6485353196811ae6e16aa75f64884abd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6485353196811ae6e16aa75f64884abd_JaffaCakes118
Size

133KB
MD5

6485353196811ae6e16aa75f64884abd
SHA1

41bb1619d7e1c69be4a9699116d9cf907f99889f
SHA256

1348fbc041a354d4d17693e8d79909e4a99d11c790efda0f5e57e8655d83ebc9
SHA512

40f28dbd29dec73acee7743f5ad102dfb5914efc81d2a254bc874ee0ffc617ef3507e7feb8564b4c38ae9bd12552ebf7ec08cd6860b63c2cc36c26acba95506a
SSDEEP

1536:wNGB4VS3ZtGdbl07Gg9zywmrr213YrZh2UwcvFh1O3OjOEQNjYAMoEYwlUnYSn3g:U84QJQEGOmfZ/g4Wu0hD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6485353196811ae6e16aa75f64884abd_JaffaCakes118

Files

6485353196811ae6e16aa75f64884abd_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a03db41c59c1520e07e0cfdf8685573b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Documents and Settings\周令俊\桌面\Hack\YaBot-LEAKiSO-20072\bin32\bot.pdb

Imports

kernel32

GetDiskFreeSpaceExA
GlobalMemoryStatus
CreateRemoteThread
GetProcAddress
OpenProcess
WriteProcessMemory
VirtualAllocEx
GetCurrentProcessId
Process32Next
Process32First
CreateToolhelp32Snapshot
lstrcmpiA
CreateThread
GetCurrentProcess
QueryPerformanceFrequency
QueryPerformanceCounter
LoadLibraryA
GetModuleFileNameA
TerminateProcess
CreateProcessA
FreeLibrary
GetVersionExA
CopyFileA
SetFileAttributesA
GetWindowsDirectoryA
GetEnvironmentVariableA
GetShortPathNameA
SetProcessWorkingSetSize
ReadFile
SetFilePointer
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ReadProcessMemory
GlobalUnlock
GlobalLock
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrlenW
LocalFree
GetSystemDirectoryA
GetComputerNameA
GetLocaleInfoA
GetTickCount
GetTempPathA
GetFileSize
GetModuleHandleA
FindResourceA
SizeofResource
LoadResource
LockResource
WriteFile
CreateFileA
DeleteFileA
GetDateFormatA
GetTimeFormatA
OutputDebugStringA
GetStdHandle
SetConsoleTextAttribute
TerminateThread
CloseHandle
Sleep
CreateMutexA
ExitProcess
GetLastError
LoadLibraryExA

user32

CloseClipboard
SetKeyboardState
DispatchMessageA
GetClipboardData
SetWindowsHookExA
UnhookWindowsHookEx
GetActiveWindow
GetWindowTextA
GetKeyNameTextA
GetKeyboardState
GetKeyboardLayout
OpenClipboard
GetMessageA
CallNextHookEx
ToAsciiEx

advapi32

OpenProcessToken
RegCloseKey
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenEventLogA
ClearEventLogA
CloseEventLog
GetUserNameA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
StartServiceA
OpenServiceA
CloseServiceHandle
CreateServiceA
OpenSCManagerA
DeleteService
ControlService
RegEnumValueA
RegCreateKeyExA

shell32

ShellExecuteA

mpr

WNetCancelConnection2A
WNetAddConnection2A

msvcrt

sscanf
atoi
system
atol
islower
_except_handler3
malloc
__CxxFrameHandler
??2@YAPAXI@Z
??3@YAXPAX@Z
strtok
toupper
_CxxThrowException
strstr
??1type_info@@UAE@XZ
_snprintf
fclose
fprintf
fopen
printf
strncat
_vsnprintf
rand
srand
strncpy

netapi32

NetShareDel

wininet

InternetOpenUrlA
InternetGetConnectedStateEx
InternetOpenA
InternetCloseHandle

ws2_32

getsockname
ntohs
WSAIoctl
bind
WSASocketA
WSACloseEvent
shutdown
accept
listen
socket
htonl
htons
connect
closesocket
recv
inet_addr
gethostbyaddr
gethostname
gethostbyname
inet_ntoa
WSAStartup
WSACleanup
sendto
send

ntdll

ZwSystemDebugControl
NtQuerySystemInformation

oleaut32

VariantInit
VariantChangeType
SysFreeString
CreateErrorInfo
SetErrorInfo
VariantClear
GetErrorInfo

Sections

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a03db41c59c1520e07e0cfdf8685573b

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

mpr

msvcrt

netapi32

wininet

ws2_32

ntdll

oleaut32

Sections

.bss Size: - Virtual size: 3KB

.data Size: 121KB - Virtual size: 120KB

.rsrc Size: 11KB - Virtual size: 11KB

.bss
Size: - Virtual size: 3KB

.data
Size: 121KB - Virtual size: 120KB

.rsrc
Size: 11KB - Virtual size: 11KB