40e03579aa744aa82d3cc3645682502e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

40e03579aa744aa82d3cc3645682502e_JaffaCakes118
Size

14.4MB
MD5

40e03579aa744aa82d3cc3645682502e
SHA1

ca3ec95f219badb0b70edea759212aa42df5066b
SHA256

29d64143183efa076c7445824d8c38cd4c62b6de5a41f4c80dbdc3f551af9f47
SHA512

95a7dac5c2555b12e605b6feb8979e181b64ef88f8ecca77186a9fcfffc34447055e31e38119159d718865aa365a2dd72a96d2277497dbbeaf5ccaac7542db55
SSDEEP

393216:yR64jEjDnqCQFOk87YtHNThLFikANN6BMHZWuZWO:Jr7AtThkkAv6ZkWO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40e03579aa744aa82d3cc3645682502e_JaffaCakes118

Files

40e03579aa744aa82d3cc3645682502e_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a5a79d8f9f28dcd911a50cd0712b2ce6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\a\svn\源码\C++源码\项目源码\大番茄一键重装系统\V2.0\FQInstall\Release\FQInstall.pdb

Imports

kernel32

InterlockedCompareExchange
GetLastError
ReadFile
SetFilePointer
GetFileSize
CreateFileA
CreateDirectoryW
WriteFile
CreateFileW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
lstrcpyA
TerminateProcess
GetModuleFileNameW
GetCurrentDirectoryW
GetProcAddress
LoadLibraryW
GetModuleHandleW
GetTickCount
GetACP
ExitProcess
FindResourceW
GetFileType
DuplicateHandle
GetCurrentProcess
SystemTimeToFileTime
DosDateTimeToFileTime
SetFileTime
MulDiv
InterlockedIncrement
InterlockedDecrement
GetLocalTime
GetModuleHandleA
Sleep
TlsAlloc
TlsFree
TlsGetValue
GetCurrentProcessId
OpenEventA
ResetEvent
TlsSetValue
ResumeThread
SetWaitableTimer
CreateWaitableTimerA
LocalFree
OpenProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
RaiseException
RtlUnwind
HeapReAlloc
ExitThread
CreateThread
SetLastError
HeapSize
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
InterlockedExchange
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
FlushFileBuffers
CompareStringA
CompareStringW
SetEnvironmentVariableA
FindClose
RemoveDirectoryW
DeleteFileW
DeviceIoControl
FindFirstFileW
FindNextFileW
GetFileAttributesW
AreFileApisANSI
WideCharToMultiByte
GetCurrentThreadId
CreateDirectoryA
lstrlenA
DeleteFileA
MultiByteToWideChar
GetTempPathA
SizeofResource
LockResource
FreeResource
LoadResource
FindResourceA
GetModuleFileNameA
WaitForMultipleObjectsEx
WaitForSingleObjectEx
HeapFree
GetProcessHeap
HeapAlloc
ReleaseSemaphore
CreateSemaphoreA
GetSystemTimeAsFileTime
SetEvent
CloseHandle
FormatMessageA
CreateEventA
InitializeCriticalSection

user32

EnableWindow
GetMonitorInfoW
MonitorFromWindow
LoadImageW
GetSystemMetrics
CallWindowProcW
GetPropW
SetPropW
ClientToScreen
RegisterClassW
RegisterClassExW
GetClassInfoExW
IsIconic
SetWindowRgn
IsZoomed
MessageBoxW
CharNextW
GetWindowRgn
IntersectRect
FillRect
DrawTextW
CharPrevW
SetRect
CreateCaret
HideCaret
ShowCaret
SetCaretPos
PostQuitMessage
GetWindowTextW
wvsprintfW
DispatchMessageW
InvalidateRgn
CreateAcceleratorTableW
BeginPaint
EndPaint
IsRectEmpty
UpdateLayeredWindow
SendMessageW
MapWindowPoints
CreateWindowExW
GetFocus
SetFocus
DestroyWindow
ReleaseDC
PtInRect
PostMessageW
ReleaseCapture
SetCapture
IsWindow
KillTimer
SetTimer
InvalidateRect
GetWindowLongW
SetWindowLongW
SetWindowPos
GetClientRect
GetDC
GetKeyState
ShowWindow
GetSysColor
DefWindowProcW
wsprintfW
LoadStringA
GetWindowRect
MoveWindow
LoadCursorW
SetCursor
InflateRect
OffsetRect
GetMessageW
GetWindowTextLengthW
TranslateMessage
LoadStringW
GetParent
GetCursorPos
ScreenToClient
GetWindow
SetWindowTextW
GetUpdateRect

advapi32

RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegCreateKeyA

shell32

SHGetSpecialFolderPathA
SHFileOperationA
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetSpecialFolderPathW
SHChangeNotify

ole32

CoCreateInstance
CoInitialize
CLSIDFromProgID
CLSIDFromString
OleLockRunning
CoUninitialize

shlwapi

PathFileExistsA
PathAppendW

gdi32

BitBlt
RestoreDC
SaveDC
CreateCompatibleBitmap
CreateCompatibleDC
CreateRoundRectRgn
PtInRegion
CreateRectRgn
CreateDIBSection
SelectClipRgn
ExtSelectClipRgn
CreateRectRgnIndirect
GetClipBox
CombineRgn
StretchBlt
Rectangle
CreatePen
ExtTextOutW
SetBkColor
CreateSolidBrush
LineTo
MoveToEx
CreatePenIndirect
RoundRect
SetBkMode
SetTextColor
TextOutW
GetTextExtentPoint32W
GetCharABCWidthsW
GetDeviceCaps
GetStockObject
SetWindowOrgEx
SelectObject
DeleteDC
GetObjectA
GetObjectW
CreateFontIndirectW
DeleteObject
SetStretchBltMode
GetTextMetricsW

oleaut32

SysAllocString
VariantClear
SysFreeString
VariantInit

comctl32

ord17
_TrackMouseEvent

gdiplus

GdipCloneBrush
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawString
GdiplusStartup
GdiplusShutdown
GdipDeleteBrush
GdipFree
GdipAlloc
GdipCreateStringFormat
GdipDeleteStringFormat
GdipDeleteGraphics
GdipDeleteFont
GdipCreateLineBrushI
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipCreateFromHDC
GdipSetTextRenderingHint

Sections

.text
Size: 520KB - Virtual size: 519KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13.7MB - Virtual size: 13.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a5a79d8f9f28dcd911a50cd0712b2ce6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

gdi32

oleaut32

comctl32

gdiplus

Sections

.text Size: 520KB - Virtual size: 519KB

.rdata Size: 100KB - Virtual size: 99KB

.data Size: 16KB - Virtual size: 33KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 13.7MB - Virtual size: 13.7MB

.reloc Size: 75KB - Virtual size: 75KB

.text
Size: 520KB - Virtual size: 519KB

.rdata
Size: 100KB - Virtual size: 99KB

.data
Size: 16KB - Virtual size: 33KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 13.7MB - Virtual size: 13.7MB

.reloc
Size: 75KB - Virtual size: 75KB