75fb3734ae1ced3542d4a545a045911c_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

75fb3734ae1ced3542d4a545a045911c_JaffaCakes118
Size

1.8MB
MD5

75fb3734ae1ced3542d4a545a045911c
SHA1

6545c2f4afe739e2fa3cecedb5e3e03497fe4da0
SHA256

e4d1c0aec1865ad174eaf4a5d4e736431678207156f8681affd5f1a55364ae54
SHA512

62e0e2eae237347e76cd3266c08bd284e10496fcc4432e415471385c03db700210a6a9826e0b0a2fa1e574e43279d60f6e1bc29a21e9caab1c2d6520d6f16ceb
SSDEEP

49152:ZtdDffzfyG1c1Ukyp7yNRoBZfCWCweae/:ZtdDffzfynGp7yeBZfCBp

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
75fb3734ae1ced3542d4a545a045911c_JaffaCakes118

Files

75fb3734ae1ced3542d4a545a045911c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e5c35a91541d8cb96082318001cc6f2f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\projects\funny\CQXZS\org\传奇DPK\bin\JDClient.pdb

Imports

ws2_32

getsockname
ntohs
bind
htons
getsockopt
getpeername
setsockopt
WSAIoctl
send
recv
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSACleanup
gethostname
WSAStartup
ioctlsocket
listen
accept
recvfrom
sendto
getaddrinfo
freeaddrinfo
connect
socket
closesocket

wldap32

ord60
ord143
ord50
ord26
ord30
ord32
ord35
ord79
ord200
ord211
ord33
ord301
ord27
ord41
ord46
ord22

kernel32

GetFileSize
FreeLibrary
MultiByteToWideChar
GetLastError
WideCharToMultiByte
GlobalAlloc
GlobalLock
WriteFile
GlobalUnlock
GlobalFree
VirtualAlloc
VirtualProtectEx
CreateThread
GetCurrentProcessId
CreateToolhelp32Snapshot
FindFirstFileA
FindClose
CreateDirectoryA
FindNextFileA
ReadFile
GetTickCount
OpenFileMappingA
GetVersionExA
IsWow64Process
GetCurrentProcess
FindResourceA
LoadResource
FreeResource
GetModuleHandleA
LockResource
GetCurrentDirectoryA
GetModuleFileNameA
Process32First
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
OpenProcess
GetExitCodeThread
SetLastError
SleepEx
VerifyVersionInfoA
InterlockedIncrement
FormatMessageA
PeekNamedPipe
WaitForMultipleObjects
GetFileType
GetStdHandle
ExpandEnvironmentStringsA
SetStdHandle
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
SetHandleCount
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetLocaleInfoW
LoadLibraryW
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
HeapCreate
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCPInfo
LCMapStringW
RaiseException
FindFirstFileExA
GetDriveTypeA
GetFileInformationByHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
GetCurrentThreadId
WaitForSingleObject
VirtualFreeEx
CreateRemoteThread
GetProcAddress
LoadLibraryA
Sleep
WriteProcessMemory
VirtualAllocEx
CreateProcessA
OutputDebugStringA
UnmapViewOfFile
MapViewOfFile
CloseHandle
CreateFileMappingA
CreateFileA
FlushFileBuffers
GetFullPathNameA
GetCurrentDirectoryW
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
GetDriveTypeW
SetEndOfFile
GetProcessHeap
CreateFileW
Process32Next
InterlockedDecrement
SizeofResource
VerSetConditionMask
InterlockedExchange
EncodePointer
DecodePointer
GetACP
ExitThread
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetSystemTimeAsFileTime
HeapReAlloc
ExitProcess
GetModuleHandleW
HeapAlloc
HeapFree
SetFileTime
GetFileAttributesA
LocalFileTimeToFileTime
SystemTimeToFileTime
SetFilePointer
MulDiv
LoadLibraryA
GetProcAddress
GetLastError
FreeLibrary
InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleW
TerminateProcess
GetCurrentProcess
DeleteCriticalSection
LoadLibraryW
CreateEventW
CompareStringW
SetLastError
GetModuleHandleA
VirtualProtect
GetTickCount
EnterCriticalSection
LeaveCriticalSection
VirtualFree
VirtualAlloc
WriteProcessMemory
CreateToolhelp32Snapshot
GetCurrentProcessId
GetCurrentThreadId
Thread32First
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
GetSystemInfo
LoadResource
MultiByteToWideChar
WideCharToMultiByte
FindResourceExW
FindResourceExA
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
HeapAlloc
HeapFree
HeapDestroy
HeapCreate
GetSystemTime
GetLocalTime
SystemTimeToFileTime
CompareFileTime
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameA
RaiseException
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
RtlUnwind
HeapSize
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
VirtualQuery
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

