6a9c3f9f333cdbbe3cb17117445f0d46_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6a9c3f9f333cdbbe3cb17117445f0d46_JaffaCakes118
Size

1.3MB
MD5

6a9c3f9f333cdbbe3cb17117445f0d46
SHA1

68a394c2f0877be55966abce21a198cde3a8756f
SHA256

432f19da6db947f7c152afb9f5d6d87b192a21fbc41e1592f95b48255a14116b
SHA512

7ea4aa300855a3d5b2a46828bec8de76a66ccee4a8dba2e3304627ef88fa5df34681455639f8a1b98ff3894ec0356dfce4eb3c9af31574c30a2bafc4dfaab066
SSDEEP

24576:etUp2KTBf5Cg/eNvc0Ky31xYIf3tDpUGKcJAgphUsOmk:UWMoyvYIPtDGGtJAyhUsFk

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
6a9c3f9f333cdbbe3cb17117445f0d46_JaffaCakes118
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/TKThreeCardDll.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

6a9c3f9f333cdbbe3cb17117445f0d46_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dfb06052e74b26a42b0e490bd1c07959

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
MulDiv
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
RegisterClassA
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
wvsprintfA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
EmptyClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
SetForegroundWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 280KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

0b51ce6ce6bf8d5c68b3ea9f3ac1bf2c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
MessageBoxA
CallWindowProcA
PostMessageA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
Lisence.txt
TKLobby.ico
TKThreeCardDll.dll
.dll windows:4 windows x86 arch:x86

3f5600b04713ab9533bbcbab4d186f3f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Work\Company\Game\TKThreeCard\TKThreeCardDll\Release\TKThreeCardDll.pdb

Imports

mfc71

ord265
ord266
ord3641
ord3441
ord5182
ord4212
ord4735
ord4890
ord2020
ord1671
ord1670
ord1551
ord5912
ord1401
ord5203
ord4262
ord354
ord605
ord6067
ord2657
ord4580
ord2654
ord4320
ord5059
ord4564
ord3596
ord2164
ord1123
ord3989
ord651
ord416
ord3683
ord1084
ord757
ord3182
ord4038
ord4014
ord6278
ord3801
ord6276
ord4326
ord2063
ord2018
ord5583
ord3806
ord501
ord5102
ord6219
ord5382
ord3832
ord1920
ord2931
ord5224
ord5226
ord3948
ord4568
ord5230
ord5566
ord2838
ord4481
ord3333
ord566
ord2248
ord5213
ord314
ord1395
ord2469
ord3830
ord6120
ord2392
ord2408
ord2413
ord2396
ord2398
ord2400
ord2394
ord709
ord5731
ord304
ord781
ord6090
ord4125
ord1161
ord760
ord310
ord4244
ord2415
ord2933
ord299
ord6118
ord2902
ord876
ord1489
ord297
ord578
ord762
ord4353
ord587
ord764
ord572
ord3164
ord4261
ord4486
ord3949
ord2644
ord3709
ord3719
ord3718
ord2533
ord2646
ord2540
ord2862
ord2714
ord4307
ord2835
ord2731
ord2537
ord5200
ord1599
ord1655
ord1656
ord1964
ord5175
ord1362
ord4967
ord3345
ord6277
ord3802
ord6279
ord1522
ord2172
ord2178
ord2405
ord2387
ord2385
ord2403
ord1010
ord3210
ord563
ord753
ord3423
ord765
ord315
ord1037
ord1206
ord1208
ord1098
ord371
ord1120
ord1201
ord1175
ord1177
ord1209
ord1092
ord1167
ord2410
ord2390
ord934
ord930
ord932
ord928
ord923
ord5233
ord5235
ord5960
ord1600
ord4282
ord4722
ord3403
ord5214
ord4185
ord6275
ord5073
ord1908
ord5152
ord4232
ord1402
ord3946
ord1617
ord1620
ord5915
ord1545
ord1903
ord2372
ord1280
ord581
ord1934
ord3302
ord3684

