7345836b24aea1b5cff615ac9892cfe5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

7345836b24aea1b5cff615ac9892cfe5_JaffaCakes118
Size

2.2MB
MD5

7345836b24aea1b5cff615ac9892cfe5
SHA1

287df0ba654bb85fe5d4b4285d07211076341cb5
SHA256

e25b2313826b79ee3cbc4c96bc84dd1df8f01f1b3f05bf7f6b8b511ef4bac388
SHA512

759f9df70b9246390f06cc7d0e9d2b8e6f1ac527ae9a2717f0517425f8abe6689e5d83adf6ab1c77a4d8676be29046b178d1881cc7887b2bda0081ba137347bd
SSDEEP

49152:M/mMpNgoOs083Fa8sa+0LofNSSJ0XDURR0p99RxyKQjFX+:M/m4KoKa+W+NSSJ0XDURR0p9PxyKQhX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7345836b24aea1b5cff615ac9892cfe5_JaffaCakes118

Files

7345836b24aea1b5cff615ac9892cfe5_JaffaCakes118
.exe windows:6 windows x86 arch:x86

a1529e069f57ba1b0ffc78b27ef96028

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\quarc-cheat-library\binary\qloader.pdb

Imports

d3d9

Direct3DCreate9

ws2_32

send
connect
bind
sendto
WSASetLastError
select
__WSAFDIsSet
WSACleanup
getpeername
getsockname
getsockopt
ntohs
WSAIoctl
setsockopt
accept
listen
recvfrom
ioctlsocket
gethostname
htonl
ntohl
closesocket
WSAGetLastError
getaddrinfo
WSAStartup
socket
recv
htons
freeaddrinfo

advapi32

CryptGenRandom
RegQueryValueExA
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
RegCreateKeyExA
RegOpenKeyExA
CryptReleaseContext
CryptAcquireContextA
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExA

crypt32

CertFreeCertificateContext

wldap32

ord22
ord41
ord50
ord60
ord211
ord46
ord27
ord301
ord200
ord30
ord79
ord35
ord33
ord26
ord143
ord32

normaliz

IdnToAscii

kernel32

InitializeSListHead
GetSystemTimeAsFileTime
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
GetCurrentThreadId
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
FormatMessageA
VerifyVersionInfoA
GetSystemDirectoryA
SleepEx
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
FreeLibrary
CreateDirectoryA
CreateProcessA
Process32Next
GetFullPathNameA
Process32First
GetModuleFileNameA
lstrcpyA
lstrlenA
CreateEventW
ResetEvent
SetEvent
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
GetTickCount64
GetCommandLineW
lstrcmpiW
ExpandEnvironmentStringsA
WaitForSingleObject
CloseHandle
CreateThread
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
VerSetConditionMask
QueryPerformanceCounter
CreateToolhelp32Snapshot
Sleep
Process32NextW
Process32FirstW
GetModuleHandleW
WriteProcessMemory
VirtualFreeEx
TerminateProcess
SuspendThread
ResumeThread
OpenProcess
lstrcatW
LoadLibraryW
Module32FirstW
VirtualAllocEx
CreateProcessW
CreateRemoteThread
Module32NextW

user32

GetForegroundWindow
IsChild
ClientToScreen
GetCapture
ScreenToClient
LoadCursorA
GetKeyState
SendMessageA
UpdateWindow
SetCapture
PostQuitMessage
UnregisterClassA
PeekMessageA
LoadIconA
TranslateMessage
CreateWindowExA
DefWindowProcA
ShowWindow
DestroyWindow
DispatchMessageA
GetClipboardData
SetClipboardData
SetCursor
GetClientRect
ReleaseCapture
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
RegisterClassExA
EmptyClipboard

shell32

SHGetPathFromIDListW
SHBrowseForFolderA
ShellExecuteA

ole32

CoInitializeEx
CoTaskMemFree
CoCreateInstance
CoUninitialize

msvcp140

?_Xout_of_range@std@@YAXPBD@Z
_Query_perf_frequency
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
_Thrd_sleep
_Query_perf_counter
_Xtime_get_ticks
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?tolower@?$ctype@D@std@@QBEDD@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?_Xbad_alloc@std@@YAXXZ
_Strxfrm
?_Xlength_error@std@@YAXPBD@Z

imm32

ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow

xinput1_3

ord2
ord4

urlmon

URLDownloadToFileA

shlwapi

PathGetArgsW

wininet

DeleteUrlCacheEntry
DeleteUrlCacheEntryA

vcruntime140

_CxxThrowException
_except_handler4_common
__current_exception_context
__current_exception
__std_exception_copy
memchr
strrchr
memmove
memcpy
memset
strchr
strstr
__std_terminate
__std_exception_destroy
__CxxFrameHandler3

api-ms-win-crt-heap-l1-1-0

calloc
free
_callnewh
_set_new_mode
realloc
malloc

api-ms-win-crt-convert-l1-1-0

atoi
strtoll
strtoul
strtol

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_c_exit
_exit
_initterm_e
_wassert
exit
_register_thread_local_exe_atexit_callback
_initterm
strerror
__sys_nerr
_beginthreadex
_getpid
_get_narrow_winmain_command_line
_errno
_set_app_type
_seh_filter_exe
terminate
_cexit
_crt_atexit
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_controlfp_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf
fflush
fputs
ftell
ferror
feof
fopen
_lseeki64
__acrt_iob_func
fread
__stdio_common_vsprintf
_set_fmode
_wfopen
fwrite
fgets
fclose
__p__commode
fputc
_open
_read
_write
_close
fseek

api-ms-win-crt-string-l1-1-0

isgraph
isxdigit
_stricmp
isprint
strncmp
islower
isupper
isalnum
isspace
isdigit
tolower
isalpha
strncpy
strpbrk
_strdup

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_stat64
rename
_fstat64
remove

api-ms-win-crt-time-l1-1-0

_gmtime64
_time64

api-ms-win-crt-math-l1-1-0

__setusermatherr
ceil
_libm_sse2_sqrt_precise
_libm_sse2_acos_precise
_libm_sse2_cos_precise
_libm_sse2_sin_precise
floor
_CIfmod

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 513KB - Virtual size: 513KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 309KB - Virtual size: 309KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a1529e069f57ba1b0ffc78b27ef96028

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

d3d9

ws2_32

advapi32

crypt32

wldap32

normaliz

kernel32

user32

shell32

ole32

msvcp140

imm32

xinput1_3

urlmon

shlwapi

wininet

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 513KB - Virtual size: 513KB

.rdata Size: 309KB - Virtual size: 309KB

.data Size: 1.4MB - Virtual size: 1.4MB

.rsrc Size: 9KB - Virtual size: 9KB

.reloc Size: 23KB - Virtual size: 22KB

.text
Size: 513KB - Virtual size: 513KB

.rdata
Size: 309KB - Virtual size: 309KB

.data
Size: 1.4MB - Virtual size: 1.4MB

.rsrc
Size: 9KB - Virtual size: 9KB

.reloc
Size: 23KB - Virtual size: 22KB