8300b733229afaf4100c81af463f32e1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8300b733229afaf4100c81af463f32e1_JaffaCakes118
Size

193KB
MD5

8300b733229afaf4100c81af463f32e1
SHA1

51220d6ac6ce159af5ed6af2da9cbbc5bf61bc64
SHA256

1393d7526d7e722338a0ce4ac2db88573889d0c8b7a902dbe5efea76388bbbc6
SHA512

880f26375a2db992824bb68fb648a6017e6c2fd8af507bc3f741a96455dc75ac0f602d61831e70fe81732db0544f8306104202949e3db005d997dc23fb6b69e6
SSDEEP

3072:U4jMmZes/9Zr7L5Xib7m01y4Dr6yfA3ftn7Ee/Jkxe1beMYojwm8f:oCrfL5Xy7544XBiFnIeqxe1yMYoz8f

Score

1^/10

Malware Config

Signatures

Files

8300b733229afaf4100c81af463f32e1_JaffaCakes118
.dll windows:4 windows x86 arch:x86

28476386f570c57b1519d9d6518d267a

Code Sign

05:eb:b4:8b:52:1e:e4:71:bc:5e:c5:cd:9b:76:27:54
Certificate

Issuer

CN=Root Agency

Not Before

23/02/2011, 11:36

Not After

31/12/2039, 23:59

Subject

CN=MineFilter 인증서

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord4627
ord4425
ord3597
ord641
ord2302
ord4234
ord2642
ord4317
ord6380
ord6215
ord6197
ord6143
ord2645
ord926
ord4710
ord4853
ord4376
ord5241
ord3706
ord3626
ord3663
ord2414
ord1641
ord2379
ord3361
ord326
ord324
ord2167
ord5232
ord2393
ord3797
ord2147
ord2864
ord1180
ord268
ord1568
ord5268
ord1567
ord1229
ord1175
ord6141
ord713
ord5683
ord5572
ord2915
ord414
ord2614
ord4277
ord4278
ord6662
ord2763
ord922
ord6283
ord6282
ord823
ord940
ord5859
ord859
ord3984
ord2754
ord5875
ord5450
ord6394
ord5440
ord6383
ord3619
ord6055
ord1776
ord2976
ord3721
ord795
ord4275
ord755
ord470
ord5787
ord284
ord5280
ord323
ord2405
ord1200
ord6199
ord3089
ord2859
ord3573
ord2860
ord3571
ord1640
ord5785
ord3402
ord567
ord4396
ord3574
ord609
ord6880
ord2575
ord2841
ord2107
ord665
ord5442
ord3318
ord5186
ord354
ord6021
ord5651
ord3127
ord3616
ord350
ord3126
ord3613
ord3584
ord543
ord803
ord3790
ord690
ord1988
ord5207
ord389
ord1105
ord4202
ord1979
ord6385
ord6869
ord5356
ord6059
ord5710
ord536
ord1980
ord3181
ord3178
ord4058
ord2781
ord2770
ord668
ord356
ord1116
ord1176
ord1575
ord1168
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord269
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord2725
ord5302
ord4353
ord6374
ord5163
ord2385
ord4407
ord4078
ord6052
ord2514
ord4998
ord5265
ord6453
ord3337
ord912
ord397
ord4188
ord5608
ord6781
ord699
ord939
ord825
ord941
ord924
ord551
ord858
ord4129
ord6883
ord5861
ord537
ord541
ord2764
ord801
ord540
ord2818
ord535
ord6467
ord860
ord3811
ord800
ord1247
ord1199
ord815
ord561
ord3738
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord640
ord3830
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord5290
ord4274

msvcrt

__dllonexit
__CxxFrameHandler
strstr
atoi
strftime
localtime
time
_mbsicmp
strtol
fread
fclose
ftell
fseek
fopen
memcpy
memset
_ftol
isdigit
strcpy
strncpy
sqrt
tolower
qsort
free
malloc
_mbscmp
_strnicmp
_onexit
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv

kernel32

LocalFree
RemoveDirectoryA
GetTempPathA
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
CreateFileA
CreateProcessA
GetExitCodeProcess
WaitForSingleObject
CloseHandle
GetShortPathNameA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetLastError
MoveFileA
QueryPerformanceFrequency
QueryPerformanceCounter
WideCharToMultiByte
ExpandEnvironmentStringsA
GetModuleHandleA
GetProcAddress
GetVersionExA
CreateDirectoryA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SizeofResource
GlobalLock
GlobalUnlock
MulDiv
lstrcmpiA
lstrcpyA
GlobalAlloc
GlobalFree
LockResource
FindResourceA
LoadResource
FreeResource
GetModuleFileNameA
GetCurrentThreadId
GetCurrentProcessId
lstrcatA
OutputDebugStringA
GetTickCount
WritePrivateProfileStringA
WritePrivateProfileSectionA
lstrlenA
DeleteFileA
LocalAlloc

user32

SetActiveWindow
GetActiveWindow
IsWindowEnabled
SendMessageA
MonitorFromPoint
GetMonitorInfoA
GetDesktopWindow
GetClassLongA
SetClassLongA
EnableWindow
SetTimer
wvsprintfA
wsprintfA
AnimateWindow
SetWindowRgn
GetDC
ScreenToClient
GetParent
PeekMessageA
GetWindowRect
GetClientRect
UpdateWindow
GetSysColor
CopyImage
CopyRect
PtInRect
OffsetRect
ReleaseDC
InvalidateRect
IsRectEmpty
PostMessageA
SetWindowLongA
GetWindowTextA
SetCursor
GetCursorPos
WindowFromPoint
LoadCursorA
UnionRect

gdi32

GetMapMode
CreateBitmap
StretchBlt
BitBlt
PatBlt
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectA
GetDeviceCaps
CreateFontA
GetTextMetricsA
GetTextExtentPoint32A
CreateRoundRectRgn
DeleteObject

advapi32

RegSetValueExA
RegEnumKeyA
RegDeleteKeyA
RegSetValueA
RegCreateKeyA
RegCloseKey
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegQueryValueA

shell32

SHGetFileInfoA
SHGetDesktopFolder
SHGetSpecialFolderLocation
ShellExecuteA

comctl32

_TrackMouseEvent

ole32

CreateStreamOnHGlobal

olepro32

ord251

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

shlwapi

SHDeleteValueA

Exports

Exports

Auto_ExecDaily
Auto_Test

Sections

.text
Size: 96KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

28476386f570c57b1519d9d6518d267a

Code Sign

05:eb:b4:8b:52:1e:e4:71:bc:5e:c5:cd:9b:76:27:54Certificate

Signer

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

olepro32

iphlpapi

version

shlwapi

Exports

Exports

Sections

.text Size: 96KB - Virtual size: 92KB

.rdata Size: 20KB - Virtual size: 16KB

.data Size: 12KB - Virtual size: 12KB

.rsrc Size: 52KB - Virtual size: 48KB

.reloc Size: 8KB - Virtual size: 6KB

05:eb:b4:8b:52:1e:e4:71:bc:5e:c5:cd:9b:76:27:54
Certificate

.text
Size: 96KB - Virtual size: 92KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 52KB - Virtual size: 48KB

.reloc
Size: 8KB - Virtual size: 6KB