09227879fb45577eeb46075fc102ac75_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

09227879fb45577eeb46075fc102ac75_JaffaCakes118
Size

62KB
MD5

09227879fb45577eeb46075fc102ac75
SHA1

ff3227de272383f82bec02a34d9c09f97e92b8cc
SHA256

428e5f67acf6add46bf47dda02405e90d82930db2903073329cd594ba4bad9ca
SHA512

217e0b7b83cc283bdc865bf41b96d9e7a576a7be993b0eb40a56d3756d38516a3f231deb2552ea2b635296f7b2aa1dfb159e9eb959220df9e8ab0cceaf9d91db
SSDEEP

1536:XeIY42OAeJ6i55BBPoaZDvG1PIQPAoebmVqpmW:XtlvAeJ6i55/oeKwoebmMpmW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09227879fb45577eeb46075fc102ac75_JaffaCakes118

Files

09227879fb45577eeb46075fc102ac75_JaffaCakes118
.exe windows:4 windows x86 arch:x86

009e1399ded23046be85761f60ec1fa5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_XcptFilter
_exit
_stricmp
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
_CxxThrowException
??0exception@@QAE@ABV0@@Z
_onexit
__dllonexit
_acmdln
_controlfp
vsprintf
fwrite
time
srand
rand
strrchr
sscanf
??1type_info@@UAE@XZ
free
_purecall
realloc
strncpy
strstr
exit
atoi
__CxxFrameHandler
??2@YAPAXI@Z
memmove
memcmp
memcpy
memset
atol
strlen
strcpy
strcat
fopen
fseek
fread
fclose
sprintf
??3@YAXPAX@Z

kernel32

GetStartupInfoA
GetModuleHandleA
GetLocalTime
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
CreateDirectoryA
MoveFileA
DeleteFileA
Sleep
MultiByteToWideChar
lstrcatA
lstrcpyA
lstrcpynA
GetLastError
GetCurrentThreadId
lstrlenA
Process32Next
Process32First
CreateToolhelp32Snapshot
CloseHandle
VirtualFreeEx
ReadProcessMemory
VirtualAllocEx
OpenProcess
WideCharToMultiByte
lstrlenW
ReleaseMutex
CreateMutexA
GetPrivateProfileIntA
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
FreeResource
GlobalFree
GlobalHandle
LockResource
LoadResource
FindResourceA
GlobalAlloc
GlobalUnlock
GlobalLock
InterlockedIncrement
InterlockedDecrement
lstrcmpA
FlushInstructionCache
GetCurrentProcess
GetSystemDirectoryA
GetPrivateProfileStringA
GetVersionExA

user32

wsprintfA
CreateWindowExA
RegisterWindowMessageA
GetClassInfoExA
RegisterClassExA
CreateDialogIndirectParamA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA
GetWindowLongA
GetParent
GetWindow
SystemParametersInfoA
GetClientRect
InvalidateRgn
SendMessageA
GetWindowThreadProcessId
GetWindowTextA
GetDesktopWindow
SetWindowPos
LoadCursorA
SetCursor
GetWindowDC
ReleaseDC
FindWindowExA
FindWindowA
DestroyWindow
GetDlgItem
RedrawWindow
SetTimer
SetCapture
ReleaseCapture
MapWindowPoints
CreateAcceleratorTableA
GetWindowRect
GetSysColor
DestroyIcon
LoadIconA
SetWindowRgn
MoveWindow
IsDialogMessageA
ShowWindow
PtInRect
GetCursorPos
GetClassNameA
IsWindow
BeginPaint
FillRect
EndPaint
CallWindowProcA
GetDC
GetFocus
IsChild
SetFocus
GetWindowTextLengthA
SetWindowTextA
KillTimer
SetWindowLongA
InvalidateRect

gdi32

SetMapMode
DeleteObject
CreatePolygonRgn
SetBkMode
BitBlt
GetPixel
TextOutA
CreateCompatibleDC
GetStockObject
SelectPalette
CreateFontA
GetDeviceCaps
CreateSolidBrush
GetObjectA
CreateCompatibleBitmap
SelectObject
SetBkColor
ExtTextOutA
SetBitmapDimensionEx
RealizePalette
GetTextExtentPoint32A
CreateDCA
SetTextColor
DeleteDC

urlmon

URLDownloadToFileA

advapi32

RegOpenKeyExA
RegCloseKey
RegOpenKeyA
RegQueryValueExA

shell32

Shell_NotifyIconA
ShellExecuteA

ole32

CoTaskMemFree
CLSIDFromString
OleUninitialize
StringFromCLSID
CoTaskMemAlloc
OleLockRunning
OleInitialize
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CoCreateInstance
CLSIDFromProgID

oleaut32

SysAllocString
VariantClear
OleCreateFontIndirect
SysStringLen
LoadRegTypeLi
SysAllocStringLen
SysFreeString

wininet

DeleteUrlCacheEntry
InternetOpenUrlA
InternetCloseHandle
InternetReadFile
InternetOpenA

qqplugin

?fnQQSysMsg@@YAPAUHWND__@@PBDH000@Z
?fnQQPopMsg@@YAPAUHWND__@@PBDH000W4tagQQ_VER@@0@Z

qqplughook

?fnUnInstallHook@@YAHXZ
?fnInstallHook@@YAHXZ

clickloaddrv

fnClickLoadDrv
KillSD

killkis

fnKillKIS

winmm

sndPlaySoundA

comctl32

InitCommonControlsEx

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

009e1399ded23046be85761f60ec1fa5

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

gdi32

urlmon

advapi32

shell32

ole32

oleaut32

wininet

qqplugin

qqplughook

clickloaddrv

killkis

winmm

comctl32

Sections

.text Size: 39KB - Virtual size: 39KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 3KB - Virtual size: 5KB

.rsrc Size: 9KB - Virtual size: 8KB

.text
Size: 39KB - Virtual size: 39KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 3KB - Virtual size: 5KB

.rsrc
Size: 9KB - Virtual size: 8KB