6897e59a5c8739b14254aa33c8855267_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6897e59a5c8739b14254aa33c8855267_JaffaCakes118
Size

212KB
MD5

6897e59a5c8739b14254aa33c8855267
SHA1

ffa1bbbe7579281230e5d66aeea2b87e242440b9
SHA256

8cf6cd9b9c4d162d012f0d749be12710c22d56d8fcdcb7b3a65738cb026c6a2e
SHA512

7552d28fc02a22f72a613831b57761972829a21bf2530083a39166ea9228bbc0459a33e6d933640989041ee443a1273dcd1332a885b1382f4d774f552060a8b1
SSDEEP

3072:Pas42GpnhiB+qMeCKfXuDJVMrM2S2asxGPtLJ:t4jiB+qfCK2IQVwsJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6897e59a5c8739b14254aa33c8855267_JaffaCakes118

Files

6897e59a5c8739b14254aa33c8855267_JaffaCakes118
.dll windows:4 windows x86 arch:x86

6554cb920f4846d426fe39b3f7f489f1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\LocalSvnForDailyBuild\guanxi_usa\bin_usa\usa_release\inter.pdb

Imports

psapi

GetModuleInformation

imagehlp

CheckSumMappedFile

user32

GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
DestroyMenu
ClientToScreen
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExA
MessageBoxA
EnableWindow
IsWindowEnabled
GetLastActivePopup
GetWindowLongA
GetParent
SendMessageA
GetWindowThreadProcessId
GetSubMenu
GetMenuItemCount
PostQuitMessage
SetWindowTextA
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
IsWindow
GetWindowTextA
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
PostMessageA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
ModifyMenuA
EnableMenuItem
CheckMenuItem
LoadCursorA
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
UnregisterClassA
DispatchMessageA
GetKeyState
PeekMessageA
ValidateRect
GetMenuState
GetMenuItemID

kernel32

VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
Sleep
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetStdHandle
GetFileType
WriteConsoleW
ExitProcess
HeapSize
VirtualAlloc
HeapReAlloc
GetProcessHeap
HeapAlloc
QueryPerformanceCounter
GetACP
IsValidCodePage
LoadLibraryW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
CreateFileA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
OutputDebugStringA
GetModuleFileNameA
GetModuleHandleA
LoadLibraryA
GetLastError
CreateMutexA
GetCurrentProcessId
SetLastError
InterlockedExchange
MultiByteToWideChar
WideCharToMultiByte
GetVersion
CompareStringA
lstrlenA
SizeofResource
LockResource
LoadResource
FindResourceA
LocalAlloc
LocalFree
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalLock
GlobalReAlloc
GlobalUnlock
GlobalHandle
GlobalAlloc
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
GlobalFree
TlsFree
GetProcAddress
GetModuleFileNameW
InterlockedDecrement
FreeLibrary
FormatMessageA
CloseHandle
ResumeThread
GetCurrentThreadId
WaitForSingleObject
SuspendThread
InterlockedIncrement
GetVersionExA
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
lstrcmpA
GetThreadLocale
GlobalFlags
GetLocaleInfoA
GetCPInfo
GetOEMCP
WritePrivateProfileStringA
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
SetEndOfFile
GetFileSize
GetCurrentProcess
HeapFree
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
TerminateProcess
OpenProcess
Thread32Next
OpenThread
Thread32First
CreateToolhelp32Snapshot
IsBadReadPtr
Module32Next
Module32First
WriteProcessMemory
VirtualAllocEx
ReadProcessMemory
VirtualProtectEx
VirtualProtect
GetTickCount
GetLocalTime
RtlUnwind
RaiseException
GetCommandLineA

shell32

SHFileOperationA

oleaut32

VariantClear
VariantChangeType
VariantInit

gdi32

GetStockObject
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutA
RectVisible
PtVisible
SetMapMode
RestoreDC
SaveDC
ExtTextOutA
DeleteObject
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
GetDeviceCaps

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

Exports

Exports

InitToLoadDll
InstallHook
ResetHook

Sections

.text
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 4KB - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6554cb920f4846d426fe39b3f7f489f1

Headers

File Characteristics

PDB Paths

Imports

psapi

imagehlp

user32

kernel32

shell32

oleaut32

gdi32

winspool.drv

Exports

Exports

Sections

.text Size: 136KB - Virtual size: 135KB

.rdata Size: 32KB - Virtual size: 29KB

.data Size: 12KB - Virtual size: 23KB

Shared Size: 4KB - Virtual size: 268B

.rsrc Size: 4KB - Virtual size: 176B

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 136KB - Virtual size: 135KB

.rdata
Size: 32KB - Virtual size: 29KB

.data
Size: 12KB - Virtual size: 23KB

Shared
Size: 4KB - Virtual size: 268B

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 20KB - Virtual size: 19KB