2f52623741b6fb4b30246fb90e660f0b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2f52623741b6fb4b30246fb90e660f0b_JaffaCakes118
Size

382KB
MD5

2f52623741b6fb4b30246fb90e660f0b
SHA1

83e0bfe47e3f33adc0663c52b76933cfc36db6e0
SHA256

44981a774464ed9559fa74ac60f69723efea488e5273040682141908b9d57572
SHA512

93acb2363598a05a5b8825d9dafe856a049f2558d7bb04d252728bb3d78c1cf6f1449174f27353c194cedfcb38964d06ca1a4b489a33a63c8d6589b550f9b993
SSDEEP

6144:83/OqeRrQBHq5VpVnUzSbvSuVZiPIpWO83fxIfgCb41/zQkwqIXufCMyPv:w/wo9SbvBVZigp9BTb5XzH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f52623741b6fb4b30246fb90e660f0b_JaffaCakes118

Files

2f52623741b6fb4b30246fb90e660f0b_JaffaCakes118
.dll windows:5 windows x86 arch:x86

9ebb3d5c0c1a2e1be8cafe77b5f7c084

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\WorkSpace\Kies 2.0\Source\InstallerHelper\Release\MSSetupAddinDll.pdb

Imports

kernel32

InterlockedIncrement
CompareStringW
WritePrivateProfileStringW
GetModuleHandleA
GlobalFlags
GetVersionExA
LoadLibraryA
GlobalFindAtomW
HeapFree
HeapAlloc
DeleteFileA
GetCommandLineA
RtlUnwind
RaiseException
HeapReAlloc
SetStdHandle
GetFileType
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
GetStdHandle
GetModuleFileNameA
SetErrorMode
GetOEMCP
IsValidCodePage
LCMapStringW
SetHandleCount
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetCurrentDirectoryA
GetDriveTypeA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GetFileTime
GetFileSizeEx
GetFileAttributesW
GetCurrentProcessId
GlobalAddAtomW
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateFileW
GetFullPathNameW
GetVolumeInformationW
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
FindFirstFileW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileW
FindClose
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
LoadLibraryW
CompareStringA
InterlockedExchange
lstrcmpW
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageW
LocalFree
FreeLibrary
InterlockedDecrement
GetModuleFileNameW
SetLastError
GetModuleHandleW
GetProcAddress
GetACP
GetLocaleInfoW
CreateThread
WaitForSingleObject
WideCharToMultiByte
lstrlenA
Sleep
ExitProcess
CreateRemoteThread
Process32NextW
TerminateProcess
GetExitCodeProcess
OpenProcess
Process32FirstW
CreateToolhelp32Snapshot
RemoveDirectoryW
GetSystemDirectoryW
OutputDebugStringW
LockResource
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
GetLastError
lstrlenW
GetCPInfo
CloseHandle

user32

DestroyMenu
ShowWindow
RegisterWindowMessageW
LoadIconW
WinHelpW
GetCapture
GetClassLongW
SetPropW
RemovePropW
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
DefWindowProcW
CallWindowProcW
CopyRect
GetMenu
SetWindowLongW
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameW
PtInRect
SetWindowTextW
ClientToScreen
GetClientRect
InvalidateRect
UnhookWindowsHookEx
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetWindowTextW
LoadCursorW
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
PostQuitMessage
PostMessageW
GetSystemMetrics
CharUpperW
CheckMenuItem
EnableMenuItem
ModifyMenuW
SendMessageW
GetParent
GetFocus
LoadBitmapW
GetMenuCheckMarkDimensions
UnregisterClassW
GetWindowThreadProcessId
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxW
SetCursor
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageW
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetPropW

gdi32

GetStockObject
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
GetDeviceCaps
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
DeleteObject
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
CreateBitmap
OffsetViewportOrgEx

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

RegSetValueExW
RegCreateKeyExW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

shell32

SHFileOperationW
SHGetSpecialFolderPathW

shlwapi

PathIsUNCW
UrlUnescapeW
PathFindFileNameW
PathFindExtensionW
PathStripToRootW

oleaut32

VariantClear
VariantChangeType
VariantInit

wininet

InternetOpenW
InternetCloseHandle
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
InternetReadFile
InternetOpenUrlW
InternetSetOptionW
InternetGetConnectedState
InternetCrackUrlW
InternetCanonicalizeUrlW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

psapi

EnumProcessModules
GetModuleFileNameExW
GetModuleBaseNameW
EnumProcesses

Exports

Exports

DeleteFolder
DeleteShortcutFolder
DestroyProcessUsingModuleFullPath
DestroyProcessUsingModuleName
GetAppVersion
GetCompareAppVersionName
HttpGetRequest
IsExistProcess
IsInternetConnected
ProcessKill
RefreshScreen

Sections

.text
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9ebb3d5c0c1a2e1be8cafe77b5f7c084

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

oleaut32

wininet

version

psapi

Exports

Exports

Sections

.text Size: 172KB - Virtual size: 171KB

.rdata Size: 40KB - Virtual size: 39KB

.data Size: 9KB - Virtual size: 27KB

.rsrc Size: 13KB - Virtual size: 13KB

.reloc Size: 30KB - Virtual size: 29KB

.text Size: 116KB - Virtual size: 116KB

.text
Size: 172KB - Virtual size: 171KB

.rdata
Size: 40KB - Virtual size: 39KB

.data
Size: 9KB - Virtual size: 27KB

.rsrc
Size: 13KB - Virtual size: 13KB

.reloc
Size: 30KB - Virtual size: 29KB

.text
Size: 116KB - Virtual size: 116KB