2c894c9398283a538c14b4f3dec021c5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2c894c9398283a538c14b4f3dec021c5_JaffaCakes118
Size

600KB
MD5

2c894c9398283a538c14b4f3dec021c5
SHA1

1f227f4aa7f46cf2e579fb9b75af52d7945a5a8b
SHA256

6cd5a19fbe19c20576494ed10e9cb7225f92d5f98db11f0e631db084184d7d72
SHA512

1995265707d1a8b16b6e8aaa1dc36a14256d86de059ed4f94545e8cf105dad0492c7058fa396f5a11637ce58cbc8883ee413e84c0999805e98bc57758690f6df
SSDEEP

12288:MCm9cF1znWpgnKv2EyOvjkM/SPVyH9ImSyQktlhHZCcpn47nKIWcGwHEgRyqGL+E:MCmogjL5Cc2hPoDvBclPlwnRK0k+S8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2c894c9398283a538c14b4f3dec021c5_JaffaCakes118

Files

2c894c9398283a538c14b4f3dec021c5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fc0000bc8adbc1e89ee89437dd2dc8e3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\p4os\client\Projects\GameUpdate\Development\EvilGameUpdate\EvilUpdateService\Samples\gu\Vc80\Release\gu.pdb

Imports

rpcrt4

NdrServerCall
RpcMgmtStopServerListening
RpcServerUnregisterIf
RpcServerUseProtseqEpA
RpcServerRegisterIf
RpcServerListen

wintrust

WinVerifyTrust

kernel32

WritePrivateProfileStringA
GlobalFlags
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetCurrentProcess
FindClose
FindFirstFileA
GetVolumeInformationA
GetCPInfo
GetOEMCP
SetErrorMode
FileTimeToLocalFileTime
GetFileAttributesA
GetFileTime
GetTickCount
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
HeapAlloc
HeapFree
HeapReAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetProcessHeap
GetStartupInfoA
ExitThread
CreateThread
GetTimeFormatA
GetDateFormatA
ExitProcess
HeapSize
VirtualFree
HeapDestroy
HeapCreate
GetACP
IsValidCodePage
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
SetConsoleMode
ReadConsoleInputA
FileTimeToSystemTime
GetThreadLocale
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
FreeResource
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetVersionExA
GetCurrentProcessId
GlobalAddAtomA
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
LoadLibraryA
lstrcmpA
FreeLibrary
GetModuleHandleA
GetProcAddress
SetLastError
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
LocalFree
MulDiv
ExpandEnvironmentStringsA
GetStdHandle
WaitForMultipleObjects
GetLocalTime
GetFullPathNameA
DeleteFileA
GetModuleFileNameA
GetTempPathA
GetTempFileNameA
GetDiskFreeSpaceExA
Sleep
OutputDebugStringA
SetEvent
CloseHandle
CreateEventA
WaitForSingleObject
ResetEvent
lstrlenA
CompareStringW
CompareStringA
GetVersion
MultiByteToWideChar
InterlockedExchange
GetCurrentDirectoryA
CreateFileA
GetFileSize
ReadFile
GetLastError
FormatMessageA
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
GetFileInformationByHandle
PeekNamedPipe
GetCommandLineA
CreateFileW

user32

RegisterClipboardFormatA
PostThreadMessageA
CharNextA
DestroyMenu
ReleaseCapture
SetCapture
LoadCursorA
GetSysColorBrush
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetDesktopWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
ReleaseDC
GetDC
SetWindowContextHelpId
MapDialogRect
RegisterWindowMessageA
WinHelpA
IsChild
GetCapture
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
SetActiveWindow
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
SetForegroundWindow
UpdateWindow
GetMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
EqualRect
CopyRect
PtInRect
DefWindowProcA
CallWindowProcA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowTextLengthA
GetWindowTextA
SetWindowPos
SetFocus
ShowWindow
MoveWindow
SetWindowLongA
GetDlgCtrlID
IsWindow
SetWindowTextA
CharUpperA
IsDialogMessageA
SendDlgItemMessageA
GetDlgItem
GetWindow
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
UnregisterClassA
MessageBeep
GetNextDlgGroupItem
IsWindowEnabled
MessageBoxA
InvalidateRgn
InvalidateRect
SetRect
IsRectEmpty
MapWindowPoints
CopyAcceleratorTableA
DrawIcon
SendMessageA
PostMessageA
IsIconic
GetWindowRect
GetClientRect
EnableWindow
LoadIconA
GetSystemMetrics
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
PostQuitMessage
CheckMenuItem
EnableMenuItem
ModifyMenuA
GetParent
GetFocus
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
PeekMessageA
GetKeyState
IsWindowVisible
GetActiveWindow
DispatchMessageA
TranslateMessage
GetMessageA
SetCursor
SetWindowsHookExA
CallNextHookEx
GetClassLongA

gdi32

ExtSelectClipRgn
DeleteDC
GetStockObject
GetBkColor
GetTextColor
GetRgnBox
GetMapMode
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetTextColor
SetViewportExtEx
OffsetViewportOrgEx
GetClipBox
CreateBitmap
GetDeviceCaps
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
RestoreDC
SaveDC
CreateRectRgnIndirect
GetObjectA
SetBkColor
SetViewportOrgEx

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegEnumValueA
RegQueryValueA
RegEnumKeyA
RegOpenKeyA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA

shell32

ShellExecuteA
ShellExecuteExA

comctl32

ord17

shlwapi

PathFindFileNameA
PathStripToRootA
PathFindExtensionA
PathIsUNCA

oledlg

ord8

ole32

OleIsCurrentClipboard
CoTaskMemAlloc
CLSIDFromProgID
CoTaskMemFree
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
OleFlushClipboard
CoRegisterMessageFilter
CoRevokeClassObject
CLSIDFromString

oleaut32

SysFreeString
SysAllocStringByteLen
VariantClear
VariantChangeType
VariantInit
SysAllocStringLen
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
SysAllocString
SysStringLen

ws2_32

WSACreateEvent
WSAEventSelect
WSAEnumNetworkEvents
bind
listen
gethostbyaddr
getsockname
accept
socket
connect
getsockopt
ioctlsocket
recv
send
__WSAFDIsSet
closesocket
htons
ntohs
select
inet_addr
ntohl
gethostbyname
htonl
inet_ntoa
WSACleanup
WSAStartup

Sections

.text
Size: 460KB - Virtual size: 456KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 92KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 20KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fc0000bc8adbc1e89ee89437dd2dc8e3

Headers

File Characteristics

PDB Paths

Imports

rpcrt4

wintrust

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

ws2_32

Sections

.text Size: 460KB - Virtual size: 456KB

.rdata Size: 92KB - Virtual size: 90KB

.data Size: 20KB - Virtual size: 33KB

.rsrc Size: 24KB - Virtual size: 24KB

.text
Size: 460KB - Virtual size: 456KB

.rdata
Size: 92KB - Virtual size: 90KB

.data
Size: 20KB - Virtual size: 33KB

.rsrc
Size: 24KB - Virtual size: 24KB