CharNextA
CreateAcceleratorTableA
InvalidateRgn
SetRect
CharPrevA
DrawTextA
FillRect
SetCaretPos
ShowCaret
HideCaret
CreateCaret
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
IntersectRect
KillTimer
SetTimer
GetFocus
GetUpdateRect
BeginPaint
EndPaint
IsRectEmpty
InvalidateRect
MapWindowPoints
GetCursorPos
GetKeyState
DestroyWindow
SetPropA
PtInRect
GetWindow
IsZoomed
GetSysColor
GetWindowRgn
GetWindowDC
GetSystemMetrics
GetWindowLongW
WindowFromPoint
GetCapture
PostMessageA
ReleaseCapture
SetCursor
SetCapture
LoadCursorA
GetWindowThreadProcessId
MessageBoxA
CharUpperA
ClientToScreen
SetForegroundWindow
LoadIconA
IsWindowVisible
PostQuitMessage
SetWindowRgn
GetWindowRect
GetClientRect
ScreenToClient
IsIconic
SetWindowLongA
GetWindowLongA
MonitorFromWindow
GetMonitorInfoA
ReleaseDC
GetDC
wsprintfA
wsprintfW
GetPropA
CallWindowProcA
MoveWindow
GetClassInfoExA
RegisterClassExA
RegisterClassA
SendMessageA
GetParent
SystemParametersInfoA
SetWindowPos
EnableWindow
GetMessageA
SetFocus
TranslateMessage
DispatchMessageA
ShowWindow
IsWindow
OffsetRect
wvsprintfA
DefWindowProcA
CreateWindowExA
MessageBoxW
CharUpperBuffW

gdi32

CreateDIBSection
GetClipBox
ExtSelectClipRgn
SelectClipRgn
SetBkMode
StretchBlt
CreateSolidBrush
GetTextMetricsA
SaveDC
RestoreDC
SetWindowOrgEx
CreateFontIndirectA
SetStretchBltMode
SetTextColor
GetCharABCWidthsA
GetTextExtentPoint32A
TextOutA
RoundRect
MoveToEx
LineTo
PtInRegion
Rectangle
FrameRgn
CreateHatchBrush
SetROP2
CreatePen
CreateRectRgn
CombineRgn
CreateRoundRectRgn
CreateRectRgnIndirect
DeleteObject
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetDIBits
RealizePalette
SelectPalette
GetStockObject
GetObjectA
DeleteDC
GetDeviceCaps
CreateDCA
ExtTextOutA
SetBkColor

advapi32

CryptDestroyHash
CryptReleaseContext
CryptHashData
CryptAcquireContextA
CryptCreateHash
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CryptGetHashParam

shell32

Shell_NotifyIconA
ShellExecuteA
DragQueryFileA
DragFinish

ole32

CLSIDFromString
OleLockRunning
CoUninitialize
CoInitialize
CoCreateInstance
CLSIDFromProgID

dbghelp

ImageRvaToVa

wininet

InternetOpenA
InternetReadFile
InternetQueryDataAvailable
HttpOpenRequestA
InternetConnectA
InternetSetOptionA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
InternetCloseHandle

ntdll

ZwClose
ZwQueryInformationProcess
ZwDuplicateObject
ZwQuerySystemInformation
ZwOpenProcess
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
RtlUnwind

comctl32

_TrackMouseEvent
ord17

riched20

ord4

Sections

.text
Size: 761KB - Virtual size: 761KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 877KB - Virtual size: 877KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e5c35a91541d8cb96082318001cc6f2f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

wldap32

kernel32

user32

gdi32

advapi32

shell32

ole32

dbghelp

wininet

ntdll

comctl32

riched20

Sections

.text Size: 761KB - Virtual size: 761KB

.rdata Size: 105KB - Virtual size: 104KB

.data Size: 10KB - Virtual size: 24KB

.vmp0 Size: 877KB - Virtual size: 877KB

.vmp1 Size: 55KB - Virtual size: 54KB

.reloc Size: 36KB - Virtual size: 35KB

.rsrc Size: 10KB - Virtual size: 9KB

.text
Size: 761KB - Virtual size: 761KB

.rdata
Size: 105KB - Virtual size: 104KB

.data
Size: 10KB - Virtual size: 24KB

.vmp0
Size: 877KB - Virtual size: 877KB

.vmp1
Size: 55KB - Virtual size: 54KB

.reloc
Size: 36KB - Virtual size: 35KB

.rsrc
Size: 10KB - Virtual size: 9KB