0f9735968f7ba0decdb623f8ce18d086_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

0f9735968f7ba0decdb623f8ce18d086_JaffaCakes118
Size

8.1MB
MD5

0f9735968f7ba0decdb623f8ce18d086
SHA1

4e12a120fa1924e429dec944a4e777c99c0109a5
SHA256

95813805d85eed6f2f8d8f3bae83c53f49fe130f6d400d82bcb0d4b7761eebd7
SHA512

d2c3cebf62e16653be0d54f81789b9854daa202ac176b1c74a4244c33ccf4112b41de50c58ed2f1518dca9095d84d5d4e0bba845ad9a67f2327f59e2520b882f
SSDEEP

196608:OuUNoNUEirWjx+rwPNcbUY3z9DHbltMLQZiLtOawhh5ARg:OuUNoNUPajorwKbX3zFbeQGoB4Rg

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/PMC.MEncoder_3.8.977_gb/PMC_ME.exe
unpack001/PMC.MEncoder_3.8.977_gb/Tools/ffmpeg.exe
unpack001/PMC.MEncoder_3.8.977_gb/Tools/mencoder.exe

Files

0f9735968f7ba0decdb623f8ce18d086_JaffaCakes118
.rar
PMC.MEncoder_3.8.977_gb/PMC_ME.exe
.exe windows:4 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 511KB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 57KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PMC.MEncoder_3.8.977_gb/PMC_ME.ver
PMC.MEncoder_3.8.977_gb/Q&A.txt
PMC.MEncoder_3.8.977_gb/Readme.txt
PMC.MEncoder_3.8.977_gb/Tools/ffmpeg.exe
.exe windows:4 windows x86 arch:x86

4e51295253133e7df7353b50c759a41b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
CreateEventA
CreateMutexA
CreateSemaphoreA
CreateThread
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
OpenProcess
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
SetEvent
SetLastError
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualAlloc
VirtualFree
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte

msvcrt

_close
_fdopen
_getch
_isatty
_kbhit
_open
_read
_setmode
_strdup
_swab
_tempnam
_unlink
_write
__getmainargs
__lc_codepage
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_assert
_atoi64
_beginthreadex
_cexit
_endthreadex
_errno
_filbuf
_ftime
_iob
_isctype
_lseeki64
_onexit
_pctype
_setjmp
_setmode
_stricmp
_strnicmp
abort
acos
asin
atan
atexit
atof
atoi
calloc
ceil
cos
cosh
exit
exp
fclose
fflush
fgetc
floor
fopen
fprintf
fputc
fputs
fread
free
frexp
fscanf
fseek
ftell
fwrite
getenv
gmtime
isalpha
isprint
isspace
ldexp
localeconv
localtime
log
log10
longjmp
malloc
memchr
memcpy
memmove
memset
mktime
perror
pow
qsort
rand
realloc
rename
signal
sin
sinh
sprintf
sqrt
srand
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strerror
strlen
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtok
strtol
strtoul
tan
tanh
time
tolower
toupper
ungetc
vfprintf
vsprintf
wcslen

user32

DestroyWindow
GetWindowLongA
SendMessageA
SetWindowLongA

avicap32

capCreateCaptureWindowA

avifil32

AVIFileExit
AVIFileGetStream
AVIFileInfoA
AVIFileInit
AVIFileOpenA
AVIFileRelease
AVIStreamInfoA
AVIStreamRead
AVIStreamReadFormat
AVIStreamRelease

ws2_32

WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
__WSAFDIsSet
bind
closesocket
connect
gethostbyname
gethostname
getsockname
getsockopt
htonl
htons
inet_ntoa
ioctlsocket
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
socket

Sections

.text
Size: 6.8MB - Virtual size: 6.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rotext
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 5.1MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PMC.MEncoder_3.8.977_gb/Tools/mencoder.exe
.exe windows:4 windows x86 arch:x86

71c3feeecf97f548221eb4cb1c628f30

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegCreateKeyExA
RegSetValueExA

kernel32

CloseHandle
CreateEventA
CreateFileA
CreateFileMappingA
CreateSemaphoreA
CreateThread
DeleteCriticalSection
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExitProcess
ExpandEnvironmentStringsA
FindClose
FindFirstFileA
FindNextFileA
FindResourceA
FreeLibrary
GetACP
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDriveTypeA
GetFileAttributesA
GetFileAttributesExA
GetFullPathNameA
GetLastError
GetLogicalDrives
GetLongPathNameA
GetModuleFileNameA
GetModuleHandleA
GetNumberOfConsoleInputEvents
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetStdHandle
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathA
GetThreadContext
GetThreadPriority
GetVersion
GetWindowsDirectoryA
HeapAlloc
HeapFree
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
InterlockedIncrement
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadResource
LockResource
MapViewOfFile
MultiByteToWideChar
OpenProcess
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleInputA
ReadFile
ReleaseSemaphore
ResetEvent
ResumeThread
SetConsoleMode
SetConsoleTextAttribute
SetEnvironmentVariableA
SetEvent
SetFilePointer
SetLastError
SetPriorityClass
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnmapViewOfFile
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte

