a54800e7d80bb8dd943b5d5c0b4cc871_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a54800e7d80bb8dd943b5d5c0b4cc871_JaffaCakes118
Size

162KB
MD5

a54800e7d80bb8dd943b5d5c0b4cc871
SHA1

0099626be6f4b984c14243a2809891968df84aad
SHA256

4f5325155d33970ce1201e963c6a30f60e0c662360f55d4925d4f65b909cfdd1
SHA512

97641dbb23bb2008ae06b03adfafd0c86bef66c71080d4edbef271d923e4a6c3f20d8e40863ee488ac66062c5d633c8b75636d9aab8e4b35ea00f92bd7dd1ae3
SSDEEP

3072:Ck6vlFwsWwPUUT3SLuD7lybmo1TskbQDaNTmDLHBculHUkH827qlH:j50TRD7l0mo1TsoualmJWe7a

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/MUAutoClicker.dll
unpack001/MUAutoClicker.exe
unpack001/MUAutoLoader.dll

Files

a54800e7d80bb8dd943b5d5c0b4cc871_JaffaCakes118
.rar
MUAutoClicker.dll
.dll windows:4 windows x86 arch:x86

4edfcd915a93f023ccdedb2cbd3c01a9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateThread
DisableThreadLibraryCalls
InterlockedIncrement
InterlockedDecrement
WaitForSingleObject
CloseHandle
TerminateThread
SetEvent
CreateEventW
LeaveCriticalSection
ResetEvent
EnterCriticalSection
WriteProcessMemory
ReadProcessMemory
FlushInstructionCache
GetCurrentProcess
GlobalAlloc
Beep
GetCurrentThreadId
SetLastError
lstrlenW
lstrcmpW
MulDiv
GetModuleFileNameW
GlobalUnlock
GlobalLock
GlobalFree
GlobalHandle
ResumeThread
CreateProcessW
GetCommandLineW
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
CreateFileW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetFilePointer
FlushFileBuffers
SetStdHandle
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetTickCount
GetFileType
SetHandleCount
ReadFile
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapSize
GetOEMCP
GetCPInfo
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
HeapCreate
HeapDestroy
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
WriteFile
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
HeapReAlloc
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
CreateFileA
SetEndOfFile
Sleep
GetCurrentProcessId
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetModuleHandleA
GetProcAddress
LoadLibraryA
VirtualProtect
FindResourceW
LoadResource
LockResource
lstrlenA
MultiByteToWideChar
GetStartupInfoA
GetLastError

user32

GetWindowTextLengthW
SetWindowTextW
CreateAcceleratorTableW
RegisterClassExW
GetClassInfoExW
DestroyAcceleratorTable
BeginPaint
RegisterWindowMessageW
FillRect
GetClassNameW
SetCapture
RedrawWindow
InvalidateRgn
GetDC
CharNextW
CreateDialogIndirectParamW
GetForegroundWindow
SetForegroundWindow
BringWindowToTop
SendInput
GetSystemMetrics
EnumDisplaySettingsA
SetWindowsHookExW
CreateDialogParamW
EndPaint
GetSysColor
UnhookWindowsHookEx
SetWindowContextHelpId
GetWindow
CreateWindowExW
MapDialogRect
CallNextHookEx
GetFocus
GetMessageW
IsDialogMessageW
IsChild
KillTimer
SetTimer
IsWindowVisible
InvalidateRect
UpdateWindow
SetWindowPos
GetWindowLongW
SetWindowLongW
DestroyWindow
CallWindowProcW
DefWindowProcW
FindWindowW
VkKeyScanW
GetCursorPos
ScreenToClient
ReleaseCapture
ClipCursor
SendMessageW
PostMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
EnumWindows
SendMessageTimeoutW
GetWindowThreadProcessId
IsWindow
GetClassNameA
LoadCursorW
SetCursor
ShowCursor
OffsetRect
DrawTextW
GetDlgItem
GetParent
SetDlgItemTextW
SendDlgItemMessageW
IsDlgButtonChecked
GetDlgItemTextW
CheckDlgButton
SetFocus
EnableWindow
ShowWindow
ReleaseDC
GetWindowDC
ClientToScreen
GetClientRect
GetWindowRect
MoveWindow
GetWindowTextW
GetDesktopWindow
UnregisterClassA

gdi32

DeleteDC
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
SelectObject
CreateSolidBrush
GetObjectW
GetStockObject
SetTextColor
ExtTextOutW
SetBkColor
GetDeviceCaps
DeleteObject
ExcludeClipRect

advapi32

RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW

ole32

OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
CoCreateInstance

oleaut32

LoadRegTypeLi
OleCreateFontIndirect
VariantClear
VariantInit
SysStringByteLen
SysAllocString
SysAllocStringLen
SysStringLen
SysFreeString
LoadTypeLi

Sections

.text
Size: 232KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MUAutoClicker.exe
.exe windows:4 windows x86 arch:x86

1ae1e1724c9380ed5946079fac7a503d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Projects\LordOfMU2\build\Release [Clicker]\LordOfMU\MUAutoClicker.pdb

