7912b483c756e28a37a0e6397d501a50_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

7912b483c756e28a37a0e6397d501a50_JaffaCakes118
Size

19.2MB
MD5

7912b483c756e28a37a0e6397d501a50
SHA1

cafbd555dfa271d4a89a48b7cf265c3324864294
SHA256

e9e166f2e4121f489ae6d6cc393c2f0e65bc34471821f44e8c72dcac1a2cb042
SHA512

66f57c9298720db719c8be80ae0daad9b1af7044d6f2dbaa7298be31174a1a9e54f60575ea3c0244f2489e34d0d7b9e1e92e886336448b5483c874bf83a6a453
SSDEEP

393216:1xpNEn1MmELdNpG2LW1MPDJFyZ/vCjVF9RgkzdVNVVLzAUTdYjhyf:g1M9LHct+DJFygVF9RxzdjVVU6

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/game.exe
unpack001/nvdaControllerClient32.dll

Files

7912b483c756e28a37a0e6397d501a50_JaffaCakes118
.zip
changes.txt
game.exe
.exe windows:5 windows x86 arch:x86

071dc177cb524c1e545e6319f357ca10

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\C++ tests\Bgt\bgt.pdb

Imports

user32

PostQuitMessage
SetForegroundWindow
LoadIconA
CallNextHookEx
IsWindowEnabled
SetFocus
SendMessageA
DrawTextExA
IsDialogMessageA
TranslateMessage
RegisterClassExA
OffsetRect
GetWindowTextA
GetAsyncKeyState
SetActiveWindow
CloseClipboard
GetMessageA
DestroyWindow
GetNextDlgTabItem
AdjustWindowRect
FindWindowA
LoadCursorA
SetDlgItemTextA
CallWindowProcA
SetClipboardData
EnableWindow
UpdateWindow
SetWindowTextA
GetSystemMetrics
UnhookWindowsHookEx
GetForegroundWindow
SetWindowLongA
AdjustWindowRectEx
OpenClipboard
DispatchMessageA
ShowWindow
SetWindowsHookExA
DefWindowProcA
GetDlgItem
RegisterClassA
MessageBoxA
UnregisterClassA
GetClipboardData
CreateWindowExA
PeekMessageA
EmptyClipboard

gdi32

DeleteDC
GetStockObject
GetTextExtentPointA
SelectObject
CreateDCA

ole32

CoUninitialize
CLSIDFromProgID
CoInitialize
CoCreateInstance

kernel32

SetEnvironmentVariableA
CompareStringW
CreateFileW
GetProcessHeap
SetEndOfFile
WriteConsoleW
FlushFileBuffers
HeapReAlloc
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryW
GetTimeZoneInformation
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetCurrentThreadId
SetLastError
IsBadWritePtr
SetEvent
CreateEventA
LocalFree
TerminateProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
CreateFileA
lstrlenA
VirtualQuery
FreeLibrary
InterlockedDecrement
GetCurrentProcess
QueryPerformanceCounter
GlobalLock
WaitForSingleObject
GetTickCount
GetCurrentThread
VirtualFree
GetDriveTypeA
GlobalAlloc
GetVolumeInformationA
Sleep
CreateProcessA
GetEnvironmentVariableA
MultiByteToWideChar
SetThreadPriority
GlobalUnlock
CreateDirectoryA
SetCurrentDirectoryA
FindFirstFileA
GetLastError
GetProcAddress
VirtualAlloc
RemoveDirectoryA
SetFileAttributesA
FindClose
LoadLibraryA
GlobalMemoryStatusEx
DeviceIoControl
GetSystemInfo
GetModuleFileNameA
FindNextFileA
GetModuleHandleA
LoadLibraryExA
CreateMutexA
GetProcessAffinityMask
QueryPerformanceFrequency
SetThreadAffinityMask
CloseHandle
GetTempPathA
CopyFileExA
DeleteFileA
WideCharToMultiByte
InterlockedIncrement
InterlockedExchange
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
ExitThread
ResumeThread
CreateThread
GetModuleHandleW
ExitProcess
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
GetCPInfo
RtlUnwind
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
ReadFile
SetHandleCount
GetStdHandle
GetFileType
SetFilePointer
WriteFile
GetModuleFileNameW
GetLocaleInfoW
HeapCreate
HeapSize
SetStdHandle
GetConsoleCP
GetConsoleMode
GetACP
GetOEMCP

