3f4e8edc97535807eecf15fa8de073bc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3f4e8edc97535807eecf15fa8de073bc_JaffaCakes118
Size

2.3MB
MD5

3f4e8edc97535807eecf15fa8de073bc
SHA1

99ff29abff7a43d5a050abb442556836398b878e
SHA256

4404378d1e57b006952eb1061c8c3eafb2ff85dedd921cfd6e4a6dcca0a0eb36
SHA512

b53fad72eb3075f6ed75c957d3aa0a54afdfa2421f9d54d5b1f21e97bf2551db738fab99d1d4fb7efb5da5fcc55b26ae9d569f5bed037cb4c8ca44e4febbb702
SSDEEP

49152:jxRhkem7YCvfT5gt9AMNUGXZgHOE78GhYYMAS5ASIl:jhkeTCvNgt9pNUsZoOETYYMAS5ASIl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f4e8edc97535807eecf15fa8de073bc_JaffaCakes118

Files

3f4e8edc97535807eecf15fa8de073bc_JaffaCakes118
.exe windows:5 windows x86 arch:x86

1809d049b3ba6135c8a2168a5abc34f5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\项目文件\GameWeb\Release\jzwld.pdb

Imports

kernel32

LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetVolumeInformationW
GetFullPathNameW
GlobalFlags
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GetFileSizeEx
GetFileTime
SetErrorMode
GetStartupInfoW
UnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
ExitProcess
HeapFree
HeapAlloc
HeapReAlloc
RtlUnwind
RaiseException
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapSize
SetStdHandle
GetFileType
GetStdHandle
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
LCMapStringW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GetCurrentDirectoryA
GetDriveTypeA
SetEnvironmentVariableA
GetThreadLocale
LocalAlloc
FileTimeToLocalFileTime
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LoadLibraryA
lstrcmpW
GetVersionExA
FormatMessageW
LocalFree
GlobalFree
MulDiv
GetModuleHandleA
GetCurrentProcessId
SetLastError
ResumeThread
GetCurrentThreadId
WaitForMultipleObjects
ExitThread
CreateSemaphoreW
ReleaseSemaphore
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
SetEvent
GetShortPathNameW
FileTimeToSystemTime
UnmapViewOfFile
GetFileSize
FreeResource
GlobalUnlock
GetModuleFileNameW
TerminateProcess
GetVersionExW
GlobalAlloc
GlobalLock
LocalFileTimeToFileTime
GetCurrentDirectoryW
ReadFile
SetFileTime
SystemTimeToFileTime
SetFilePointer
CreateEventW
ResetEvent
lstrlenW
GetModuleHandleW
CreateThread
SetFileAttributesW
CreateToolhelp32Snapshot
FindNextFileW
Process32NextW
SetProcessWorkingSetSize
RemoveDirectoryW
Process32FirstW
FindClose
GetFileAttributesW
OpenProcess
WaitForSingleObject
GetCurrentProcess
FindFirstFileW
GetProcAddress
GetTickCount
lstrlenA
IsBadWritePtr
InterlockedDecrement
InterlockedIncrement
GetPrivateProfileIntW
GetLastError
WideCharToMultiByte
DeleteFileW
CloseHandle
WritePrivateProfileStringW
MultiByteToWideChar
CreateFileW
CopyFileW
Sleep
LoadLibraryW
WriteFile
GetPrivateProfileStringW
CreateDirectoryW
SetUnhandledExceptionFilter
FreeLibrary
GetCommandLineW
LockResource
SizeofResource
LoadResource
GetModuleFileNameA
FindResourceW

user32

CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
OffsetRect
SystemParametersInfoA
GetWindowPlacement
MapVirtualKeyW
GetKeyNameTextW
GetMenuItemID
GetMenuItemCount
IntersectRect
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
GetSysColor
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
SetMenu
TabbedTextOutW
GetLastActivePopup
IsWindowEnabled
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
GetParent
GetMenuState
EnableMenuItem
TrackPopupMenu
GetDesktopWindow
GetWindowThreadProcessId
GetWindow
wsprintfW
keybd_event
ScreenToClient
GetClientRect
SystemParametersInfoW
CopyRect
SetWindowRgn
SetRectEmpty
TranslateMessage
PeekMessageW
DispatchMessageW
SetCursor
UpdateLayeredWindow
SetTimer
IsIconic
LoadImageW
KillTimer
GetSubMenu
SetForegroundWindow
GetDC
LoadIconW
SetRect
LoadMenuW
GetWindowLongW
ReleaseDC
SetWindowLongW
GetKeyState
DrawTextW
GetCursorPos
MessageBoxW
ReleaseCapture
GetSystemMetrics
IsWindowVisible
CheckMenuItem
MoveWindow
GetWindowRect
PostMessageW
LoadCursorW
SetParent
SetWindowPos
ShowWindow
IsWindow
UpdateWindow
PtInRect
PostThreadMessageW
InvalidateRect
SendMessageW
UnregisterClassW
MessageBeep
MapWindowPoints
GetNextDlgGroupItem
SetCapture
InvalidateRgn
CopyAcceleratorTableW
IsRectEmpty
RegisterHotKey
UnregisterHotKey
EnableWindow
WindowFromPoint
DestroyMenu
CharUpperW
CharNextW
RegisterClipboardFormatW
GetMessageW
ValidateRect
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
SetWindowTextW
IsDialogMessageW
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
SetFocus
GetWindowTextW
GetForegroundWindow
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
ModifyMenuW
GetSysColorBrush

