48010448e375484148d2d8ffd77df49b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

48010448e375484148d2d8ffd77df49b_JaffaCakes118
Size

672KB
MD5

48010448e375484148d2d8ffd77df49b
SHA1

6060dc61bfdc489d70b6532c1cb55ba388a8564a
SHA256

7fb32100e53b70395e2f00b676329593c4ecdc7f7e8896b007096fe2894b3591
SHA512

016add4c4ef7a40e2a324adfd7e2c1f6ee1ee9e5ca03d8af184a5527c03ea7546475e3ed3a01deb301f6789f98d64c42ecc7ca35eabb288ce8c774456d684e14
SSDEEP

12288:JCm9cF1znWpgnKv2EyOvjkM/SPVyH9ImSyQktlhHZCcpn47nKIWcGwHEgRyqGL+h:JCmogjL5Cc2hPoDvBclPlwXRK0k+SeH4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48010448e375484148d2d8ffd77df49b_JaffaCakes118

Files

48010448e375484148d2d8ffd77df49b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fc0000bc8adbc1e89ee89437dd2dc8e3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\p4os\client\Projects\GameUpdate\Development\EvilGameUpdate\EvilUpdateService\Samples\gu\Vc80\Release\gu.pdb

Imports

rpcrt4

NdrServerCall
RpcMgmtStopServerListening
RpcServerUnregisterIf
RpcServerUseProtseqEpA
RpcServerRegisterIf
RpcServerListen

wintrust

WinVerifyTrust

kernel32

WritePrivateProfileStringA
GlobalFlags
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetCurrentProcess
FindClose
FindFirstFileA
GetVolumeInformationA
GetCPInfo
GetOEMCP
SetErrorMode
FileTimeToLocalFileTime
GetFileAttributesA
GetFileTime
GetTickCount
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
HeapAlloc
HeapFree
HeapReAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetProcessHeap
GetStartupInfoA
ExitThread
CreateThread
GetTimeFormatA
GetDateFormatA
ExitProcess
HeapSize
VirtualFree
HeapDestroy
HeapCreate
GetACP
IsValidCodePage
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
SetConsoleMode
ReadConsoleInputA
FileTimeToSystemTime
GetThreadLocale
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
FreeResource
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetVersionExA
GetCurrentProcessId
GlobalAddAtomA
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
LoadLibraryA
lstrcmpA
FreeLibrary
GetModuleHandleA
GetProcAddress
SetLastError
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
LocalFree
MulDiv
ExpandEnvironmentStringsA
GetStdHandle
WaitForMultipleObjects
GetLocalTime
GetFullPathNameA
DeleteFileA
GetModuleFileNameA
GetTempPathA
GetTempFileNameA
GetDiskFreeSpaceExA
Sleep
OutputDebugStringA
SetEvent
CloseHandle
CreateEventA
WaitForSingleObject
ResetEvent
lstrlenA
CompareStringW
CompareStringA
GetVersion
MultiByteToWideChar
InterlockedExchange
GetCurrentDirectoryA
CreateFileA
GetFileSize
ReadFile
GetLastError
FormatMessageA
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
GetFileInformationByHandle
PeekNamedPipe
GetCommandLineA
CreateFileW

user32

RegisterClipboardFormatA
PostThreadMessageA
CharNextA
DestroyMenu
ReleaseCapture
SetCapture
LoadCursorA
GetSysColorBrush
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetDesktopWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
ReleaseDC
GetDC
SetWindowContextHelpId
MapDialogRect
RegisterWindowMessageA
WinHelpA
IsChild
GetCapture
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
SetActiveWindow
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
SetForegroundWindow
UpdateWindow
GetMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
EqualRect
CopyRect
PtInRect
DefWindowProcA
CallWindowProcA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowTextLengthA
GetWindowTextA
SetWindowPos
SetFocus
ShowWindow
MoveWindow
SetWindowLongA
GetDlgCtrlID
IsWindow
SetWindowTextA
CharUpperA
IsDialogMessageA
SendDlgItemMessageA
GetDlgItem
GetWindow
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
UnregisterClassA
MessageBeep
GetNextDlgGroupItem
IsWindowEnabled
MessageBoxA
InvalidateRgn
InvalidateRect
SetRect
IsRectEmpty
MapWindowPoints
CopyAcceleratorTableA
DrawIcon
SendMessageA
PostMessageA
IsIconic
GetWindowRect
GetClientRect
EnableWindow
LoadIconA
GetSystemMetrics
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
PostQuitMessage
CheckMenuItem
EnableMenuItem
ModifyMenuA
GetParent
GetFocus
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
PeekMessageA
GetKeyState
IsWindowVisible
GetActiveWindow
DispatchMessageA
TranslateMessage
GetMessageA
SetCursor
SetWindowsHookExA
CallNextHookEx
GetClassLongA

gdi32

ExtSelectClipRgn
DeleteDC
GetStockObject
GetBkColor
GetTextColor
GetRgnBox
GetMapMode
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetTextColor
SetViewportExtEx
OffsetViewportOrgEx
GetClipBox
CreateBitmap
GetDeviceCaps
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
RestoreDC
SaveDC
CreateRectRgnIndirect
GetObjectA
SetBkColor
SetViewportOrgEx

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegEnumValueA
RegQueryValueA
RegEnumKeyA
RegOpenKeyA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA

shell32

ShellExecuteA
ShellExecuteExA

comctl32

ord17

shlwapi

PathFindFileNameA
PathStripToRootA
PathFindExtensionA
PathIsUNCA

oledlg

ord8

ole32

OleIsCurrentClipboard
CoTaskMemAlloc
CLSIDFromProgID
CoTaskMemFree
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
OleFlushClipboard
CoRegisterMessageFilter
CoRevokeClassObject
CLSIDFromString

oleaut32

SysFreeString
SysAllocStringByteLen
VariantClear
VariantChangeType
VariantInit
SysAllocStringLen
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
SysAllocString
SysStringLen

ws2_32

WSACreateEvent
WSAEventSelect
WSAEnumNetworkEvents
bind
listen
gethostbyaddr
getsockname
accept
socket
connect
getsockopt
ioctlsocket
recv
send
__WSAFDIsSet
closesocket
htons
ntohs
select
inet_addr
ntohl
gethostbyname
htonl
inet_ntoa
WSACleanup
WSAStartup

Sections

.text
Size: 460KB - Virtual size: 456KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 92KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 20KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fc0000bc8adbc1e89ee89437dd2dc8e3

Headers

File Characteristics

PDB Paths

Imports

rpcrt4

wintrust

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

ws2_32

Sections

.text Size: 460KB - Virtual size: 456KB

.rdata Size: 92KB - Virtual size: 90KB

.data Size: 20KB - Virtual size: 33KB

.rsrc Size: 92KB - Virtual size: 92KB

.text
Size: 460KB - Virtual size: 456KB

.rdata
Size: 92KB - Virtual size: 90KB

.data
Size: 20KB - Virtual size: 33KB

.rsrc
Size: 92KB - Virtual size: 92KB