8bce32510b48e20ed5d21173f4138c07_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8bce32510b48e20ed5d21173f4138c07_JaffaCakes118
Size

7.1MB
MD5

8bce32510b48e20ed5d21173f4138c07
SHA1

a20556985480680a551916439ac4ff823369cc87
SHA256

dae422825e6ebd5cfd7bd25eee6d8ef83bd32f89fc8ae816909807efc362e6cb
SHA512

6b2c7f46d1f3eeae37def803e62870c9593564efd68cdb1a3c53ccd5ba0209c0c0ef15aad8547d8c7804a25d51f8fdf5a3845b996c07d390812d9d243c7c8ad7
SSDEEP

49152:cYlV2cs6JLZ1RoGUJn7i/5g5gBfLPwL6LIyg5FXhxUKBlpk+8xl/fs7osMw2:1BN4Gbj0/n9FvpkbxlcUBw2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8bce32510b48e20ed5d21173f4138c07_JaffaCakes118

Files

8bce32510b48e20ed5d21173f4138c07_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9fa61efc24400ff28534ce81665fc7eb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

i:\projects\arc_yds260\yds-release\yandesk.pdb

Imports

wsock32

accept
recv
listen
WSAGetLastError
getsockname
getpeername
WSACleanup
WSAStartup
ntohs
ntohl
bind
htons
setsockopt
socket
__WSAFDIsSet
closesocket
htonl
select
shutdown
send
gethostbyname
connect
getsockopt

comctl32

ImageList_AddMasked
ImageList_GetIconSize
ImageList_GetIcon
ImageList_Remove
ImageList_Duplicate
_TrackMouseEvent
ImageList_SetBkColor
ImageList_Create
ImageList_ReplaceIcon
ImageList_Draw
InitCommonControlsEx
ImageList_GetImageInfo

wininet

InternetCloseHandle
InternetReadFile
InternetOpenUrlA
InternetOpenA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
RetrieveUrlCacheEntryStreamA
ReadUrlCacheEntryStream
UnlockUrlCacheEntryStream
FindCloseUrlCache
InternetGetConnectedState

oleaut32

SysAllocStringByteLen
SysStringByteLen
SysStringLen
SysFreeString
VariantClear
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
GetActiveObject
VarUI4FromStr
LoadRegTypeLi
RegisterActiveObject
RevokeActiveObject
SysAllocString

kernel32

lstrlenA
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
GetTimeZoneInformation
GetFileAttributesA
lstrlenW
SetHandleCount
IsBadWritePtr
GetExitCodeThread
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
ExpandEnvironmentStringsA
lstrcmpiA
GetCurrentThread
GetTickCount
GetDiskFreeSpaceExA
VirtualFree
SetThreadPriority
LocalAlloc
FormatMessageA
DeleteCriticalSection
InitializeCriticalSection
GetLastError
RaiseException
GetWindowsDirectoryA
WideCharToMultiByte
CompareStringA
CompareStringW
MultiByteToWideChar
GetVersionExA
InterlockedDecrement
GetEnvironmentVariableA
GetThreadLocale
CloseHandle
GetExitCodeProcess
CreateProcessA
GetLocaleInfoA
GetACP
InterlockedExchange
HeapCreate
HeapDestroy
LocalFree
SetLastError
FindClose
FindNextFileA
FindFirstFileA
MoveFileA
DeviceIoControl
FreeResource
LockResource
LoadResource
FindResourceA
GetModuleFileNameA
GetFullPathNameW
GetOEMCP
WritePrivateProfileStringA
GetPrivateProfileStringA
WaitForSingleObject
FileTimeToDosDateTime
CreateMutexA
GetSystemDirectoryA
CreateEventA
GetPrivateProfileIntA
GetPrivateProfileSectionNamesA
FreeLibrary
ResetEvent
SetEvent
GetSystemTimeAsFileTime
SetProcessWorkingSetSize
OpenProcess
GetCurrentProcessId
GetFullPathNameA
Sleep
EnterCriticalSection
LeaveCriticalSection
LCMapStringW
LCMapStringA
InterlockedIncrement
FlushInstructionCache
GetCurrentProcess
HeapFree
GetProcessHeap
HeapAlloc
SetFileAttributesW
GetStartupInfoA
SetStdHandle
DeleteFileA
GetFileAttributesW
lstrcpyA
GetModuleHandleA
GetDiskFreeSpaceA
CreateDirectoryW
GetSystemTime
lstrcmpW
OutputDebugStringA
LocalFileTimeToFileTime
GetSystemPowerStatus
TerminateProcess
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
FindFirstFileW
SetUnhandledExceptionFilter
DebugBreak
ExitProcess
FindNextFileW
SetConsoleCtrlHandler
GetCPInfo
GetFileType
GetFileTime
SetFileTime
SetEndOfFile
SetFilePointer
GetStdHandle
FlushFileBuffers
lstrcpynA
GetCurrentDirectoryA
lstrcatA
GetCurrentThreadId
QueryPerformanceCounter
ReadFile
WriteFileEx
CreateThread
ExitThread
WriteFile
CreateFileW
IsDBCSLeadByte
GetSystemInfo
LoadLibraryExW
LoadLibraryW
VirtualProtect
WriteProcessMemory
VirtualQuery
Module32Next
Module32First
CreateToolhelp32Snapshot
GetDateFormatA
GetTimeFormatA
GetLongPathNameA
SetFileAttributesA
HeapReAlloc
RtlUnwind
VirtualAlloc
SizeofResource
LoadLibraryExA
GetTempFileNameA
CreateFileA
GetLogicalDriveStringsA
GetDriveTypeA
LoadLibraryA
GetProcAddress
CreateDirectoryA
HeapSize
UnhandledExceptionFilter
SetEnvironmentVariableA
GetCommandLineA
SetErrorMode
GetTempPathA
WaitForMultipleObjects
FreeEnvironmentStringsA
QueryPerformanceFrequency
MulDiv
SetPriorityClass
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
IsBadReadPtr
IsBadCodePtr
GetLocaleInfoW
RemoveDirectoryA
DuplicateHandle
GetFileInformationByHandle
OpenMutexA
PeekNamedPipe