gdi32

GetClipBox
GetObjectW
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
SetMapMode
ExtSelectClipRgn
GetStockObject
GetDeviceCaps
CreateFontIndirectW
CreateRectRgnIndirect
GetMapMode
DPtoLP
GetBkColor
GetTextColor
GetRgnBox
SetTextColor
SetBkColor
RestoreDC
SaveDC
CreateBitmap
CreateRoundRectRgn
DeleteDC
CreateDIBSection
DeleteObject
SelectObject
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

RegDeleteKeyW
RegQueryValueW
RegEnumKeyW
RegOpenKeyW
RegCreateKeyExW
RegQueryValueExW
AdjustTokenPrivileges
RegOpenKeyExW
LookupPrivilegeValueW
OpenProcessToken
RegSetValueExW
RegCloseKey

shell32

ShellExecuteW
CommandLineToArgvW
Shell_NotifyIconW
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderLocation

comctl32

_TrackMouseEvent

shlwapi

PathFindExtensionW
UrlUnescapeW
PathStripToRootW
PathIsUNCW
PathFindFileNameW

oledlg

OleUIBusyW

ole32

OleIsCurrentClipboard
CoRevokeClassObject
CreateILockBytesOnHGlobal
CoTaskMemFree
CreateStreamOnHGlobal
CoFreeUnusedLibraries
CoInitialize
CoUninitialize
OleFlushClipboard
CoRegisterMessageFilter
CoCreateInstance
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
OleInitialize
OleUninitialize
CLSIDFromString
CLSIDFromProgID
CoTaskMemAlloc

oleaut32

VariantCopy
SysStringLen
VariantChangeType
SysAllocString
VariantClear
SysFreeString
SysAllocStringLen
VariantInit
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect

wininet

InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetGetLastResponseInfoW
InternetCrackUrlW
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
InternetOpenW
InternetReadFile
InternetConnectW
HttpSendRequestW
HttpAddRequestHeadersW
HttpQueryInfoW
HttpOpenRequestW
InternetCloseHandle
InternetCanonicalizeUrlW
InternetQueryDataAvailable

gdiplus

GdipCloneImage
GdipDisposeImage
GdipLoadImageFromStream
GdipDeleteBrush
GdipFree
GdipCloneBrush
GdipDrawImageRectRectI
GdipSetTextRenderingHint
GdipDeleteFont
GdipDeleteGraphics
GdipDeleteFontFamily
GdipCreateSolidFill
GdipAlloc
GdipCreateFont
GdipDrawString
GdipCreateFontFamilyFromName
GdipCreateFromHDC
GdipCreateStringFormat
GdipDeleteStringFormat
GdiplusShutdown
GdiplusStartup
GdipGetImageHeight
GdipGetImageWidth
GdipReleaseDC
GdipDeletePen
GdipDrawImageRectI
GdipDrawLineI
GdipCreatePen1
GdipDrawImageRectRect
GdipFillRectangle

psapi

EnumProcesses
EnumProcessModules
GetModuleFileNameExW
EmptyWorkingSet
GetModuleBaseNameW

snmpapi

SnmpUtilOidCpy
SnmpUtilVarBindFree
SnmpUtilOidNCmp

sensapi

IsNetworkAlive

ws2_32

recv
socket
__WSAFDIsSet
closesocket
gethostbyname
htons
connect
WSAGetLastError
WSAStartup
select
send

Sections

.text
Size: 386KB - Virtual size: 385KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1809d049b3ba6135c8a2168a5abc34f5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

wininet

gdiplus

psapi

snmpapi

sensapi

ws2_32

Sections

.text Size: 386KB - Virtual size: 385KB

.rdata Size: 94KB - Virtual size: 93KB

.data Size: 12KB - Virtual size: 29KB

.rsrc Size: 1.7MB - Virtual size: 1.7MB

.reloc Size: 52KB - Virtual size: 51KB

.text
Size: 386KB - Virtual size: 385KB

.rdata
Size: 94KB - Virtual size: 93KB

.data
Size: 12KB - Virtual size: 29KB

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

.reloc
Size: 52KB - Virtual size: 51KB