a44a9bb8728feff5ea9dea14e3f303f0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
a44a9bb8728feff5ea9dea14e3f303f0_JaffaCakes118
Size 2.4MB
Sample240613-hndtmayarb
SHA256 88f1a077ebf23d8379660224d06985fde832eae90aefb80c15263c83d43eb543
MD5 a44a9bb8728feff5ea9dea14e3f303f0
SHA1 506e24fc953af7fc13e8651c3f965199707b301e
SHA512 6901b14aae5d83ab6ec6f214d1834e1fd4f3858651da725ac2080c99a475b2f507725cb5034fe1056a58485247df8e6b382838b25a55f9c052b71bd90702ccbc
SSDEEP 49152:p9VmdUFpFECbA6qvTNTOOTDxsgbn4Ej5BHYDXTYPQnRxlP2RvTA7V0RZOTQ:vBFEMAFr4UHYDjYkh0vTA5EZOk
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

a44a9bb8728feff5ea9dea14e3f303f0_JaffaCakes118

.exe 2.4MB

a44a9bb8728feff5ea9dea14e3f303f0_JaffaCakes118

IMPHASH 2568575e3d06733a75110675395ccd47
SHA256 88f1a077ebf23d8379660224d06985fde832eae90aefb80c15263c83d43eb543
MD5 a44a9bb8728feff5ea9dea14e3f303f0
SHA1 506e24fc953af7fc13e8651c3f965199707b301e
SHA512 6901b14aae5d83ab6ec6f214d1834e1fd4f3858651da725ac2080c99a475b2f507725cb5034fe1056a58485247df8e6b382838b25a55f9c052b71bd90702ccbc
SSDEEP 49152:p9VmdUFpFECbA6qvTNTOOTDxsgbn4Ej5BHYDXTYPQnRxlP2RvTA7V0RZOTQ:vBFEMAFr4UHYDjYkh0vTA5EZOk
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

a3:b9:6f:ca:f7:79:0f:19:4b:a3:95:32:56:93:6c:52:64:d8:77:f8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=北京丰余科技有限公司,O=北京丰余科技有限公司,L=北京市,ST=北京市,C=CN

Chains

Mar 15, 2017

Minor OS version

Major OS version

Entry point

523279

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

QueryPerformanceFrequency GetModuleHandleW GetModuleFileNameW LoadLibraryExW CreateMutexA lstrcmpiW GetCurrentProcessId GetProcAddress InterlockedDecrement InterlockedIncrement DecodePointer Process32NextW Process32FirstW CreateToolhelp32Snapshot WideCharToMultiByte MultiByteToWideChar GetVersionExW CreateFileW QueryDosDeviceW GetTempFileNameW GetTempPathW FindResourceA GetStartupInfoW CreateProcessW GetLogicalDriveStringsW CloseHandle ReadFile lstrlenA lstrcmpiA lstrcmpA GetFileSize Sleep WaitForSingleObject ResumeThread SetThreadPriority TerminateProcess OpenProcess VirtualFree VirtualAlloc FreeLibrary FreeResource WritePrivateProfileStringW GetPrivateProfileStringW FindResourceExW FindResourceW GetCommandLineW SizeofResource LoadResource DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection InitializeCriticalSection SetLastError GetLastError GetCurrentThreadId RaiseException GetCurrentProcess UnmapViewOfFile GetDiskFreeSpaceExW MoveFileW SetEndOfFile GetCurrentDirectoryW WriteConsoleW SetFileAttributesW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTimeZoneInformation MoveFileExW ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers GetOEMCP GetACP IsValidCodePage GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy FlushInstructionCache GetModuleHandleExW ExitProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW TlsFree TlsSetValue TlsGetValue TlsAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo SetEnvironmentVariableA SystemTimeToFileTime LocalFileTimeToFileTime GetFileType GetSystemTimeAsFileTime AreFileApisANSI ExitThread VirtualQuery VirtualProtect RtlUnwind EncodePointer GetStringTypeW IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent CreateFileA GetModuleFileNameA GetStdHandle lstrcpyW GetSystemInfo CreateThread GetVolumeInformationW GetDriveTypeW DeviceIoControl GetFileAttributesW RemoveDirectoryW FindClose FindNextFileW DeleteFileW FindFirstFileW GlobalFree LockResource SetFilePointer GetFileSizeEx GetFileTime SetFileTime CreateDirectoryW GetVersion CreateEventW ResetEvent SetEvent GlobalAlloc LocalFree OutputDebugStringW GlobalLock GlobalUnlock WriteFile lstrlenW LocalAlloc LoadLibraryW lstrcatW GetWindowsDirectoryW