msvcr71

??0exception@@QAE@XZ
??1exception@@UAE@XZ
__CxxFrameHandler
_adjust_fdiv
__CppXcptFilter
_purecall
??0exception@@QAE@ABV0@@Z
_CxxThrowException
memmove
_mbscmp
malloc
free
_except_handler3
fclose
getc
fseek
fread
fopen
longjmp
_setjmp3
rand
sprintf
atoi
_mbschr
_vsnprintf
fflush
fprintf
bsearch
_CIpow
strtod
_iob
strncpy
abort
vsprintf
_initterm
_strtime
strchr
_local_unwind2
realloc
strrchr
srand
memset
?terminate@@YAXXZ
??1type_info@@UAE@XZ
__dllonexit
_onexit
__security_error_handler

kernel32

GetSystemTimeAsFileTime
QueryPerformanceCounter
ExitProcess
LocalAlloc
LocalFree
GetModuleHandleA
GetModuleFileNameA
SetCurrentDirectoryA
GlobalMemoryStatus
GetPrivateProfileStringA
GetTickCount
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
LeaveCriticalSection
EnterCriticalSection
SetFilePointer
CreateFileA
GetFileSize
GlobalAlloc
CloseHandle
ReadFile
GlobalFree
DeleteCriticalSection
InitializeCriticalSection
GetVersionExA
InterlockedExchange
LoadLibraryA
GetProcAddress
FreeLibrary
GetFileAttributesA
lstrcpynA
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreA
CreateMutexA

user32

SetTimer
KillTimer
GetCapture
SetCapture
GetParent
EnableWindow
GetWindowLongA
DrawTextA
GetDC
IsWindow
ReleaseCapture
SetCursor
PtInRect
ReleaseDC
OffsetRect
UnregisterClassA
LoadCursorA
PostMessageA
InvalidateRect
GetWindowThreadProcessId
GetForegroundWindow
FlashWindow
SetPropA
wsprintfA
CopyRect
RedrawWindow
DrawIcon
LoadIconA
GetDesktopWindow
DestroyWindow
FindWindowA
GetSysColor
GetWindowTextA
GetClientRect
GetWindowRect
DestroyIcon
SetWindowRgn
CopyImage
SendMessageA

gdi32

DeleteDC
GetPixel
CreateCompatibleBitmap
GetStockObject
CreateDIBSection
CombineRgn
GetObjectA
CreateFontIndirectA
CreateSolidBrush
CreateCompatibleDC
DeleteObject
SelectObject
SetBkMode
SetTextColor
CreateRectRgn
BitBlt

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

shell32

ShellExecuteExA

ole32

CreateStreamOnHGlobal

oleaut32

OleLoadPicture

msvcp71

?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?clear@ios_base@std@@QAEXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z

