2c4b31b6e4b3b80c078c1dce8a772c18_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2c4b31b6e4b3b80c078c1dce8a772c18_JaffaCakes118
Size

276KB
MD5

2c4b31b6e4b3b80c078c1dce8a772c18
SHA1

3a2d202c3896314ffda8e1911569089d0e717d90
SHA256

62f60c1b187e0d85784410a95cbf1625241945915641ff52e56f3407138b730c
SHA512

7122c68f0a8b0ebc37024cdc1f12cd08a6849dba3bcdb01e074cdaebfbe9d1a358d68efcb21f245c281806a6d41565595d7c6b3b8807b99939571dbb76c1e9f4
SSDEEP

6144:AZLEEZ8Kqt9Sw9B458RDlhVrg5hAhYovLTlj:AZPpqt0w/42RhXrbYCLJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2c4b31b6e4b3b80c078c1dce8a772c18_JaffaCakes118

Files

2c4b31b6e4b3b80c078c1dce8a772c18_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3e7f871d4d67e25660dbc16d642857bc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\svnroot\kad_search_demo\Product Release\kad_search_demo.pdb

Imports

dispatch

start_kad_search
get_server_search_result
stop_server_search
start_server_search
get_kad_search_result
stop_kad_search
generate_ed2k_link
init
delete_file_basic_info_table
uninit
get_emule_status

kernel32

GetFileTime
RtlUnwind
ExitProcess
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStartupInfoA
GetCommandLineA
TerminateProcess
HeapReAlloc
HeapSize
SetUnhandledExceptionFilter
GetFileAttributesA
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
LCMapStringA
LCMapStringW
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
IsBadReadPtr
IsBadCodePtr
SetStdHandle
SetEnvironmentVariableA
FileTimeToLocalFileTime
SetErrorMode
FileTimeToSystemTime
GetOEMCP
GetCPInfo
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
EnterCriticalSection
GlobalHandle
GlobalReAlloc
LeaveCriticalSection
LocalAlloc
RaiseException
GlobalFlags
InterlockedIncrement
InterlockedDecrement
GlobalGetAtomNameA
GlobalFindAtomA
lstrcatA
lstrcmpW
SetLastError
MulDiv
FormatMessageA
lstrcpynA
LocalFree
WritePrivateProfileStringA
GlobalFree
FreeResource
GlobalAddAtomA
GetCurrentThread
GetCurrentThreadId
FreeLibrary
GlobalDeleteAtom
lstrcmpA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
ConvertDefaultLocale
EnumResourceLanguagesA
lstrcpyA
LoadLibraryA
GetCurrentDirectoryA
CreateFileA
GetFileSize
ReadFile
CloseHandle
InitializeCriticalSection
DeleteCriticalSection
CompareStringW
CompareStringA
lstrcmpiA
GetVersion
GetLastError
GetTickCount
lstrlenA
GlobalAlloc
GlobalLock
GlobalUnlock
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
QueryPerformanceCounter

user32

CharNextA
IsRectEmpty
SetRect
CopyAcceleratorTableA
InvalidateRect
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
RegisterClipboardFormatA
PostThreadMessageA
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
ReleaseDC
GetDC
DestroyMenu
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
WinHelpA
GetCapture
CreateWindowExA
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SendDlgItemMessageA
SetFocus
IsChild
GetWindowTextA
GetForegroundWindow
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
TrackPopupMenu
SetForegroundWindow
UpdateWindow
GetMenu
GetSysColor
AdjustWindowRectEx
EqualRect
GetClassInfoA
RegisterClassA
UnregisterClassA
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
CopyRect
GetMenuItemID
GetMenuItemCount
GetWindow
SetWindowContextHelpId
MapDialogRect
SetWindowPos
wsprintfA
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
SetMenuItemBitmaps
GetFocus
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
GetKeyState
PeekMessageA
ValidateRect
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
SetCursor
PostQuitMessage
PostMessageA
GetSysColorBrush
CharUpperA
GetCursorPos
MessageBoxA
EmptyClipboard
SetClipboardData
CloseClipboard
GetSystemMetrics
LoadIconA
EnableWindow
ReleaseCapture
LoadCursorA
SetCapture
EndPaint
BeginPaint
OpenClipboard
KillTimer
SetTimer
IsWindowVisible
GetClientRect
GetWindowRect
IsIconic
GetSystemMenu
SendMessageA
LoadMenuA
GetSubMenu
AppendMenuA
DrawIcon
PtInRect
ScreenToClient

gdi32

ExtSelectClipRgn
GetWindowExtEx
DeleteDC
GetStockObject
GetBkColor
GetTextColor
GetRgnBox
GetViewportExtEx
DeleteObject
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutA
RectVisible
PtVisible
GetObjectA
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
GetMapMode
CreateBitmap
SetMapMode
RestoreDC
SaveDC
CreateRectRgnIndirect
ExtTextOutA

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyA
RegQueryValueA
RegCreateKeyExA
RegSetValueExA
RegCloseKey

comctl32

ord17
ImageList_Destroy

shlwapi

PathFindFileNameA
PathStripToRootA
PathFileExistsA
PathFindExtensionA
PathIsUNCA

oledlg

ord8

ole32

CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoTaskMemAlloc

oleaut32

VariantInit
VariantCopy
SafeArrayDestroy
SystemTimeToVariantTime
OleCreateFontIndirect
SysAllocStringByteLen
SysStringLen
VariantChangeType
SysAllocStringLen
SysFreeString
SysAllocString
VariantClear

Sections

.text
Size: 192KB - Virtual size: 188KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3e7f871d4d67e25660dbc16d642857bc

Headers

File Characteristics

PDB Paths

Imports

dispatch

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

comctl32

shlwapi

oledlg

ole32

oleaut32

Sections

.text Size: 192KB - Virtual size: 188KB

.rdata Size: 48KB - Virtual size: 46KB

.data Size: 12KB - Virtual size: 22KB

.rsrc Size: 20KB - Virtual size: 18KB

.text
Size: 192KB - Virtual size: 188KB

.rdata
Size: 48KB - Virtual size: 46KB

.data
Size: 12KB - Virtual size: 22KB

.rsrc
Size: 20KB - Virtual size: 18KB