89df8841c1c099cafbfca448f31d0ef1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

89df8841c1c099cafbfca448f31d0ef1_JaffaCakes118
Size

236KB
MD5

89df8841c1c099cafbfca448f31d0ef1
SHA1

3488170927c8d52c6d572b7654c3db74178b7e5c
SHA256

7896db0d84eac9c9a6933db38267dea12cb15858945662bd0b382b6cb43d458f
SHA512

e1f6a06d9a3fab2c4bbf0d0deaa71a5d9b1eb7fd71b3b936e5c44fb0e1e78d3673adf071481f1e254a6363cd745b6f0c9a371bd090cdabc8dc1f76bec7bdf046
SSDEEP

3072:FG1avLEXaU5YaVIryrqhjz7MqAhth1b7hcSWpi07RGFVeeqFlKeLEPgfHiD:hvLUyOEhjXvatXb7hcbpNRMeUeLEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
89df8841c1c099cafbfca448f31d0ef1_JaffaCakes118

Files

89df8841c1c099cafbfca448f31d0ef1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ccc41ee1b56e5c595fce2e768438943c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Work\Prj\Project\4_DMaster\2008011500_mswinhost테이블변경\winhost\winhost\Release\winhost.pdb

Imports

wininet

InternetOpenA
InternetSetStatusCallback
HttpSendRequestA
HttpQueryInfoA
InternetReadFile
InternetConnectA
HttpOpenRequestA
InternetCloseHandle

kernel32

GetCPInfo
GetOEMCP
SetErrorMode
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlUnwind
ExitProcess
GetFileType
GetSystemTimeAsFileTime
GetStartupInfoA
GetCommandLineA
HeapReAlloc
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
SetHandleCount
GetStdHandle
SetStdHandle
LCMapStringA
LCMapStringW
GetTimeZoneInformation
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsBadReadPtr
IsBadCodePtr
SetEnvironmentVariableA
GetCurrentProcess
SetEndOfFile
FlushFileBuffers
SetFilePointer
ReadFile
GlobalFlags
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
EnterCriticalSection
GlobalHandle
GlobalReAlloc
LeaveCriticalSection
LocalAlloc
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
WritePrivateProfileStringA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileA
GlobalAddAtomA
InterlockedDecrement
GetCurrentThread
GetCurrentThreadId
GlobalDeleteAtom
lstrcmpA
GetModuleHandleA
ConvertDefaultLocale
EnumResourceLanguagesA
SetLastError
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
lstrcpynA
LocalFree
GetLogicalDriveStringsA
GetDriveTypeA
QueryDosDeviceA
DeviceIoControl
lstrcatA
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
TerminateProcess
WriteFile
lstrcpyA
CreateFileA
CloseHandle
CreateDirectoryA
GetFullPathNameA
GetModuleFileNameA
Sleep
DeleteFileA
RemoveDirectoryA
ExpandEnvironmentStringsA
GetSystemDirectoryA
GetWindowsDirectoryA
GetCurrentDirectoryA
FindFirstFileA
SearchPathA
FindClose
CopyFileA
LoadLibraryA
FreeLibrary
GetProcAddress
FindResourceA
LoadResource
LockResource
SizeofResource
GetEnvironmentVariableA
CompareStringW
CompareStringA
lstrlenA
lstrcmpiA
GetVersion
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
HeapSize

user32

LoadCursorA
GetSysColorBrush
ShowWindow
SetWindowTextA
DestroyMenu
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
RegisterWindowMessageA
GetCapture
CreateWindowExA
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetWindowTextA
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
LoadIconA
MapWindowPoints
SetForegroundWindow
GetMenu
AdjustWindowRectEx
GetClassInfoA
RegisterClassA
UnregisterClassA
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
CopyRect
GetWindow
SetMenuItemBitmaps
GetFocus
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
ValidateRect
MessageBoxA
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
SetCursor
UnhookWindowsHookEx
PostQuitMessage
GetMenuState
GetMenuItemID
GetMenuItemCount
PostMessageA
GetCursorPos
GetSysColor
GetSystemMetrics
EnableWindow
ReleaseDC
GetDC
GetClientRect
GetWindowRect
SendMessageA
GetSubMenu
PtInRect
wsprintfA
WinHelpA

gdi32

DeleteObject
GetStockObject
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
PtVisible
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
GetClipBox
CreateBitmap
GetDeviceCaps
SetMapMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
RectVisible

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

StartServiceA
RegOpenKeyExA
RegQueryValueExA
RegFlushKey
RegSetValueExA
RegDeleteKeyA
RegCreateKeyExA
RegEnumKeyA
RegOpenKeyA
RegQueryValueA
OpenSCManagerA
DeleteService
ControlService
OpenServiceA
RegCloseKey
CreateServiceA
CloseServiceHandle

shell32

ShellExecuteA
SHGetSpecialFolderPathA

comctl32

ord17

shlwapi

PathFindExtensionA
PathFindFileNameA

oleaut32

VariantInit
VariantClear
VariantChangeType

ws2_32

WSACleanup
WSAStartup
gethostname
inet_ntoa
WSAGetLastError
gethostbyname

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ccc41ee1b56e5c595fce2e768438943c

Headers

File Characteristics

PDB Paths

Imports

wininet

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oleaut32

ws2_32

iphlpapi

Sections

.text Size: 136KB - Virtual size: 135KB

.rdata Size: 44KB - Virtual size: 42KB

.data Size: 12KB - Virtual size: 27KB

.rsrc Size: 40KB - Virtual size: 36KB

.text
Size: 136KB - Virtual size: 135KB

.rdata
Size: 44KB - Virtual size: 42KB

.data
Size: 12KB - Virtual size: 27KB

.rsrc
Size: 40KB - Virtual size: 36KB