Exports

Exports

GCInit

Sections

.text
Size: 152KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ThreeCardTheme/Sound/Bet.wav
ThreeCardTheme/Sound/Deal.wav
ThreeCardTheme/Sound/Sound.ini
ThreeCardTheme/Sound/b_̫С Ӵ.mp3
ThreeCardTheme/Sound/b_͵͵һ.mp3
ThreeCardTheme/Sound/b_Ϊʲô˵.mp3
ThreeCardTheme/Sound/b_ϣԹ.mp3
ThreeCardTheme/Sound/b_ϣҵı.mp3
ThreeCardTheme/Sound/b_ϣһдƹ.mp3
ThreeCardTheme/Sound/b_Ҫ.mp3
ThreeCardTheme/Sound/b_̲סһ.mp3
ThreeCardTheme/Sound/b_ȵһһ.mp3
ThreeCardTheme/Sound/b_һ Ǹ .mp3
ThreeCardTheme/Sound/b_ .mp3
ThreeCardTheme/Sound/b_ʿҪ.mp3
ThreeCardTheme/Sound/b_.mp3
ThreeCardTheme/Sound/b_.mp3
ThreeCardTheme/Sound/b_.mp3
ThreeCardTheme/Sound/b_ȥ.mp3
ThreeCardTheme/Sound/b_͸.mp3
ThreeCardTheme/Sound/b_.mp3
ThreeCardTheme/Sound/b_.mp3
ThreeCardTheme/Sound/b_.mp3
ThreeCardTheme/Sound/b_ע.mp3
ThreeCardTheme/Sound/b_.mp3
ThreeCardTheme/Sound/b_ӱ ̲.mp3
ThreeCardTheme/Sound/b_һ.mp3
ThreeCardTheme/Sound/b_ˣ.mp3
ThreeCardTheme/Sound/b_ܴ.mp3
ThreeCardTheme/Sound/b_ƲþͲ.mp3
ThreeCardTheme/Sound/b_Ʋȳ.mp3
ThreeCardTheme/Sound/b_ҿ.mp3
ThreeCardTheme/Sound/b_Һ̫ǿ.mp3
ThreeCardTheme/Sound/b_һ.mp3
ThreeCardTheme/Sound/b_.mp3
ThreeCardTheme/Sound/b_Ϣһ.mp3
ThreeCardTheme/Sound/b_ټӵ.mp3
ThreeCardTheme/Sound/g_̫С Ӵ.mp3
ThreeCardTheme/Sound/g_͵͵һ.mp3
ThreeCardTheme/Sound/g_Ϊʲô˵.mp3
ThreeCardTheme/Sound/g_ϣԹ.mp3
ThreeCardTheme/Sound/g_ Ҫ.mp3
ThreeCardTheme/Sound/g_ ̲סһô.mp3
ThreeCardTheme/Sound/g_ȵһһ.mp3
ThreeCardTheme/Sound/g_һ ĸ.mp3
ThreeCardTheme/Sound/g_ .mp3
ThreeCardTheme/Sound/g_ 綼Ҫõ.mp3
ThreeCardTheme/Sound/g_Ҫܹ.mp3
ThreeCardTheme/Sound/g_මම.mp3
ThreeCardTheme/Sound/g_.mp3
ThreeCardTheme/Sound/g_.mp3
ThreeCardTheme/Sound/g_.mp3
ThreeCardTheme/Sound/g_ȥ.mp3
ThreeCardTheme/Sound/g_͸.mp3
ThreeCardTheme/Sound/g_.mp3
ThreeCardTheme/Sound/g_.mp3
ThreeCardTheme/Sound/g_ע.mp3
ThreeCardTheme/Sound/g_.mp3
ThreeCardTheme/Sound/g_ӱ̲.mp3
ThreeCardTheme/Sound/g_һ.mp3
ThreeCardTheme/Sound/g_ˣ.mp3
ThreeCardTheme/Sound/g_ܴô.mp3
ThreeCardTheme/Sound/g_ƲþͲ.mp3
ThreeCardTheme/Sound/g_Ʋس.mp3
ThreeCardTheme/Sound/g_.mp3
ThreeCardTheme/Sound/g_ .mp3
ThreeCardTheme/Sound/g_Һ̫ǿ.mp3
ThreeCardTheme/Sound/g_һô.mp3
ThreeCardTheme/Sound/g_ɢ.mp3
ThreeCardTheme/default.thm

Sharing

General

Malware Config

Signatures

Files

dfb06052e74b26a42b0e490bd1c07959

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 3KB - Virtual size: 252KB

.ndata Size: - Virtual size: 280KB

.rsrc Size: 32KB - Virtual size: 32KB

0b51ce6ce6bf8d5c68b3ea9f3ac1bf2c

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

3f5600b04713ab9533bbcbab4d186f3f

Headers

File Characteristics

PDB Paths

Imports

mfc71

msvcr71

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcp71

Exports

Exports

Sections

.text Size: 152KB - Virtual size: 150KB

.rdata Size: 44KB - Virtual size: 40KB

.data Size: 4KB - Virtual size: 12KB

.rsrc Size: 48KB - Virtual size: 44KB

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 3KB - Virtual size: 252KB

.ndata
Size: - Virtual size: 280KB

.rsrc
Size: 32KB - Virtual size: 32KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 152KB - Virtual size: 150KB

.rdata
Size: 44KB - Virtual size: 40KB

.data
Size: 4KB - Virtual size: 12KB

.rsrc
Size: 48KB - Virtual size: 44KB

.reloc
Size: 20KB - Virtual size: 19KB