user32

PostQuitMessage
GetDoubleClickTime
RegisterClassA
FillRect
SetTimer
GetWindowTextA
EndPaint
BeginPaint
RegisterWindowMessageA
IsWindow
LoadBitmapA
GetIconInfo
DestroyWindow
CreateDialogParamA
InvalidateRect
PtInRect
SetCapture
GetWindowTextLengthA
GetCapture
ReleaseCapture
UpdateWindow
ScreenToClient
OemToCharA
LoadCursorA
CharToOemA
CheckDlgButton
GetDlgItemInt
GetDlgItemTextA
IsDlgButtonChecked
SetDlgItemInt
IsDialogMessageA
DrawFocusRect
DialogBoxParamA
GetClassNameA
EndDialog
GetDlgItem
GetDlgCtrlID
GetParent
GetNextDlgTabItem
GetClientRect
SetWindowPos
SendMessageA
CallWindowProcA
CreateWindowExA
OffsetRect
PostMessageA
SetRectEmpty
GetFocus
InflateRect
IntersectRect
GetDC
DrawFrameControl
GetSysColor
IsChild
OemToCharBuffA
DefWindowProcA
LoadMenuA
GetSubMenu
SetMenuDefaultItem
CheckMenuRadioItem
GetCursorPos
SetForegroundWindow
TrackPopupMenu
ReleaseDC
RegisterHotKey
PostThreadMessageA
FindWindowA
GetWindowLongA
LoadIconA
UnregisterHotKey
SystemParametersInfoA
SetCursor
SetFocus
SetWindowLongA
IsWindowEnabled
CharNextA
DestroyIcon
LoadStringA
IsWindowVisible
RedrawWindow
DrawTextA
GetWindow
MessageBoxA
GetWindowRect
UnregisterClassA
wsprintfA
PeekMessageA
CharToOemBuffA
MapWindowPoints
ShowWindow
LoadImageA
HideCaret
SetDlgItemTextA
DrawEdge
EnableWindow
IsWindowUnicode
GetMessageW
SetWindowTextA
GetMessageA
TranslateMessage
DispatchMessageW
DispatchMessageA
MsgWaitForMultipleObjects
CharUpperA
CharLowerA
SetRect
GetMessagePos
KillTimer
CopyRect
SetActiveWindow
wvsprintfA
GetSysColorBrush
GetActiveWindow
CreateCursor
DestroyCursor
DialogBoxIndirectParamA
GetSystemMetrics

ole32

OleUninitialize
CoTaskMemFree
StringFromGUID2
CoCreateGuid
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemAlloc
CoTaskMemRealloc
CoUninitialize
CLSIDFromProgID
CLSIDFromString
CoUnmarshalInterface
CoMarshalInterface
CreateStreamOnHGlobal
OleRun
ProgIDFromCLSID
CoCreateInstance
OleInitialize
CoInitializeEx
CoInitialize
StringFromCLSID
CoReleaseMarshalData

advapi32

RegOpenKeyExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
SetFileSecurityW
SetFileSecurityA
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
RegCreateKeyExA
RegDeleteKeyA
RegQueryInfoKeyA
RegCloseKey

shell32

SHFileOperationA
SHBrowseForFolderA
ExtractIconExA
Shell_NotifyIconA
SHGetFileInfoA
SHGetSpecialFolderPathA
ShellExecuteA
ShellExecuteExA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHGetDesktopFolder

gdi32

GetBitmapBits
GetDIBits
SetTextColor
CreateSolidBrush
SelectObject
SelectClipRgn
SetBkMode
CreateCompatibleDC
CreateFontIndirectA
GetObjectA
CreateCompatibleBitmap
BitBlt
SetBkColor
ExtTextOutA
TextOutA
DeleteDC
SaveDC
CreateRectRgnIndirect
GetStockObject
DeleteObject
RestoreDC
GetTextExtentPoint32A

comdlg32

GetOpenFileNameA

shlwapi

PathAddBackslashA
PathGetArgsA
PathFindFileNameA
PathCompactPathA
PathFindExtensionA
PathFileExistsA

dinput

DirectInputCreateA

imagehlp

ImageDirectoryEntryToData

ws2_32

WSASend
WSAEventSelect
WSACreateEvent
WSAWaitForMultipleEvents
WSAStringToAddressA
WSACloseEvent

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 320KB - Virtual size: 700KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 356KB - Virtual size: 356KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9fa61efc24400ff28534ce81665fc7eb

Headers

File Characteristics

PDB Paths

Imports

wsock32

comctl32

wininet

oleaut32

kernel32

user32

ole32

advapi32

shell32

gdi32

comdlg32

shlwapi

dinput

imagehlp

ws2_32

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

.rdata Size: 3.6MB - Virtual size: 3.6MB

.data Size: 320KB - Virtual size: 700KB

.rsrc Size: 356KB - Virtual size: 356KB

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 3.6MB - Virtual size: 3.6MB

.data
Size: 320KB - Virtual size: 700KB

.rsrc
Size: 356KB - Virtual size: 356KB