23770363ac9ac1a72cf023c891279c51_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

23770363ac9ac1a72cf023c891279c51_JaffaCakes118
Size

733KB
MD5

23770363ac9ac1a72cf023c891279c51
SHA1

8457bd94cfcb787a43e97bc9c87ca59782547541
SHA256

f0104ee355efbf7546d75e1602906372b234ce28fd5aa5045e504d3c6e87e923
SHA512

e85fe92132b04534a82ddf011f371a5cc5cc2bcf2d73fdd28abf55ecfb673a988e9b98b745f4f5e3318a3fb76fef3d934becf0bd59e1ec664e3118385d34ba90
SSDEEP

12288:ROMgXIVI2ci9zpKAl72PL80hitkEGlqBQTVIWkNFs8FrOzdIfUhNxp+N5lv:8MJI/PL3hOkrqeTVIFsKrOBIch3sNv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
23770363ac9ac1a72cf023c891279c51_JaffaCakes118

Files

23770363ac9ac1a72cf023c891279c51_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ffcf86af608f0a1aab47c948e000fb39

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Work\SVN_NxApp\GameLauncher\NGLClient\NGLC_Nexon\Release_KartTPE\NGLC_Nexon.pdb

Imports

kernel32

lstrcmpW
GlobalFindAtomA
GlobalGetAtomNameA
FlushFileBuffers
LockFile
UnlockFile
GetVolumeInformationA
GetFullPathNameA
InterlockedIncrement
GlobalFlags
LocalAlloc
GlobalReAlloc
GlobalHandle
TlsGetValue
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
FileTimeToSystemTime
GetCPInfo
GetOEMCP
SetErrorMode
RtlUnwind
ExitProcess
ExitThread
CreateThread
VirtualProtect
VirtualAlloc
VirtualQuery
GetStartupInfoA
GetCommandLineA
HeapReAlloc
HeapSize
LCMapStringA
LCMapStringW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
SetStdHandle
GetTimeZoneInformation
IsBadReadPtr
IsBadCodePtr
SetEnvironmentVariableA
GlobalAddAtomA
WritePrivateProfileStringA
FreeResource
InterlockedDecrement
SetLastError
GlobalFree
MulDiv
GlobalUnlock
lstrcpynA
LocalFree
GetCurrentThread
GetCurrentThreadId
GlobalLock
GlobalAlloc
FreeLibrary
GlobalDeleteAtom
lstrcmpA
GetModuleHandleA
GetProcAddress
ConvertDefaultLocale
EnumResourceLanguagesA
lstrcpyA
LoadLibraryA
Sleep
GetCurrentProcess
DuplicateHandle
DosDateTimeToFileTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
GetFileTime
MoveFileA
GetFileInformationByHandle
SystemTimeToFileTime
CompareFileTime
FormatMessageA
SetEndOfFile
SetFileTime
GetFileSize
GetSystemInfo
LeaveCriticalSection
EnterCriticalSection
OpenProcess
TerminateProcess
lstrcatA
RemoveDirectoryA
FindNextFileA
GetTempPathA
FindFirstFileA
CreateDirectoryA
FindClose
HeapAlloc
GetProcessHeap
HeapFree
GetTickCount
WriteFile
CreateFileA
SetFilePointer
ReadFile
CompareStringW
CompareStringA
lstrlenA
lstrcmpiA
GetVersion
DeleteCriticalSection
InitializeCriticalSection
RaiseException
MultiByteToWideChar
GetCurrentDirectoryA
CreateProcessA
GetFileAttributesA
SetFileAttributesA
SetCurrentDirectoryA
CreateMutexA
DeleteFileA
GetWindowsDirectoryA
_lcreat
_hwrite
_lclose
lstrlenW
WideCharToMultiByte
WaitForSingleObject
CloseHandle
CreateEventA
SetEvent
FindResourceA
LoadResource
LockResource
SizeofResource
GetLastError
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetFileType
GetModuleFileNameA

