3b0b20b31f9eda830d3de73d0ad5805c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
3b0b20b31f9eda830d3de73d0ad5805c_JaffaCakes118
Size 3.2MB
Sample240711-2wva5ayajr
SHA256 a40d46dc29b3b7d4f07cbdb47cf9dc8da68584963eaf0e1d0212b8db3dde766c
MD5 3b0b20b31f9eda830d3de73d0ad5805c
SHA1 9e5dc0299a01eefbf637061a3117d02026e3c5f4
SHA512 817029c8dc7d514d2c0eba088fc4499503dd29d1b165ff81bc3d16f249b14af33f7a53b283a3a9a3af206451c3a0c30d513331e6b75c2147aa1c1bbac9601dd4
SSDEEP 49152:20YzUJHNwATIXJzlzEqZw4YbWUxZVpU4yPy7sXiCZTAmeYAzziU0BY:JMUJHrIXJzJTsWUxtUw7sPzeYAzX0BY
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b0b20b31f9eda830d3de73d0ad5805c_JaffaCakes118

File Explorer

3b0b20b31f9eda830d3de73d0ad5805c_JaffaCakes118

.exe 3.2MB

3b0b20b31f9eda830d3de73d0ad5805c_JaffaCakes118

IMPHASH c311bca871b49a0fef4eb2b6e77017a2
SHA256 a40d46dc29b3b7d4f07cbdb47cf9dc8da68584963eaf0e1d0212b8db3dde766c
MD5 3b0b20b31f9eda830d3de73d0ad5805c
SHA1 9e5dc0299a01eefbf637061a3117d02026e3c5f4
SHA512 817029c8dc7d514d2c0eba088fc4499503dd29d1b165ff81bc3d16f249b14af33f7a53b283a3a9a3af206451c3a0c30d513331e6b75c2147aa1c1bbac9601dd4
SSDEEP 49152:20YzUJHNwATIXJzlzEqZw4YbWUxZVpU4yPy7sXiCZTAmeYAzziU0BY:JMUJHrIXJzJTsWUxtUw7sPzeYAzX0BY
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1928947

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Users\Matthew\Desktop\New Source\Stable\Gunz\Runtime\Gunz.pdb

fmod

_FSOUND_3D_SetDopplerFactor@4 _FSOUND_SetMute@8 _FSOUND_3D_SetMinMaxDistance@12 _FSOUND_Update@0 _FSOUND_3D_Listener_SetAttributes@32 _FSOUND_StopSound@4 _FSOUND_GetNumDrivers@0 _FSOUND_GetDriverName@4 _FSOUND_Stream_Stop@4 _FSOUND_Stream_Close@4 _FSOUND_Stream_PlayEx@16 _FSOUND_Stream_SetMode@8 _FSOUND_Stream_GetMode@4 _FSOUND_3D_SetDistanceFactor@4 _FSOUND_GetMaxChannels@0 _FSOUND_Stream_SetBufferSize@4 _FSOUND_Init@12 _FSOUND_SetMaxHardwareChannels@4 _FSOUND_SetMinHardwareChannels@4 _FSOUND_GetDriverCaps@8 _FSOUND_SetDriver@4 _FSOUND_SetOutput@4 _FSOUND_SetHWND@4 _FSOUND_GetVersion@0 _FSOUND_Sample_Load@20 _FSOUND_GetVolume@4 _FSOUND_Close@0 _FSOUND_Stream_SetEndCallback@12 _FSOUND_Stream_Open@16 _FSOUND_3D_SetRolloffFactor@4 _FSOUND_Sample_GetMode@4 _FSOUND_PlaySoundEx@16 _FSOUND_GetError@0 _FSOUND_3D_SetAttributes@12 _FSOUND_SetPriority@8 _FSOUND_SetVolume@8 _FSOUND_SetPaused@8 _FSOUND_Sample_Free@4 _FSOUND_Sample_SetMinMaxDistance@12