msvcrt

_access
_close
_fdopen
_ftime
_memccpy
_mkdir
_open
_putenv
_read
_rmdir
_setmode
_stat
_strdup
_swab
_tempnam
_unlink
_write
__getmainargs
__lc_codepage
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_assert
_beginthread
_beginthreadex
_cexit
_endthread
_endthreadex
_errno
_filbuf
_findclose
_findfirst
_findnext
_flsbuf
_fstati64
_ftime
_fullpath
_get_osfhandle
_iob
_isctype
_lseeki64
_mkdir
_onexit
_open_osfhandle
_pctype
_setjmp
_setmode
_snprintf
_stati64
_stricmp
_strnicmp
_telli64
abort
acos
asin
atan
atan2
atexit
atof
atoi
atol
bsearch
calloc
ceil
clearerr
cos
cosh
ctime
exit
exp
fclose
fflush
fgetc
fgets
floor
fopen
fprintf
fputc
fputs
fread
free
frexp
fscanf
fseek
ftell
fwrite
getenv
gmtime
ldexp
localeconv
localtime
log
log10
longjmp
malloc
mbstowcs
memchr
memcmp
memcpy
memmove
memset
mktime
modf
perror
pow
printf
putchar
puts
qsort
rand
realloc
rename
rewind
setbuf
setlocale
signal
sin
sinh
sprintf
sqrt
srand
sscanf
strcat
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtok
strtol
strtoul
tan
tanh
time
tolower
toupper
ungetc
vfprintf
vsprintf
wcslen
wcstombs

ole32

CoCreateInstance
CoInitialize
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CreateItemMoniker
GetRunningObjectTable

user32

wsprintfW

winmm

timeGetTime

ws2_32

WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyname
gethostname
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
socket

Sections

.text
Size: 8.2MB - Virtual size: 8.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

/4
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rotext
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 249KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 5.4MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PMC.MEncoder_3.8.977_gb/Update.txt
PMC.MEncoder_3.8.977_gb/新云软件.url
.url

Sharing

General

Malware Config

Signatures

Files

09d0478591d4f788cb3e5ea416c25237

Headers

File Characteristics

Imports

kernel32

Sections

.text Size: 511KB - Virtual size: 3.2MB

.rsrc Size: 57KB - Virtual size: 60KB

4e51295253133e7df7353b50c759a41b

Headers

File Characteristics

Imports

kernel32

msvcrt

user32

avicap32

avifil32

ws2_32

Sections

.text Size: 6.8MB - Virtual size: 6.8MB

.rotext Size: 107KB - Virtual size: 106KB

.data Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.rodata Size: 13KB - Virtual size: 12KB

.bss Size: - Virtual size: 5.1MB

.idata Size: 6KB - Virtual size: 5KB

71c3feeecf97f548221eb4cb1c628f30

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

ole32

user32

winmm

ws2_32

Sections

.text Size: 8.2MB - Virtual size: 8.2MB

/4 Size: 118KB - Virtual size: 117KB

.rotext Size: 107KB - Virtual size: 106KB

.data Size: 249KB - Virtual size: 248KB

.rdata Size: 3.2MB - Virtual size: 3.2MB

.rodata Size: 13KB - Virtual size: 12KB

.bss Size: - Virtual size: 5.4MB

.idata Size: 7KB - Virtual size: 7KB

.rsrc Size: 109KB - Virtual size: 108KB

.text
Size: 511KB - Virtual size: 3.2MB

.rsrc
Size: 57KB - Virtual size: 60KB

.text
Size: 6.8MB - Virtual size: 6.8MB

.rotext
Size: 107KB - Virtual size: 106KB

.data
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.rodata
Size: 13KB - Virtual size: 12KB

.bss
Size: - Virtual size: 5.1MB

.idata
Size: 6KB - Virtual size: 5KB

.text
Size: 8.2MB - Virtual size: 8.2MB

/4
Size: 118KB - Virtual size: 117KB

.rotext
Size: 107KB - Virtual size: 106KB

.data
Size: 249KB - Virtual size: 248KB

.rdata
Size: 3.2MB - Virtual size: 3.2MB

.rodata
Size: 13KB - Virtual size: 12KB

.bss
Size: - Virtual size: 5.4MB

.idata
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 109KB - Virtual size: 108KB