user32

EnableWindow GetDlgItem IsWindowVisible SetWindowPos MoveWindow GetSystemMetrics MessageBoxW AdjustWindowRectEx GetWindowRect GetClientRect SetWindowTextW GetMenu GetDC ReleaseDC BeginPaint EndPaint InvalidateRect SendMessageW PostMessageW DefWindowProcW PostQuitMessage RedrawWindow ShowWindow DestroyWindow CreateWindowExW ClientToScreen MapWindowPoints CopyRect GetWindowLongW SetWindowLongW GetParent GetWindow GetClassInfoExW RegisterClassExW UnregisterClassW CallWindowProcW RemovePropA CharNextW wsprintfW MsgWaitForMultipleObjects RegisterWindowMessageW CreateDialogParamW PeekMessageW DispatchMessageW TranslateMessage GetMessageW WindowFromPoint ScreenToClient GetCursorPos DrawTextW IsWindowEnabled ReleaseCapture SetCapture IsWindow GetMonitorInfoW MonitorFromWindow SystemParametersInfoW IsDialogMessageW LoadImageW LoadCursorW

gdi32

ExtTextOutW PatBlt BitBlt SetStretchBltMode StretchBlt EnumFontFamiliesW CreateFontW DeleteDC CreateCompatibleDC GetStockObject GetObjectW DeleteObject SetBkMode SetTextColor GetTextMetricsW SelectObject SetBkColor CreateDCW CreateFontIndirectW

advapi32

RegEnumKeyExA RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegSetValueExW RegOpenKeyExW RegDeleteKeyW RegCreateKeyExW RegCloseKey RegQueryValueExA RegQueryValueExW RegOpenKeyExA

shell32

CommandLineToArgvW SHGetSpecialFolderLocation SHGetSpecialFolderPathW SHGetFolderPathW SHGetPathFromIDListW SHCreateDirectoryExW SHFileOperationW

ole32

CoUninitialize CoCreateInstance CreateStreamOnHGlobal CreateBindCtx CoInitialize CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree

oleaut32

VarUI4FromStr SysFreeString SysAllocString SysAllocStringLen SysStringLen VarBstrCmp SysAllocStringByteLen SysStringByteLen

shlwapi

PathIsRelativeW PathIsNetworkPathA PathIsNetworkPathW PathIsUNCW SHSetValueA PathIsRootW PathCombineW PathRemoveFileSpecW PathAppendW SHGetValueA PathFileExistsW PathAddBackslashW PathFindFileNameW PathIsDirectoryW StrCpyW

comctl32

InitCommonControlsEx _TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdipLoadImageFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipCreateHBITMAPFromBitmap GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipCreateFromHDC GdipDeleteGraphics GdipDrawRectangleI GdipFillRectangleI GdipCreateBitmapFromScan0 GdiplusStartup GdipAlloc GdipFree GdipCloneImage

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

ws2_32

freeaddrinfo getaddrinfo WSASocketW WSASend WSAResetEvent WSARecv WSAGetOverlappedResult WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSASetEvent WSAStartup WSACleanup closesocket WSASetLastError WSAGetLastError WSACloseEvent WSAConnect

winmm

timeEndPeriod timeBeginPeriod

psapi

GetProcessImageFileNameW

urlmon

RegisterBindStatusCallback CreateURLMoniker

iphlpapi

GetAdaptersInfo

netapi32

Netbios

Name

.text

Size

664KB

Virtual Size

663KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

227KB

Virtual Size

226KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a44a9bb8728feff5ea9dea14e3f303f0_JaffaCakes118

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

version

ws2_32

winmm

psapi

urlmon

iphlpapi

netapi32

generic