kernel32

GetLocaleInfoA GetThreadLocale InterlockedExchange WideCharToMultiByte GetVersion CompareStringA CompareStringW GetACP GetCurrentProcess SetPriorityClass lstrlenA GlobalMemoryStatus InitializeCriticalSection GetProcessHeap IsProcessorFeaturePresent SetEnvironmentVariableA GetLocaleInfoW SetStdHandle IsValidCodePage IsValidLocale EnumSystemLocalesA GetUserDefaultLCID IsBadCodePtr IsBadReadPtr GetStringTypeW GetStringTypeA GetDriveTypeA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter IsBadWritePtr VirtualFree HeapCreate HeapDestroy GetTimeZoneInformation DeleteCriticalSection Sleep lstrcmpiA QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId SetCurrentDirectoryA CreateMutexA WaitForSingleObject CloseHandle GetModuleFileNameA GetWindowsDirectoryA FindFirstFileA CreateDirectoryA FindClose GetCurrentDirectoryA GetVolumeInformationA GetTickCount GetLastError IsDebuggerPresent OutputDebugStringA GetModuleHandleA EnterCriticalSection LeaveCriticalSection GetVersionExA LoadLibraryA GetProcAddress FreeLibrary MultiByteToWideChar GetLocalTime GetFileType GetStdHandle SetHandleCount LCMapStringW LCMapStringA HeapSize HeapReAlloc GetCommandLineA GetStartupInfoA VirtualQuery VirtualAlloc VirtualProtect HeapAlloc HeapFree GetSystemTimeAsFileTime RtlUnwind ExitProcess MulDiv UnmapViewOfFile MapViewOfFile CreateFileMappingA GetFileSize CreateFileA CreateEventA IsDBCSLeadByte SetEvent ResetEvent ExitThread WaitForMultipleObjects SizeofResource LockResource LoadResource FindResourceA SetUnhandledExceptionFilter TerminateProcess CreateThread GetSystemInfo FileTimeToSystemTime SystemTimeToFileTime GlobalUnlock GlobalLock ReadFile SetFileTime GetFileAttributesA lstrcatA GlobalMemoryStatusEx InterlockedDecrement FindNextFileA GetCurrentProcessId WriteFile OpenProcess GetCurrentThread GlobalAlloc GlobalSize GlobalAddAtomA GlobalDeleteAtom FindNextChangeNotification OpenEventA FindCloseChangeNotification FindFirstChangeNotificationA LocalFree lstrcpynA FormatMessageA GlobalFree SetLastError GlobalReAlloc lstrcmpA lstrcmpW lstrcpyA RaiseException InterlockedIncrement LocalAlloc GlobalHandle TlsGetValue TlsAlloc TlsSetValue LocalReAlloc TlsFree GlobalFlags GlobalFindAtomA GlobalGetAtomNameA GetCPInfo GetOEMCP GetFullPathNameA SetFilePointer FlushFileBuffers SetEndOfFile FileTimeToLocalFileTime

user32

GrayStringA SetWindowTextA GetFocus PtInRect GetDlgCtrlID ValidateRect CallNextHookEx SetWindowsHookExA GetDlgItem CopyRect SystemParametersInfoA RegisterWindowMessageA AdjustWindowRectEx LoadBitmapA GetMenuCheckMarkDimensions EnableMenuItem ModifyMenuA SetMenuItemBitmaps GetWindowPlacement IsIconic CallWindowProcA GetClassInfoA EnableWindow SetForegroundWindow MapWindowPoints GetMessagePos GetMessageTime DestroyWindow GetForegroundWindow RemovePropA GetPropA SetPropA GetClassInfoExA GetClassLongA GetCapture WinHelpA DrawTextExA DestroyMenu GetMenuState GetMenuItemID GetMenuItemCount DrawTextA TabbedTextOutA GetParent GetLastActivePopup IsWindowEnabled UnhookWindowsHookEx LoadCursorA GetSystemMetrics GetSysColor GetSysColorBrush GetSubMenu MapVirtualKeyA GetKeyNameTextA ScreenToClient SendMessageA GetTopWindow GetClassNameA FindWindowExA GetWindow ShowWindow DefWindowProcA ShowCursor SetFocus MessageBoxA OpenClipboard GetClipboardData CloseClipboard GetAsyncKeyState wsprintfA GetWindowRect PostMessageA EnumWindows GetWindowTextA GetKeyState ClientToScreen SetCursorPos GetKeyboardLayout UnregisterHotKey EmptyClipboard SetClipboardData GetCursorPos GetDC ReleaseDC DispatchMessageA PeekMessageA TranslateMessage LoadIconA RegisterClassA CreateWindowExA PostQuitMessage SetWindowPos GetActiveWindow UpdateWindow UnregisterClassA GetWindowLongA SetWindowLongA GetClientRect MoveWindow GetMenu CheckMenuItem

