0371d4305d43bf67997918857f34b1f9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0371d4305d43bf67997918857f34b1f9_JaffaCakes118
Size

163KB
MD5

0371d4305d43bf67997918857f34b1f9
SHA1

c04ca50ea05342c1609bbba9a7ea03e03d17c874
SHA256

fdc0303d3862f3cdca9fd781238b3bb791890f4406fc064ef434a7bd119a41b1
SHA512

68f3a66f57fa9015c7cfd6c7cac6723ee87527daf362b50488fa572617bdd1f660904ee84c597bba6b9874de0de3d51ec06595ae209a136c68871a6162372b2f
SSDEEP

3072:0i7GZ3udIDKbXxmEaBxk6xiu62EtDYBcmVWD5ltbmPX:0V+2DKbExk6xR6DYGmJP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0371d4305d43bf67997918857f34b1f9_JaffaCakes118

Files

0371d4305d43bf67997918857f34b1f9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dfc469706a10e8b978f1353579575178

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\users\dreamhunter\desktop\naversetup\trunk\naverappsetuptemplate\release\NaverAppSetupTemplate.pdb

Imports

kernel32

InterlockedDecrement
lstrlenW
RemoveDirectoryW
FindFirstFileW
InterlockedIncrement
GetExitCodeProcess
WaitForSingleObject
GetFileAttributesW
GetDiskFreeSpaceW
WideCharToMultiByte
GetModuleHandleW
GetVersionExW
DebugBreak
OutputDebugStringW
lstrlenA
GetCurrentProcess
GetCurrentProcessId
lstrcpynW
GetTempPathW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetVersionExA
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetTickCount
CreateDirectoryW
GetModuleFileNameW
GetSystemDirectoryW
FindResourceW
SizeofResource
LoadResource
LockResource
CreateFileW
SetFilePointer
WriteFile
DeleteFileW
LoadLibraryA
OpenProcess
CloseHandle
LoadLibraryW
GetProcAddress
RaiseException
FreeLibrary
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
VirtualAlloc
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoW
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
HeapReAlloc
GetModuleHandleA
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
HeapSize

user32

SetWindowPos
MessageBoxW
LoadStringW
CharLowerW
UnregisterClassA
GetWindowRect
SystemParametersInfoW
wsprintfW
EndDialog
CharNextW
wvsprintfW

advapi32

RegEnumKeyW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
GetUserNameW
LookupAccountSidW
RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
GetTokenInformation
RegEnumValueW

ole32

CoInitialize
CoCreateGuid
CoTaskMemFree
CoUninitialize

shell32

SHGetSpecialFolderPathW
ord680
ShellExecuteW
ShellExecuteExW

shlwapi

PathFindFileNameW
PathFileExistsW

Sections

.text
Size: 100KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8.4MB - Virtual size: 8.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dfc469706a10e8b978f1353579575178

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

shell32

shlwapi

Sections

.text Size: 100KB - Virtual size: 97KB

.rdata Size: 24KB - Virtual size: 22KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 8.4MB - Virtual size: 8.4MB

.text
Size: 100KB - Virtual size: 97KB

.rdata
Size: 24KB - Virtual size: 22KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 8.4MB - Virtual size: 8.4MB