4dddf78c0256864f807cc8f83669f344_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4dddf78c0256864f807cc8f83669f344_JaffaCakes118
Size

408KB
MD5

4dddf78c0256864f807cc8f83669f344
SHA1

d1b0bdf59bbdfcf50da45ba7c58e28007a85576e
SHA256

3d527d7c21ddefb578672a87e21eb96b3b8b3ee3c7026ccb087d799cd95c504a
SHA512

8e9edb3126a869bcc8c546390927724cdd48d6c2e5e46867c46eb67c61dd3fcc403f8e296ad467f2baf045fa0033f2e420621b9d87c9ddb2c4ae42ebe32bbc4f
SSDEEP

6144:DQ/eCCUdIbVsEWebTJ/3sP3kQ5YcMj69nuw8kRinLLikqOPKPyECL:McUdIe2b1sPvLMj6lkkRinPiKPYyEk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4dddf78c0256864f807cc8f83669f344_JaffaCakes118

Files

4dddf78c0256864f807cc8f83669f344_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e5b4de31dc7c7e188d0aa494138dfcd3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kartresu

?InitKartRes@@YG_NPBG@Z
?GetString@@YGPBGPBGH@Z

gdiplus

GdipDisposeImageAttributes
GdiplusShutdown
GdiplusStartup
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromHBITMAP
GdipFree
GdipSetImageAttributesColorMatrix
GdipCreateFromHDC
GdipDrawImageRectRectI
GdipAlloc
GdipCloneImage
GdipCreateImageAttributes
GdipDeleteGraphics

dinput8

DirectInput8Create

mfc71u

ord4184
ord5178
ord4207
ord4730
ord4884
ord2011
ord1662
ord1661
ord5908
ord1611
ord1608
ord3940
ord1392
ord4238
ord5148
ord1899
ord5067
ord6271
ord4179
ord5207
ord3397
ord4714
ord4276
ord1591
ord5956
ord920
ord925
ord929
ord927
ord931
ord2404
ord2388
ord2407
ord2402
ord2379
ord2381
ord2399
ord2169
ord2163
ord1513
ord6273
ord3796
ord6275
ord3339
ord4961
ord1353
ord5171
ord1955
ord5196
ord2531
ord2725
ord2829
ord4301
ord2708
ord2856
ord2534
ord2640
ord2527
ord3712
ord3713
ord3703
ord2638
ord3943
ord4480
ord4256
ord516
ord718
ord5965
ord2651
ord4574
ord764
ord762
ord1866
ord1784
ord3678
ord1545
ord5911
ord1393
ord5210
ord4716
ord4255
ord3189
ord620
ord1079
ord2366
ord4838
ord2985
ord572
ord4882
ord1785
ord4535
ord3677
ord4032
ord4008
ord6272
ord3795
ord6274
ord2054
ord5579
ord3800
ord6215
ord5378
ord3826
ord1911
ord2925
ord5220
ord5222
ord2239
ord3942
ord4562
ord5226
ord5562
ord2832
ord4475
ord3327
ord757
ord605
ord748
ord5209
ord3635
ord6232
ord4729
ord4119
ord2089
ord1641
ord1585
ord4237
ord2977
ord3318
ord4206
ord5199
ord3176
ord354
ord5609
ord6086
ord4743
ord709
ord501
ord4347
ord2086
ord4234
ord3311
ord741
ord736
ord1637
ord1579
ord3306
ord5829
ord265
ord266
ord2155
ord1864
ord1781
ord1542
ord5231
ord5229
ord2384
ord2394
ord2392
ord2390
ord2386
ord2409
ord2397
ord1647
ord1646
ord1590
ord5803
ord870
ord6063
ord577
ord1472
ord3756
ord293
ord1118
ord776
ord1883
ord290
ord2926
ord777
ord2656
ord4320
ord2009
ord1007
ord5096
ord566
ord2657
ord2311
ord1058
ord3875
ord1582
ord4861
ord4611
ord4791
ord5064
ord5066
ord5065
ord3546
ord3661
ord1894
ord1198

msvcr71

__CxxFrameHandler
_CxxThrowException
wcscpy
wcscmp
_wtoi
_controlfp
?terminate@@YAXXZ
__security_error_handler
_onexit
__dllonexit
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
wcslen
__wgetmainargs
_amsg_exit
_wcmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
free
_except_handler3
memset
strncpy
strchr
strncmp
isalnum
isalpha
tolower
isspace
fseek
ftell
fgets
fputs
sprintf
fprintf
fopen
fclose
_purecall
atoi
atof
wcsncpy
_snprintf
memmove
??0exception@@QAE@XZ
??1exception@@UAE@XZ
swprintf
??0exception@@QAE@ABV0@@Z

kernel32

GetVersionExA
MultiByteToWideChar
GetSystemTimeAsFileTime
WideCharToMultiByte
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ExitProcess
GetStartupInfoW
GetModuleHandleA
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcessId
GetModuleHandleW

user32

EnableWindow
GetParent
GetWindowLongW
GetKeyNameTextW
SetWindowLongW
KillTimer
GetWindow
LoadImageW
IsWindow
RedrawWindow
GetSystemMetrics
LoadIconW
GetClientRect
GetWindowRect
IsIconic
SendMessageW
DrawIcon
SetTimer

gdi32

DeleteObject

ole32

CoUninitialize
CoInitialize

msvcp71

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

Sections

.text
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1004B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 320KB - Virtual size: 319KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.uuu9
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e5b4de31dc7c7e188d0aa494138dfcd3

Headers

File Characteristics

Imports

kartresu

gdiplus

dinput8

mfc71u

msvcr71

kernel32

user32

gdi32

ole32

msvcp71

Sections

.text Size: 48KB - Virtual size: 44KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 4KB - Virtual size: 1004B

.rsrc Size: 320KB - Virtual size: 319KB

.uuu9 Size: 8KB - Virtual size: 6KB

.text
Size: 48KB - Virtual size: 44KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 4KB - Virtual size: 1004B

.rsrc
Size: 320KB - Virtual size: 319KB

.uuu9
Size: 8KB - Virtual size: 6KB