Imports

comdlg32

GetOpenFileNameW

kernel32

DeleteCriticalSection
CloseHandle
CreateMutexW
GetModuleHandleW
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
SetEvent
EnterCriticalSection
LeaveCriticalSection
TerminateThread
WaitForSingleObject
GetTickCount
WideCharToMultiByte
FlushInstructionCache
GetCurrentProcess
GlobalAlloc
GetModuleFileNameW
LoadLibraryW
SetLastError
lstrlenW
lstrcmpW
MulDiv
GlobalUnlock
GlobalLock
Sleep
GlobalFree
GlobalHandle
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStdHandle
WriteFile
GetCurrentDirectoryA
GetFullPathNameW
ReadFile
ExitProcess
GetOEMCP
GetCPInfo
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
HeapCreate
GetStartupInfoW
FindFirstFileW
GetDriveTypeW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
InitializeCriticalSection
RaiseException
LoadLibraryA
GetProcAddress
lstrlenA
MultiByteToWideChar
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetLastError
SetEnvironmentVariableA
SetFilePointer
CompareStringW
CompareStringA
CreateFileA
GetDriveTypeA
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetTimeZoneInformation
CreateFileW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle

user32

GetCursorPos
CreatePopupMenu
AppendMenuW
TrackPopupMenu
PostQuitMessage
DestroyMenu
DialogBoxIndirectParamW
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
UnregisterClassA
IsWindow
SetFocus
GetFocus
DestroyAcceleratorTable
GetDesktopWindow
BeginPaint
EndPaint
FillRect
ReleaseCapture
GetClassNameW
GetDlgItem
GetParent
CreateAcceleratorTableW
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
GetClientRect
MoveWindow
CharNextW
GetSysColor
SendMessageW
SetWindowContextHelpId
GetWindow
SetWindowPos
MapDialogRect
RegisterClassExW
CreateWindowExW
CallWindowProcW
DefWindowProcW
LoadCursorW
GetClassInfoExW
GetWindowLongW
SetWindowLongW
DestroyWindow
LoadIconW
PostThreadMessageW
GetMessageW
DispatchMessageW
TranslateMessage
SetForegroundWindow
SetDlgItemTextW
SendDlgItemMessageW
SetWindowTextW
EndDialog
IsChild

gdi32

GetStockObject
GetObjectW
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
SelectObject
DeleteObject

advapi32

RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey

shell32

ShellExecuteW
Shell_NotifyIconW

ole32

OleUninitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
CoCreateInstance
CoUninitialize
CoInitialize
OleInitialize

oleaut32

SysStringByteLen
VariantInit
VariantClear
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
SysAllocStringLen
SysStringLen
SysFreeString
SysAllocString

Sections

.text
Size: 108KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
MUAutoLoader.dll
.dll windows:4 windows x86 arch:x86

48debfda852c9448222b2aadf5c5cc51

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
GetProcAddress
LoadLibraryA
Sleep
TerminateProcess
GetCurrentProcess
ExitProcess
CreateEventW
DisableThreadLibraryCalls
CloseHandle
GetModuleFileNameW
CreateProcessW
WaitForSingleObject
LoadLibraryW
GetModuleHandleW
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
GetDriveTypeA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetTimeZoneInformation
GetLastError
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileW
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
GetFullPathNameW
GetCurrentDirectoryA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
RtlUnwind
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSection

user32

MessageBoxW
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
PostMessageW
SetPropW
CallWindowProcW
SetWindowLongW
RemovePropW
GetClassNameW
GetClassNameA
IsWindow

Exports

Exports

InstallHook
InstallHook2
Main
RemoveHook
RemoveHook2

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

mydata
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4edfcd915a93f023ccdedb2cbd3c01a9

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

Sections

.text Size: 232KB - Virtual size: 228KB

.rdata Size: 36KB - Virtual size: 33KB

.data Size: 8KB - Virtual size: 15KB

.rsrc Size: 12KB - Virtual size: 8KB

.reloc Size: 20KB - Virtual size: 18KB

1ae1e1724c9380ed5946079fac7a503d

Headers

File Characteristics

PDB Paths

Imports

comdlg32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 108KB - Virtual size: 106KB

.rdata Size: 28KB - Virtual size: 26KB

.data Size: 12KB - Virtual size: 15KB

.rsrc Size: 8KB - Virtual size: 5KB

48debfda852c9448222b2aadf5c5cc51

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 43KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 8KB - Virtual size: 13KB

mydata Size: 4KB - Virtual size: 12B

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 232KB - Virtual size: 228KB

.rdata
Size: 36KB - Virtual size: 33KB

.data
Size: 8KB - Virtual size: 15KB

.rsrc
Size: 12KB - Virtual size: 8KB

.reloc
Size: 20KB - Virtual size: 18KB

.text
Size: 108KB - Virtual size: 106KB

.rdata
Size: 28KB - Virtual size: 26KB

.data
Size: 12KB - Virtual size: 15KB

.rsrc
Size: 8KB - Virtual size: 5KB

.text
Size: 44KB - Virtual size: 43KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 8KB - Virtual size: 13KB

mydata
Size: 4KB - Virtual size: 12B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 6KB