEx
OleInitialize
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
OleUninitialize
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree

oleaut32

VarBstrCmp
SysStringByteLen
SysAllocStringByteLen
VarDateFromStr
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocStringLen
OleCreateFontIndirect
DispCallFunc
SysAllocString
VariantClear
VariantInit
LoadTypeLi
LoadRegTypeLi
SysStringLen
SysFreeString
VarUI4FromStr

shlwapi

PathRemoveExtensionW
PathIsDirectoryW
StrCmpNIW
SHSetValueW
ord176
StrFormatByteSizeW
StrCpyNW
StrCmpIW
PathIsNetworkPathW
StrStrIW
PathFindExtensionW
PathCombineW
PathAddBackslashW
PathRemoveFileSpecW
SHGetValueW
PathFindFileNameW
PathAppendW
PathFileExistsW
StrCpyW

comctl32

ord17
_TrackMouseEvent
InitCommonControlsEx

msimg32

AlphaBlend

gdiplus

GdipBitmapGetPixel
GdipBitmapLockBits
GdipCreateBitmapFromHICON
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromFile
GdipCloneImage
GdipDisposeImage
GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup
GdipGetImageEncodersSize

wininet

InternetGetConnectedState

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW

imm32

ImmGetContext
ImmReleaseContext
ImmAssociateContext

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 125KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

whsewuy
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

04142aafecb837eec2a8163eaf27db6e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

wininet

version

psapi

imm32

iphlpapi

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 208KB - Virtual size: 207KB

.data Size: 32KB - Virtual size: 49KB

.rsrc Size: 50KB - Virtual size: 49KB

.reloc Size: 125KB - Virtual size: 127KB

whsewuy Size: 6KB - Virtual size: 6KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 208KB - Virtual size: 207KB

.data
Size: 32KB - Virtual size: 49KB

.rsrc
Size: 50KB - Virtual size: 49KB

.reloc
Size: 125KB - Virtual size: 127KB

whsewuy
Size: 6KB - Virtual size: 6KB