026fb32550bbac333ad2dc194cc975ec_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

026fb32550bbac333ad2dc194cc975ec_JaffaCakes118
Size

649KB
MD5

026fb32550bbac333ad2dc194cc975ec
SHA1

0f48e32b217e289aac649dff4e13ff682b0c3a7e
SHA256

95d45d7ac6a210f5f0c88c3b4b6c152aa52e11d8fc4107de0aaec410157e4055
SHA512

234ee1893b0870edd852ae494edfa7605bf58cb20bf2eaad5497e6557a20385e56287eacdf66b7bc679b098a981e6748f02437814ab5f318fd97cab7d4dbd20b
SSDEEP

12288:qCyGNs21dLWQTC2+TgL8n7HtYUfFObQvNt:tyGdTC2+T88n7HtlUbQvX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
026fb32550bbac333ad2dc194cc975ec_JaffaCakes118

Files

026fb32550bbac333ad2dc194cc975ec_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e6cfaeb52af7db9648cf15e2d910f89b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathIsRootA
SHDeleteKeyA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

winmm

PlaySoundA
timeSetEvent

wininet

InternetOpenUrlA
InternetCloseHandle
InternetReadFile
InternetOpenA

kernel32

GetProcAddress
LoadLibraryA
SystemTimeToFileTime
GetModuleFileNameA
CreateDirectoryA
GetFileAttributesA
IsBadReadPtr
UnmapViewOfFile
lstrcmpiA
MapViewOfFile
CreateFileMappingA
lstrcatA
GetSystemDirectoryA
CopyFileA
lstrlenA
lstrcpyA
RaiseException
lstrlenW
Sleep
GetPrivateProfileStringA
RemoveDirectoryW
DeleteFileW
CopyFileW
SetProcessWorkingSetSize
GetCurrentProcess
HeapFree
GetProcessHeap
GlobalUnlock
GlobalLock
GlobalAlloc
WaitForSingleObject
CreateProcessA
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GetModuleHandleA
InterlockedIncrement
InterlockedDecrement
lstrcpynA
IsDBCSLeadByte
CreateThread
GetTickCount
LoadLibraryExA
MulDiv
HeapAlloc
FlushInstructionCache
lstrcmpA
GetCurrentThreadId
LocalFree
FormatMessageA
GetWindowsDirectoryA
WritePrivateProfileStringA
GetPrivateProfileIntA
CreateEventA
GetCommandLineA
OutputDebugStringA
SetEvent
GetSystemTime
GetCurrentThread
VirtualQuery
SetErrorMode
SetUnhandledExceptionFilter
GetLocalTime
GetTempPathA
TerminateThread
SetThreadPriority
ResumeThread
HeapSize
FreeLibrary
HeapDestroy
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
ExitProcess
GetStartupInfoA
ReadProcessMemory
GetThreadSelectorEntry
VirtualQueryEx
EnterCriticalSection
LeaveCriticalSection
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
WideCharToMultiByte
HeapReAlloc
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSection
CloseHandle
FindClose
FindFirstFileA
GetLastError
CreateFileA
WriteFile
ReadFile
SetFilePointer
GetFileSize
MoveFileA
DeleteFileA

user32

GetWindowTextA
wsprintfA
CharNextA
PostMessageA
ReleaseDC
GetClientRect
GetDC
PtInRect
GetCursorPos
GetWindowRect
DefWindowProcA
ShowWindow
MessageBeep
KillTimer
SetTimer
SetWindowPos
SystemParametersInfoA
SetCursor
DestroyWindow
LoadCursorA
LoadBitmapA
GetWindowLongA
SendMessageA
EnableWindow
SendMessageW
GetActiveWindow
GetDlgItemTextA
GetMessageA
TranslateMessage
DispatchMessageA
FindWindowA
LoadMenuA
GetSubMenu
GetWindowThreadProcessId
AttachThreadInput
TrackPopupMenu
RegisterWindowMessageA
GetWindowTextLengthA
DestroyIcon
UnregisterHotKey
RegisterHotKey
GetClassInfoExA
CreateAcceleratorTableA
GetClassNameA
RedrawWindow
DestroyAcceleratorTable
IsWindow
GetFocus
IsChild
GetWindow
SetFocus
BeginPaint
EndPaint
CallWindowProcA
GetDesktopWindow
InvalidateRgn
InvalidateRect
SetCapture
ReleaseCapture
GetSysColor
EnumThreadWindows
FlashWindow
DialogBoxParamA
DrawTextA
DrawIconEx
FillRect
FrameRect
SetWindowTextA
SetDlgItemTextA
SetWindowLongA
GetDlgItem
LoadIconA
EndDialog
IsWindowVisible
GetSystemMetrics
GetForegroundWindow
GetParent
ExitWindowsEx
SetForegroundWindow
BringWindowToTop
SetCursorPos
mouse_event
PostQuitMessage
MessageBoxW
MessageBoxA
UnregisterClassA
RegisterClassExA
CreateWindowExA