user32

DestroyMenu
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
InvalidateRect
CopyAcceleratorTableA
SetRect
IsRectEmpty
CharNextA
GetSysColorBrush
LoadCursorA
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
WinHelpA
CreateWindowExA
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SendDlgItemMessageA
SetFocus
IsChild
GetWindowTextA
GetForegroundWindow
GetTopWindow
GetMessageTime
GetMessagePos
SetForegroundWindow
UpdateWindow
GetMenu
GetSysColor
AdjustWindowRectEx
EqualRect
GetClassInfoA
RegisterClassA
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
CharUpperA
UnregisterClassA
SetWindowRgn
GetWindowRect
GetCapture
SetCapture
SendMessageA
EnableWindow
LoadIconA
SystemParametersInfoA
OffsetRect
IntersectRect
IsIconic
GetWindowPlacement
CopyRect
PtInRect
RegisterWindowMessageA
GetClientRect
SetMenuItemBitmaps
GetFocus
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
SetWindowsHookExA
PostThreadMessageA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
IsWindowVisible
GetKeyState
PeekMessageA
ValidateRect
MessageBoxA
GetLastActivePopup
SetCursor
RegisterClipboardFormatA
MapWindowPoints
GetCursorPos
ReleaseCapture
SetTimer
KillTimer
PostMessageA
PostQuitMessage
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
UnhookWindowsHookEx
EndDialog
GetNextDlgTabItem
GetParent
IsWindowEnabled
GetDlgItem
GetWindowLongA
IsWindow
DestroyWindow
CreateDialogIndirectParamA
GetSystemMetrics
SetActiveWindow
GetActiveWindow
GetDesktopWindow
wsprintfA
MapDialogRect
SetWindowContextHelpId
GetWindow

gdi32

GetBkColor
GetTextColor
CreateRectRgnIndirect
GetRgnBox
GetMapMode
GetStockObject
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
CreateRectRgn
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
RestoreDC
SaveDC
GetObjectA
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
GetDeviceCaps
CombineRgn
ScaleViewportExtEx

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegOpenKeyExA
RegQueryValueExA
RegDeleteKeyA
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyA
RegEnumKeyA
RegCloseKey
RegQueryValueA

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetSpecialFolderPathA
SHGetMalloc

comctl32

ord17

shlwapi

PathFindFileNameA
PathStripToRootA
PathFindExtensionA
PathIsUNCA

oledlg

ord8

ole32

CoTaskMemFree
CoInitialize
CoUninitialize
CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocStringLen
SysStringLen
SysAllocString
SysAllocStringByteLen
VariantCopy
VariantChangeType
DispCallFunc
LoadRegTypeLi
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayCreate
SafeArrayDestroy
SystemTimeToVariantTime
OleCreateFontIndirect

wininet

FtpGetFileSize
FtpCommandA
FtpOpenFileA
FtpSetCurrentDirectoryA
HttpQueryInfoA
HttpOpenRequestA
HttpSendRequestA
InternetQueryDataAvailable
InternetGetLastResponseInfoA
InternetSetFilePointer
InternetReadFile
InternetConnectA
InternetCloseHandle
InternetOpenA

Sections

.text
Size: 320KB - Virtual size: 316KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 76KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 16KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 244KB - Virtual size: 243KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rrdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ffcf86af608f0a1aab47c948e000fb39

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

wininet

Sections

.text Size: 320KB - Virtual size: 316KB

.rdata Size: 76KB - Virtual size: 74KB

.data Size: 16KB - Virtual size: 40KB

.rsrc Size: 244KB - Virtual size: 243KB

.rrdata Size: 68KB - Virtual size: 68KB

.text
Size: 320KB - Virtual size: 316KB

.rdata
Size: 76KB - Virtual size: 74KB

.data
Size: 16KB - Virtual size: 40KB

.rsrc
Size: 244KB - Virtual size: 243KB

.rrdata
Size: 68KB - Virtual size: 68KB