8db89bda0629ac3731c2e3cb1680b745_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8db89bda0629ac3731c2e3cb1680b745_JaffaCakes118
Size

180KB
MD5

8db89bda0629ac3731c2e3cb1680b745
SHA1

e4353acd59fea307d4c81bbab8007f062fccac3b
SHA256

d58af301a8887f6afdc312a36f37dd3ef0f9ebef347c1bb554d61cc43473379a
SHA512

bbe17ed39204249940b479107a27c04ae6656764a4f781055999a6ba364132e366486c602c9f6660d7e63269a855465f34c56a49eccd9a1ab5ef92d3f128e151
SSDEEP

3072:oQWu/8gvmn12Us8LLyPHK6g9OvxpRcA1OFf6XOwEJF3DpWscDn3z85YWuG:GU8N1TLGf9gMvx3cA2JHWscD33WuG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/5UStartBuilder.exe

Files

8db89bda0629ac3731c2e3cb1680b745_JaffaCakes118
.rar
155绿色软件站.url
.url
5UStartBuilder.exe
.exe windows:4 windows x86 arch:x86

c408e99e858c6b58bbe9f45ad4e94eb7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\freeland\NetBarCode\5UStart\release\5UStartBuilder.pdb

Imports

kernel32

InterlockedIncrement
SetErrorMode
GetFileAttributesA
GetFileTime
GlobalFlags
GetCPInfo
GetOEMCP
GetTickCount
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
VirtualQuery
GetCommandLineA
GetProcessHeap
GetStartupInfoA
RaiseException
RtlUnwind
ExitProcess
HeapSize
Sleep
GetACP
IsValidCodePage
LCMapStringA
GetStringTypeA
GetStringTypeW
GetStdHandle
HeapDestroy
HeapCreate
VirtualFree
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetDriveTypeA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
InterlockedDecrement
GetModuleFileNameW
GetCurrentProcessId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
lstrcmpW
GetVersionExA
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
FreeLibrary
GetModuleHandleA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetProcAddress
GetFullPathNameA
GetVolumeInformationA
GetCurrentProcess
DuplicateHandle
GetFileSize
UnlockFile
LockFile
FlushFileBuffers
LoadLibraryA
GetThreadLocale
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
GetSystemInfo
FindClose
SetEndOfFile
FindFirstFileA
FindNextFileA
SetFilePointer
ReadFile
FreeResource
CloseHandle
WriteFile
CreateFileA
SetLastError
GetModuleFileNameA
GetLocalTime
GetCurrentThreadId
LocalFree
FormatMessageA
GetCurrentDirectoryA
InterlockedExchange
MultiByteToWideChar
GetVersion
lstrlenA
CompareStringA
GetLastError
CompareStringW
WritePrivateProfileStringA
GetSystemDirectoryA
CreateThread
WaitForSingleObject
CopyFileA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateDirectoryA
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
LCMapStringW
SizeofResource

user32

RegisterClipboardFormatA
PostThreadMessageA
DestroyMenu
GetDesktopWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
SetWindowContextHelpId
MapDialogRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetWindowThreadProcessId
IsWindowEnabled
IsDialogMessageA
SetDlgItemTextA
RegisterWindowMessageA
SendDlgItemMessageA
IsChild
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
IsWindow
SetFocus
GetWindowTextLengthA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
UpdateWindow
GetMenu
MessageBoxA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
EqualRect
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowPos
EnableWindow
SetTimer
AppendMenuA
IsIconic
SendMessageA
GetSystemMetrics
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindow
PostMessageA
PostQuitMessage
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
UnregisterClassA
GetNextDlgGroupItem
InvalidateRgn
SetRect
IsRectEmpty
CopyAcceleratorTableA
CharNextA
PeekMessageA
GetCursorPos
ReleaseCapture
SetCapture
GetWindowTextA
GetSysColorBrush
GetClientRect
LoadIconA
DrawIcon
KillTimer
GetSystemMenu
MessageBeep
InvalidateRect
LoadCursorA
SetCursor
GetParent
GetWindowRect
SetRectEmpty
InflateRect
DrawFocusRect
CharUpperA
MoveWindow
FindWindowExA
ShowWindow
GetDlgItem
GetWindowLongA
SetWindowLongA
SetWindowTextA
ScreenToClient
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
ValidateRect
WinHelpA

gdi32

ExtSelectClipRgn
DeleteDC
CreateBitmap
CreateRectRgnIndirect
GetMapMode
GetBkColor
GetTextColor
GetRgnBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
GetStockObject
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
SetBkMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
CreateFontIndirectA
GetObjectA
PtVisible

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyA
RegCloseKey
RegEnumKeyExA
RegEnumValueA
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA

shell32

SHGetPathFromIDListA
SHGetFileInfoA
SHGetSpecialFolderLocation
SHBrowseForFolderA
SHGetMalloc
ShellExecuteA

comctl32

InitCommonControlsEx

shlwapi

PathIsDirectoryA
PathStripToRootA
PathIsUNCA
PathFindExtensionA
PathFileExistsA
PathFindFileNameA

oledlg

ord8

ole32

OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemFree
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CLSIDFromProgID

oleaut32

SysFreeString
SysAllocStringByteLen
VariantClear
VariantChangeType
VariantInit
SysAllocStringLen
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
SysAllocString
SysStringLen

Sections

.text
Size: 248KB - Virtual size: 246KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 208KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c408e99e858c6b58bbe9f45ad4e94eb7

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

Sections

.text Size: 248KB - Virtual size: 246KB

.rdata Size: 60KB - Virtual size: 58KB

.data Size: 12KB - Virtual size: 26KB

.rsrc Size: 208KB - Virtual size: 204KB

.text
Size: 248KB - Virtual size: 246KB

.rdata
Size: 60KB - Virtual size: 58KB

.data
Size: 12KB - Virtual size: 26KB

.rsrc
Size: 208KB - Virtual size: 204KB