5beff906cbb871b36ef14d575597d0d5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5beff906cbb871b36ef14d575597d0d5_JaffaCakes118
Size

208KB
MD5

5beff906cbb871b36ef14d575597d0d5
SHA1

e99905accb8f2f239c8420abf4d3a86091ce5508
SHA256

c95b5f30505c97dc5184af50cb76863229622762d4ce4ffc900f454a3501fe29
SHA512

1905739577b4a60c495690294796c794abafdaab66cc9b34fdcc7303e3c7f18c20dc63bda94be40e73455be9252bbcb82a4e440496a021d10bd27f366c3aa2f3
SSDEEP

3072:a5ZI/UxXYGXSxmF2gIeCLcCF7xd2koX6GZ1jrktGcl:4ZuGXSxmYgIrF7xM9Hc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5beff906cbb871b36ef14d575597d0d5_JaffaCakes118

Files

5beff906cbb871b36ef14d575597d0d5_JaffaCakes118
.dll windows:4 windows x86 arch:x86

47d62a2e746959dc76cf89e17b2174fe

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

R:\LocalSvnForDailyBuild\guanxi_sg\bin\release\kernel32.pdb

Imports

psapi

GetModuleInformation

imagehlp

CheckSumMappedFile

user32

GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
DestroyMenu
ClientToScreen
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExA
MessageBoxA
EnableWindow
IsWindowEnabled
GetLastActivePopup
GetWindowLongA
GetParent
SendMessageA
GetWindowThreadProcessId
GetSubMenu
GetMenuItemCount
PostQuitMessage
SetWindowTextA
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
IsWindow
GetWindowTextA
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
PostMessageA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
ModifyMenuA
EnableMenuItem
CheckMenuItem
LoadCursorA
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
UnregisterClassA
DispatchMessageA
GetKeyState
PeekMessageA
ValidateRect
GetMenuState
GetMenuItemID

kernel32

VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
GetStdHandle
GetFileType
WriteConsoleW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
ExitProcess
HeapSize
VirtualAlloc
HeapReAlloc
GetProcessHeap
HeapAlloc
HeapFree
QueryPerformanceCounter
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
LoadLibraryW
GetStringTypeA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetModuleHandleA
LoadLibraryA
Sleep
GetLastError
SetLastError
InterlockedExchange
MultiByteToWideChar
WideCharToMultiByte
GetVersion
CompareStringA
lstrlenA
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleFileNameA
GetCurrentProcessId
LocalAlloc
LocalFree
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalLock
GlobalReAlloc
GlobalUnlock
GlobalHandle
GlobalAlloc
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
GlobalFree
TlsFree
GetProcAddress
GetModuleFileNameW
InterlockedDecrement
FreeLibrary
FormatMessageA
CloseHandle
ResumeThread
GetCurrentThreadId
WaitForSingleObject
SuspendThread
InterlockedIncrement
GetVersionExA
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
lstrcmpA
GetThreadLocale
GlobalFlags
GetLocaleInfoA
GetCPInfo
GetOEMCP
WritePrivateProfileStringA
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
SetEndOfFile
GetCurrentProcess
GetCommandLineA
CreateFileA
TerminateProcess
OpenProcess
Thread32Next
OpenThread
Thread32First
CreateToolhelp32Snapshot
IsBadReadPtr
Module32Next
Module32First
WriteProcessMemory
VirtualAllocEx
ReadProcessMemory
VirtualProtectEx
VirtualProtect
GetTickCount
GetLocalTime
RtlUnwind
RaiseException
GetStringTypeW

shell32

SHFileOperationA

oleaut32

VariantClear
VariantChangeType
VariantInit

gdi32

GetStockObject
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutA
RectVisible
PtVisible
SetMapMode
RestoreDC
SaveDC
ExtTextOutA
DeleteObject
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
GetDeviceCaps

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

Exports

Exports

InitToLoadDll
InstallHook
ResetHook

Sections

.text
Size: 136KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 4KB - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

47d62a2e746959dc76cf89e17b2174fe

Headers

File Characteristics

PDB Paths

Imports

psapi

imagehlp

user32

kernel32

shell32

oleaut32

gdi32

winspool.drv

Exports

Exports

Sections

.text Size: 136KB - Virtual size: 133KB

.rdata Size: 32KB - Virtual size: 28KB

.data Size: 8KB - Virtual size: 22KB

Shared Size: 4KB - Virtual size: 268B

.rsrc Size: 4KB - Virtual size: 176B

.reloc Size: 20KB - Virtual size: 18KB

.text
Size: 136KB - Virtual size: 133KB

.rdata
Size: 32KB - Virtual size: 28KB

.data
Size: 8KB - Virtual size: 22KB

Shared
Size: 4KB - Virtual size: 268B

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 20KB - Virtual size: 18KB