gdi32

GetDeviceCaps
PatBlt
GetStockObject
MoveToEx
LineTo
CreatePen
GetDIBits
CreateSolidBrush
CreateFontIndirectA
CreateRectRgn
CombineRgn
CreateCompatibleBitmap
DeleteObject
StretchBlt
GetObjectA
CreateCompatibleDC
DeleteDC
Rectangle
SetTextColor
SelectObject
SetBkMode
TextOutA
PtInRegion
BitBlt

comdlg32

GetOpenFileNameA
GetSaveFileNameA

advapi32

RegEnumKeyExA
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
RegQueryValueExA
RegCreateKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegQueryInfoKeyA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
RegCloseKey
RegOpenKeyA
CryptReleaseContext

shell32

SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
ShellExecuteExA
ShellExecuteA
SHGetFileInfoA
ExtractIconA
Shell_NotifyIconA

ole32

CoRevokeClassObject
CoRegisterClassObject
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
StringFromIID
CoCreateInstance
StringFromGUID2
OleLockRunning
CreateStreamOnHGlobal
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
OleInitialize
OleUninitialize
CoUninitialize
CoInitialize

oleaut32

SysStringLen
VarBstrCat
VarBstrCmp
SysStringByteLen
SysAllocStringByteLen
SysFreeString
SysAllocString
SysAllocStringLen
VariantCopy
VariantClear
VariantInit
VarUI4FromStr
LoadRegTypeLi
OleCreateFontIndirect
LoadTypeLi

registerdll

IsConnect
GetAuthenInfo
Logout
Authentication
SetAutoLogin
Registerexit
setregisterproxy
SetDownloadMessage
TestMyXunleiConnect
GetUserNameInfo
GetMessageNum
SetRetryGetMessage
Registerinit

imagehlp

SymFunctionTableAccess
SymSetOptions
SymLoadModule
SymGetModuleBase
SymGetSymFromAddr
SymGetModuleInfo
CheckSumMappedFile
SymInitialize
StackWalk

msvcr71

time
atoi
wcslen
_mbscmp
_except_handler3
_resetstkoflw
malloc
fopen
fclose
strncpy
_mbsnbicmp
_mbslwr
_mbsstr
_mbsicmp
_ismbcspace
_mbsinc
_i64toa
strcat
strstr
sprintf
_mbsrchr
_ismbcalpha
strcpy
??_V@YAXPAX@Z
_purecall
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_wtoi64
_wtoi
vsprintf
_vscprintf
free
_CxxThrowException
__CxxFrameHandler
??3@YAXPAX@Z
memset
memmove
memchr
memcpy
strlen
_mbscspn
realloc
_atoi64
fgets
fputs
_callnewh
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
_itoa
_stricmp
_strnicmp
_strlwr
_strupr
_beginthreadex
_snprintf
_mbsnbcpy
localtime
_onexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_c_exit
_exit
_XcptFilter
_ismbblead
_cexit
memcmp
isalnum
exit
_acmdln
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
__security_error_handler
_controlfp
__dllonexit

Sections

.text
Size: 220KB - Virtual size: 216KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 368KB - Virtual size: 366KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.KL
Size: 652B - Virtual size: 652B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e6cfaeb52af7db9648cf15e2d910f89b

Headers

File Characteristics

Imports

shlwapi

version

winmm

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

registerdll

imagehlp

msvcr71

Sections

.text Size: 220KB - Virtual size: 216KB

.rdata Size: 48KB - Virtual size: 47KB

.data Size: 4KB - Virtual size: 18KB

.rsrc Size: 368KB - Virtual size: 366KB

.KL Size: 652B - Virtual size: 652B

.text
Size: 220KB - Virtual size: 216KB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 4KB - Virtual size: 18KB

.rsrc
Size: 368KB - Virtual size: 366KB

.KL
Size: 652B - Virtual size: 652B