9420732ab6adceba7800e4338780d3b5_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

9420732ab6adceba7800e4338780d3b5_JaffaCakes118
Size

1.0MB
MD5

9420732ab6adceba7800e4338780d3b5
SHA1

bb837541f187ccbf0731df53ca34b40d4ff9e829
SHA256

88249769f21cb9f7855b72f444517aa2640e13d6503e82b1d5d216ff37036534
SHA512

88d87147fcc65cdb868bda0ed9732428f5d362b9e08db41f4c37d83cd5c11bd338434aaa7a9df2423b42428c5e36b1ef7c2bd3427fc5e7912e23b0fd0842a9a0
SSDEEP

24576:J6iZTYuj58sf1PC3UtQ3Pu2pQC+iaiNteoqNycH3b5uzqDtX:1ZTYu5N9j2p/HqNxbAE

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/pictxt-v4.1/dll/Advp.dll
unpack001/pictxt-v4.1/dll/Common.dll
unpack001/pictxt-v4.1/dll/RegCom.dll
unpack001/pictxt-v4.1/dll/SelectPanel.dll
unpack001/pictxt-v4.1/pictxt.exe

Files

9420732ab6adceba7800e4338780d3b5_JaffaCakes118
.rar
pictxt-v4.1/dll/Advp.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

LoadAP

Sections

CODE
Size: 398KB - Virtual size: 397KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 66B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
pictxt-v4.1/dll/Common.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

CreatTempFileName
CreatTempPath
Execute
InttoByteSize
IsFileNameWrong
URLink
WinExecAndWait32

Sections

CODE
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 215B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
pictxt-v4.1/dll/RegCom.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DefaultProgramRegistry
PopMenuRegistry
RegisterFileType
RemovePopMenuRegistry

Sections

CODE
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 169B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
pictxt-v4.1/dll/SelectPanel.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

FreeSelectForm
InitSelectForm
ShowSelectForm

Sections

CODE
Size: 643KB - Virtual size: 643KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 7KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 131B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
pictxt-v4.1/help/Thumbs.db
pictxt-v4.1/help/help.ico
pictxt-v4.1/help/pictxt.chm
.chm
pictxt-v4.1/pictxt.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 7KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 317KB - Virtual size: 317KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
pictxt-v4.1/support/add.dll
.html
pictxt-v4.1/support/pictxt.ini
pictxt-v4.1/support/pictxtreadme.mht
.eml
- http://hi.baidu.com/drawtxt/blog/item/22180013dffd06d3f6039eb7.html
- http://otot.w2.icgaya.com/drawtxt/drawtxt.htm
attachment-2
.gif
email-html-1.txt
.html
pictxt-v4.1/temp/send.htm
.html
pictxt-v4.1/例图/Thumbs.db
pictxt-v4.1/例图/butterfly.jpg
.jpg
pictxt-v4.1/例图/china.bmp
pictxt-v4.1/例图/color.bmp
pictxt-v4.1/例图/face.gif
.gif
pictxt-v4.1/例图/hand.ico
pictxt-v4.1/例图/leaf.gif
.gif
pictxt-v4.1/例图/mm.jpg
.jpg
pictxt-v4.1/例图/toy.jpg
.jpg
pictxt-v4.1/例图/渐变.bmp
pictxt-v4.1/新云软件.url
.url

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 398KB - Virtual size: 397KB

DATA Size: 5KB - Virtual size: 4KB

BSS Size: - Virtual size: 3KB

.idata Size: 9KB - Virtual size: 9KB

.edata Size: 512B - Virtual size: 66B

.reloc Size: 28KB - Virtual size: 28KB

.rsrc Size: 23KB - Virtual size: 23KB

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 69KB - Virtual size: 69KB

DATA Size: 1KB - Virtual size: 1KB

BSS Size: - Virtual size: 2KB

.idata Size: 3KB - Virtual size: 2KB

.edata Size: 512B - Virtual size: 215B

.reloc Size: 6KB - Virtual size: 5KB

.rsrc Size: 6KB - Virtual size: 6KB

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 73KB - Virtual size: 73KB

DATA Size: 1KB - Virtual size: 1KB

BSS Size: - Virtual size: 2KB

.idata Size: 3KB - Virtual size: 2KB

.edata Size: 512B - Virtual size: 169B

.reloc Size: 6KB - Virtual size: 5KB

.rsrc Size: 7KB - Virtual size: 7KB

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 643KB - Virtual size: 643KB

DATA Size: 8KB - Virtual size: 8KB

BSS Size: - Virtual size: 7KB

.idata Size: 9KB - Virtual size: 8KB

.edata Size: 512B - Virtual size: 131B

.reloc Size: 38KB - Virtual size: 37KB

.rsrc Size: 70KB - Virtual size: 70KB

Headers

File Characteristics

Sections

CODE Size: 1.1MB - Virtual size: 1.1MB

DATA Size: 13KB - Virtual size: 12KB

BSS Size: - Virtual size: 7KB

.idata Size: 11KB - Virtual size: 11KB

.tls Size: - Virtual size: 16B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 67KB - Virtual size: 67KB

.rsrc Size: 317KB - Virtual size: 317KB

We care about your privacy.

CODE
Size: 398KB - Virtual size: 397KB

DATA
Size: 5KB - Virtual size: 4KB

BSS
Size: - Virtual size: 3KB

.idata
Size: 9KB - Virtual size: 9KB

.edata
Size: 512B - Virtual size: 66B

.reloc
Size: 28KB - Virtual size: 28KB

.rsrc
Size: 23KB - Virtual size: 23KB

CODE
Size: 69KB - Virtual size: 69KB

DATA
Size: 1KB - Virtual size: 1KB

BSS
Size: - Virtual size: 2KB

.idata
Size: 3KB - Virtual size: 2KB

.edata
Size: 512B - Virtual size: 215B

.reloc
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 6KB - Virtual size: 6KB

CODE
Size: 73KB - Virtual size: 73KB

DATA
Size: 1KB - Virtual size: 1KB

BSS
Size: - Virtual size: 2KB

.idata
Size: 3KB - Virtual size: 2KB

.edata
Size: 512B - Virtual size: 169B

.reloc
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 7KB - Virtual size: 7KB

CODE
Size: 643KB - Virtual size: 643KB

DATA
Size: 8KB - Virtual size: 8KB

BSS
Size: - Virtual size: 7KB

.idata
Size: 9KB - Virtual size: 8KB

.edata
Size: 512B - Virtual size: 131B

.reloc
Size: 38KB - Virtual size: 37KB

.rsrc
Size: 70KB - Virtual size: 70KB

CODE
Size: 1.1MB - Virtual size: 1.1MB

DATA
Size: 13KB - Virtual size: 12KB

BSS
Size: - Virtual size: 7KB

.idata
Size: 11KB - Virtual size: 11KB

.tls
Size: - Virtual size: 16B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 67KB - Virtual size: 67KB

.rsrc
Size: 317KB - Virtual size: 317KB