2de60f5b347ff219176dfb062d84d377_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2de60f5b347ff219176dfb062d84d377_JaffaCakes118
Size

477KB
MD5

2de60f5b347ff219176dfb062d84d377
SHA1

01db08cad0199b539391fc05e61d7cee7c09002f
SHA256

23f9eadc8e4c7eaeb299e4714c7f4ec893f695f88a133c3b3dbbc540a8841801
SHA512

f8747b0706ae317e8c37ae387c2cd05aef77afc12d213a08a1c80dc4e6790464b8b7c8824a8f03e7af676c17228a2873e6bb23c8d98913df6ec15d9d2d9aca20
SSDEEP

12288:EmNry5awa9T/MPVNUB1WIrbfBCy9n3fhie1WIn5eb:bRggT/MPbk1WIroY3fXbnkb

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/DK X5/DK X5.exe
unpack001/DK X5/Dkx5.dll

Files

2de60f5b347ff219176dfb062d84d377_JaffaCakes118
.rar
DK X5/155绿色软件站.url
.url
DK X5/DK X5.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

code
Size: - Virtual size: 748KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

text
Size: 422KB - Virtual size: 424KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DK X5/Dkx5.dll
.dll regsvr32 windows:5 windows x86 arch:x86

a4720e887ce5857b1e6ea7bd7736d12d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

iasrad.pdb

Imports

msvcrt

wcsspn
?terminate@@YAXXZ
wcschr
iswdigit
wcstoul
_wcsicmp
wcsrchr
_wcsupr
memmove
qsort
bsearch
wcscmp
wcscpy
_itow
_except_handler3
_purecall
__CxxFrameHandler
??0exception@@QAE@ABV0@@Z
_callnewh
malloc
_CxxThrowException
free
wcslen
_ultow
_initterm
_adjust_fdiv
__dllonexit
_onexit
??1type_info@@UAE@XZ

msvcp60

??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??0bad_alloc@std@@QAE@PBD@Z
??1bad_alloc@std@@UAE@XZ
??0bad_alloc@std@@QAE@ABV01@@Z
??1_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?nothrow@std@@3Unothrow_t@1@B

atl

ord21
ord18
ord22
ord15
ord16
ord32

iaspolcy

IASAttributeRelease
IASAttributeAnsiAlloc
IASAttributeAlloc
IASAttributeAddRef

iassvcs

IASGetLocalDictionary
IASReportEvent
IASGetHostByName
IASRequestThread
IASRegisterComponent
IASVariantChangeType
IASRadiusCrypt
IASAdler32
IASGetDictionary

advapi32

GetSidLengthRequired
InitializeSid
GetSidSubAuthority
RegOpenKeyW
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
RegQueryValueExW
RegCloseKey

kernel32

HeapAlloc
GetProcessHeap
GetTickCount
TryEnterCriticalSection
SwitchToThread
LocalAlloc
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
HeapFree
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
SetEvent
CloseHandle
ResetEvent
Sleep
lstrlenW
GetLastError
InterlockedIncrement
DisableThreadLibraryCalls
MultiByteToWideChar
lstrlenA
GetCurrentThreadId
GetCurrentProcess
SetUnhandledExceptionFilter
ReleaseMutex
CreateMutexW
GetSystemInfo
VirtualAlloc
MapViewOfFile
CreateFileMappingW
InterlockedCompareExchange
InterlockedExchange
InitializeCriticalSectionAndSpinCount
CreateSemaphoreW
InterlockedExchangeAdd
ReleaseSemaphore
VirtualQuery
QueryPerformanceCounter
lstrcpyW
LocalFree
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
CreateEventW
WaitForSingleObject
GetModuleFileNameW

ole32

CoTaskMemAlloc
CoCreateInstance
CLSIDFromProgID
CoTaskMemFree
CLSIDFromString
CoGetClassObject

oleaut32

LoadRegTypeLi
SysAllocString
SysFreeString
VariantClear
VariantInit
SetErrorInfo

rtutils

TraceVprintfExA
TraceDeregisterW
TracePutsExA
TraceRegisterExW

ws2_32

WSASendTo
setsockopt
recv
socket
bind
ioctlsocket
closesocket
select
WSARecvFrom
inet_ntoa
sendto
htons
htonl
getsockname
ntohs
WSAGetLastError
ntohl
WSASocketW
recvfrom

ntdll

RtlRandom

Exports

Exports

?initialize@VSAFilter@@QAEJXZ
?radiusFromIAS@VSAFilter@@QBEJPAUIAttributesRaw@@@Z
?radiusToIAS@VSAFilter@@QBEJPAUIAttributesRaw@@@Z
?shutdown@VSAFilter@@QAEJXZ
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DK X5/System.ini
DK X5/使用简介.txt

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

code Size: - Virtual size: 748KB

text Size: 422KB - Virtual size: 424KB

.rsrc Size: 23KB - Virtual size: 24KB

a4720e887ce5857b1e6ea7bd7736d12d

Headers

File Characteristics

PDB Paths

Imports

msvcrt

msvcp60

atl

iaspolcy

iassvcs

advapi32

kernel32

ole32

oleaut32

rtutils

ws2_32

ntdll

Exports

Exports

Sections

.text Size: 96KB - Virtual size: 95KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 11KB - Virtual size: 10KB

.reloc Size: 6KB - Virtual size: 5KB

code
Size: - Virtual size: 748KB

text
Size: 422KB - Virtual size: 424KB

.rsrc
Size: 23KB - Virtual size: 24KB

.text
Size: 96KB - Virtual size: 95KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 11KB - Virtual size: 10KB

.reloc
Size: 6KB - Virtual size: 5KB