99839790d04b79dcd1e98766dc9d5b09_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

99839790d04b79dcd1e98766dc9d5b09_JaffaCakes118
Size

871KB
MD5

99839790d04b79dcd1e98766dc9d5b09
SHA1

68924f77f82aef4016e8abdf5c69243defd91fa8
SHA256

25f3f9ff57242bf3bf8d93ac3bb828b35076f5ad0751e748cbfe486123797135
SHA512

e2c23d75842d3da688845920f506e3603f87c76b453f8a8fc9ca7d7082d9fbc2f0f88a37ca29b77652b779a46869034b25c18f52a708b79946a94dd4f81cf06e
SSDEEP

24576:Q9oPLsg0pIPIuLdbbbfJhII92ThepgKV:EoPLdmYpLdbHf/4ThXKV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
99839790d04b79dcd1e98766dc9d5b09_JaffaCakes118

Files

99839790d04b79dcd1e98766dc9d5b09_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a94b87711098cb8cb9d434fb18a71d1a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\work\project\backup\savepathdeals__24_10_2013\installers\_savepathdeals_merged\uninstaller_1\live_EN\uninst000_en_live.pdb

Imports

kernel32

LockResource
DeleteCriticalSection
GetEnvironmentVariableW
FindFirstFileW
FindClose
RemoveDirectoryW
FindNextFileW
GetTickCount
Sleep
LoadLibraryW
CreateFileW
CloseHandle
WideCharToMultiByte
GetCurrentProcess
GetFullPathNameW
GetFullPathNameA
CreateFileA
GetFileSize
SetFilePointer
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
QueryPerformanceCounter
InterlockedCompareExchange
UnlockFile
LockFile
UnlockFileEx
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
FormatMessageW
GetVersionExW
GetFileAttributesA
GetFileAttributesW
ReadFile
FlushFileBuffers
GetTempPathW
LockFileEx
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
CreateThread
EnterCriticalSection
SetErrorMode
OpenProcess
TerminateProcess
OutputDebugStringW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetStringTypeW
EncodePointer
DecodePointer
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
GetProcAddress
GetCommandLineW
SetEnvironmentVariableA
WriteConsoleW
GetTimeZoneInformation
ReadConsoleW
GetOEMCP
GetACP
IsValidCodePage
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointerEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsDebuggerPresent
GetFileType
GetModuleFileNameW
GetStdHandle
GetCurrentThreadId
EnumSystemLocalesW
GetUserDefaultLCID
GetLastError
RaiseException
LeaveCriticalSection
SizeofResource
GetModuleHandleW
WaitForSingleObject
LoadLibraryExW
LoadResource
FreeLibrary
FindResourceW
FindResourceExW
GetPrivateProfileStringW
InterlockedDecrement
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
GetCPInfo
RtlUnwind
InterlockedIncrement
SetFileAttributesW
DeleteFileW
MultiByteToWideChar
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateMutexW
InitializeCriticalSectionAndSpinCount

user32

LoadImageW
ShowWindow
GetWindowRect
BeginPaint
EndPaint
DispatchMessageW
TranslateMessage
EndDialog
GetDlgItem
ScreenToClient
InvalidateRect
MessageBoxW
EnableWindow
FillRect
PostQuitMessage
SendMessageW
CreateDialogParamW
GetMessageW
GetDesktopWindow
MoveWindow
SetWindowTextW
GetDlgCtrlID

advapi32

RegSetValueExW
RegQueryValueExW
RegOpenKeyW
RegDeleteKeyW
RegCloseKey
RegEnumKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCreateKeyW
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW

ole32

StringFromGUID2
CoCreateGuid

shell32

ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathW

shlwapi

PathAppendW
PathFileExistsW

gdi32

DeleteObject
CreateFontW
SetTextColor
CreateSolidBrush

wininet

InternetOpenW
InternetOpenUrlA
InternetConnectA
InternetReadFile
HttpOpenRequestA
HttpSendRequestA
HttpAddRequestHeadersA
InternetCloseHandle
InternetOpenA

comctl32

InitCommonControlsEx

psapi

GetProcessImageFileNameW
EnumProcesses

Sections

.text
Size: 694KB - Virtual size: 693KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a94b87711098cb8cb9d434fb18a71d1a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

shell32

shlwapi

gdi32

wininet

comctl32

psapi

Sections

.text Size: 694KB - Virtual size: 693KB

.rdata Size: 96KB - Virtual size: 96KB

.data Size: 13KB - Virtual size: 23KB

.rsrc Size: 11KB - Virtual size: 10KB

.reloc Size: 55KB - Virtual size: 54KB

.text
Size: 694KB - Virtual size: 693KB

.rdata
Size: 96KB - Virtual size: 96KB

.data
Size: 13KB - Virtual size: 23KB

.rsrc
Size: 11KB - Virtual size: 10KB

.reloc
Size: 55KB - Virtual size: 54KB