6a93b98c0524c8606464083c812366d1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6a93b98c0524c8606464083c812366d1_JaffaCakes118
Size

280KB
MD5

6a93b98c0524c8606464083c812366d1
SHA1

2c39386872a20c25d758fde18548e32b1bc74a7b
SHA256

5f4e68968934a98e58dec57b26abdb60f731e909b8607a05158e0fd1f704d7de
SHA512

b41a9a4df01b57869e149391ebd2fb6d64100c3c95d94bf40f23d65344858fa628af5bfc4fbe7a716e38b5b6ae7f2e701acfd16938e2b78e26bbf7e0dc5418d3
SSDEEP

6144:t/xpq8eZkZni0331vKj3OJ9g+4RdZrynNMfSOi84:t/x08ckZni0331yj3OzsdZrD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6a93b98c0524c8606464083c812366d1_JaffaCakes118

Files

6a93b98c0524c8606464083c812366d1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f7118a03c65b3b869d9b73197e8a591b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\iCafe8\网维6.0\SourceCode\BarClient\HardwareInfo\Release\HardwareInfo.pdb

Imports

iocptcp

TcpInit
TcpCreate
TcpGetLinkAddr
TcpConnect
TcpSend

kernel32

GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GlobalFlags
GetCPInfo
GetOEMCP
GetCurrentDirectoryA
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
SetEndOfFile
GetFullPathNameA
CreateFileA
ExitProcess
RtlUnwind
HeapFree
HeapAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetSystemTimeAsFileTime
HeapReAlloc
HeapSize
QueryPerformanceCounter
GetCurrentProcessId
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
GlobalDeleteAtom
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
GetDriveTypeA
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
SetEnvironmentVariableA
InterlockedExchange
GetACP
CreateDirectoryA
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
InitializeCriticalSection
DeleteCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceA
EnterCriticalSection
LeaveCriticalSection
GetComputerNameA
WideCharToMultiByte
TerminateProcess
GetCurrentProcess
InterlockedDecrement
MultiByteToWideChar
GetLastError
GetVersion
lstrcmpiA
lstrlenA
CompareStringA
CompareStringW
FreeEnvironmentStringsW
Sleep
SetConsoleCtrlHandler
GetModuleHandleA
GetCommandLineA
GetModuleFileNameA
DeleteFileA
GetTimeZoneInformation
LoadLibraryA
FreeLibrary
lstrcmpW
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
GlobalReAlloc
LocalAlloc
InterlockedIncrement
FileTimeToLocalFileTime
FileTimeToSystemTime
SetErrorMode
GetProcAddress
lstrcpyA
lstrcatA
lstrcmpA
SetLastError
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
lstrcpynA
LocalFree
CreateThread
TerminateThread
WaitForSingleObject
GetTickCount
GetLocalTime
GetCurrentThreadId
OutputDebugStringA
SetEvent
OpenFileMappingA
OpenEventA
CreateFileMappingA
CreateEventA
MapViewOfFile
UnmapViewOfFile
CloseHandle
FindFirstFileA
FindNextFileA
FindClose

user32

CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
SetWindowTextA
ValidateRect
RegisterWindowMessageA
WinHelpA
GetCapture
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
EnableMenuItem
GetMessagePos
LoadIconA
MapWindowPoints
GetKeyState
SetForegroundWindow
GetClientRect
GetMenu
PostMessageA
AdjustWindowRectEx
GetClassInfoA
UnregisterClassA
ModifyMenuA
SetMenuItemBitmaps
RegisterClassA
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
CopyRect
DestroyMenu
PostQuitMessage
PtInRect
GetWindow
GetMessageTime
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
GetSysColorBrush
GetSysColor
ReleaseDC
GetDC
GetSystemMetrics
LoadCursorA
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetWindowTextA
SendMessageA
MessageBoxA
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
UnhookWindowsHookEx

gdi32

SetMapMode
GetClipBox
DeleteObject
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetTextColor
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
CreateBitmap
GetStockObject
SetBkColor
RestoreDC
SaveDC
SetViewportExtEx
GetDeviceCaps

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegEnumKeyExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey

comctl32

ord17

shlwapi

PathFindExtensionA
PathFindFileNameA

ole32

CoInitializeEx
CoCreateInstance
CoInitializeSecurity
CoSetProxyBlanket

oleaut32

SysFreeString
SafeArrayDestroy
SafeArrayGetElement
VariantInit
SafeArrayGetUBound
SafeArrayGetLBound
VariantClear
VariantChangeType
SysAllocString

ws2_32

htonl
ntohl
htons
ntohs

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 228KB - Virtual size: 225KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f7118a03c65b3b869d9b73197e8a591b

Headers

File Characteristics

PDB Paths

Imports

iocptcp

kernel32

user32

gdi32

winspool.drv

advapi32

comctl32

shlwapi

ole32

oleaut32

ws2_32

iphlpapi

Sections

.text Size: 228KB - Virtual size: 225KB

.rdata Size: 36KB - Virtual size: 34KB

.data Size: 8KB - Virtual size: 24KB

.rsrc Size: 4KB - Virtual size: 1024B

.text
Size: 228KB - Virtual size: 225KB

.rdata
Size: 36KB - Virtual size: 34KB

.data
Size: 8KB - Virtual size: 24KB

.rsrc
Size: 4KB - Virtual size: 1024B