ws2_32

inet_addr
WSAStartup
inet_ntoa
connect
ioctlsocket
send
recv
select
WSAGetLastError
WSARecvFrom
setsockopt
WSACleanup
bind
socket
__WSAFDIsSet
closesocket
gethostbyname
WSASendTo
ntohl
ntohs
htonl
htons

advapi32

RegSetValueExA
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
OpenProcessToken
RegQueryInfoKeyA
RegDeleteValueA
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
GetTokenInformation
RegCloseKey

shell32

SHGetFolderPathA

winmm

mmioSetInfo
mmioAdvance
mmioSeek
mmioDescend
mmioAscend
mmioClose
mmioCreateChunk
mmioWrite
timeEndPeriod
timeGetTime
timeBeginPeriod
mmioRead
mmioOpenA
mmioGetInfo

dsound

ord11
ord2

dinput8

DirectInput8Create

oleaut32

VariantChangeType
SysAllocString
VariantClear
VariantCopy
VariantInit
SysFreeString

Sections

.text
Size: 679KB - Virtual size: 679KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 149KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nvdaControllerClient32.dll
.dll windows:5 windows x86 arch:x86

9139f14541503d04870b9f37b714530f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetThreadDesktop
GetUserObjectInformationW

rpcrt4

NdrClientCall2
RpcBindingFromStringBindingW
RpcBindingFree

kernel32

GetStartupInfoA
InitializeCriticalSection
InterlockedCompareExchange
FlushFileBuffers
GetCurrentThreadId
ProcessIdToSessionId
GetCurrentProcessId
HeapAlloc
GetLastError
HeapFree
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetCommandLineA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
HeapDestroy
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetModuleHandleA
SetHandleCount
GetFileType
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
InterlockedExchange
LoadLibraryA
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
SetFilePointer
GetConsoleCP
GetConsoleMode
GetLocaleInfoW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CloseHandle

Exports

Exports

nvdaController_brailleMessage
nvdaController_cancelSpeech
nvdaController_speakText
nvdaController_testIfRunning

Sections

.text
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
readme.txt
sounds1.pack

Sharing

General

Malware Config

Signatures

Files

071dc177cb524c1e545e6319f357ca10

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

gdi32

ole32

kernel32

ws2_32

advapi32

shell32

winmm

dsound

dinput8

oleaut32

Sections

.text Size: 679KB - Virtual size: 679KB

.rdata Size: 149KB - Virtual size: 148KB

.data Size: 20KB - Virtual size: 46KB

.rsrc Size: 512B - Virtual size: 16B

.reloc Size: 36KB - Virtual size: 36KB

9139f14541503d04870b9f37b714530f

Headers

File Characteristics

Imports

user32

rpcrt4

kernel32

Exports

Exports

Sections

.text Size: 96KB - Virtual size: 96KB

.rdata Size: 18KB - Virtual size: 18KB

.data Size: 6KB - Virtual size: 13KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 679KB - Virtual size: 679KB

.rdata
Size: 149KB - Virtual size: 148KB

.data
Size: 20KB - Virtual size: 46KB

.rsrc
Size: 512B - Virtual size: 16B

.reloc
Size: 36KB - Virtual size: 36KB

.text
Size: 96KB - Virtual size: 96KB

.rdata
Size: 18KB - Virtual size: 18KB

.data
Size: 6KB - Virtual size: 13KB

.reloc
Size: 7KB - Virtual size: 7KB