gdi32

GetStockObject GetTextExtentPoint32A SelectObject GetObjectA DeleteDC DeleteObject SetMapMode CreateDIBSection CreateCompatibleDC CreateFontA GetDeviceCaps GetTextMetricsA SaveDC RestoreDC SetBkColor SetWindowExtEx ScaleWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape ExtTextOutA TextOutA RectVisible PtVisible CreateBitmap RemoveFontResourceA AddFontResourceA GetClipBox SetTextColor

shell32

SHChangeNotify ShellExecuteA SHGetSpecialFolderPathA

ole32

CoUninitialize OleRun CoInitialize CoCreateInstance

comctl32

ord17

shlwapi

PathSearchAndQualifyA StrStrIA PathRemoveFileSpecA PathStripPathA PathFileExistsA PathIsDirectoryA

imm32

ImmGetCompositionStringA ImmGetDefaultIMEWnd ImmSetConversionStatus ImmAssociateContext ImmNotifyIME ImmGetCandidateListA ImmGetContext ImmGetOpenStatus ImmReleaseContext ImmGetConversionStatus

winmm

timeBeginPeriod timeGetDevCaps timeEndPeriod timeGetTime

ws2_32

ntohs inet_addr inet_ntoa gethostname closesocket WSAStartup WSACleanup setsockopt gethostbyname ioctlsocket socket bind htons htonl recv WSAGetLastError connect WSACloseEvent send WSAEnumNetworkEvents WSAWaitForMultipleEvents WSAEventSelect WSACreateEvent shutdown sendto recvfrom

sensapi

IsNetworkAlive

gdiplus

GdipCloneBrush GdipGetFamily GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawString GdipFillPath GdipGraphicsClear GdipDrawPath GdiplusStartup GdipSetSmoothingMode GdipCreateFromHDC GdipAddPathString GdipCreateSolidFill GdipDeleteFont GdipDeleteFontFamily GdipDeleteGraphics GdipDeletePath GdipCreatePath GdipStringFormatGetGenericTypographic GdipDeletePen GdipCreatePen1 GdipDeleteBrush GdipAlloc GdipFree GdipGetImageEncoders GdiplusShutdown GdipGetImageEncodersSize GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipSaveImageToFile GdipDisposeImage

dbghelp

MiniDumpWriteDump

wininet

InternetCloseHandle InternetSetStatusCallback InternetReadFileExA HttpQueryInfoA HttpSendRequestA HttpOpenRequestA InternetConnectA InternetOpenA InternetCrackUrlA

psapi

EnumProcesses EnumProcessModules GetModuleBaseNameA GetModuleFileNameExA

oleacc

LresultFromObject CreateStdAccessibleObject

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

advapi32

RegCloseKey RegOpenKeyExA RegSetValueExA RegCreateKeyA RegOpenKeyA RegQueryValueExA

oleaut32

SysFreeString SysAllocString SysAllocStringByteLen SysStringByteLen VariantInit VariantClear VariantChangeType GetErrorInfo

generic

count=33, id=100, version=3077,

count=9, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=5, id=105, version=2067,

count=4, id=28, version=9178,

count=9, id=95, version=2067,

count=6, id=18, version=8444,

count=119, id=29, version=9178,

count=55, id=15, productName=VS2003 (.NET) build 3077, version=3077,

count=4, id=11, version=8966,

count=2, id=25, version=9111,

count=8, id=95, version=2179,

count=6, id=25, version=9210,

count=2, id=93, version=2067,

count=34, id=93, version=2179,

count=3, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=814, id=1, productName=Unmarked objects,

count=228, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=609, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,

count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,