9665502dac6c8dade4ed8a2167c04006_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

9665502dac6c8dade4ed8a2167c04006_JaffaCakes118
Size

4.1MB
MD5

9665502dac6c8dade4ed8a2167c04006
SHA1

174e92285ab991a6230db7c2381598b7f38e91f8
SHA256

eb61e4a36b8b9c80769a18377140dea09f2310d5038ab394e33fe7fb8701823d
SHA512

bde116e50e4b93af0675a07debbab3c4068e6b666f2baa841c3286dd75e089579e4ed46edadb691312d86d5fee7f2eb5d824745551dbeee50e5c17cd51532920
SSDEEP

49152:zClbeG+KO+t5OZz0/MV6VtJ1QOmsQ2kwI66kMNFjoWwPI0AtQQSZJOj:z+ypKOb0/MsttvkJ69IiWAI0AtWZJ2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9665502dac6c8dade4ed8a2167c04006_JaffaCakes118

Files

9665502dac6c8dade4ed8a2167c04006_JaffaCakes118
.exe windows:4 windows x86 arch:x86

33cfec46e87925d2b81e093fed444f20

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\CabalUpdateEx\US\FBUpdate\Client\CabalMain.pdb

Imports

dsound

ord11

dinput8

DirectInput8Create

d3dx9_30

D3DXMatrixTranspose
D3DXMatrixMultiply
D3DXVec3TransformCoord
D3DXVec3TransformCoordArray
D3DXAssembleShader
D3DXMatrixReflect
D3DXMatrixShadow
D3DXComputeBoundingBox
D3DXQuaternionNormalize
D3DXQuaternionRotationMatrix
D3DXCreateEffectFromFileA
D3DXMatrixRotationZ
D3DXCreateBuffer
D3DXCreateMeshFVF
D3DXCreateSkinInfoFVF
D3DXCreateAnimationController
D3DXCreateKeyframedAnimationSet
D3DXQuaternionSlerp
D3DXCreateCompressedAnimationSet
D3DXQuaternionRotationYawPitchRoll
D3DXMatrixOrthoLH
D3DXMatrixScaling
D3DXMatrixRotationYawPitchRoll
D3DXMatrixTransformation
D3DXIntersect
D3DXBoxBoundProbe
D3DXMatrixDeterminant
D3DXVec3CatmullRom
D3DXPlaneFromPoints
D3DXVec3Transform
D3DXMatrixPerspectiveFovLH
D3DXQuaternionMultiply
D3DXQuaternionRotationAxis
D3DXMatrixInverse
D3DXMatrixRotationQuaternion
D3DXMatrixTranslation
D3DXMatrixLookAtLH
D3DXSaveSurfaceToFileA
D3DXCreateTexture
D3DXCreateSprite
D3DXVec3Normalize
D3DXGetImageInfoFromFileInMemory
D3DXGetImageInfoFromFileA
D3DXCreateTextureFromFileInMemoryEx
D3DXCreateTextureFromFileExA
D3DXMatrixRotationY

d3d9

Direct3DCreate9

winmm

timeGetTime
mmioInstallIOProcA
mmioGetInfo
mmioWrite
mmioOpenA
mmioSeek
mmioDescend
mmioSetInfo
mmioAscend
mmioRead
mmioCreateChunk
mmioClose
mmioAdvance

imm32

ImmGetOpenStatus
ImmGetIMEFileNameA
ImmNotifyIME
ImmAssociateContext
ImmGetCompositionStringA
ImmReleaseContext
ImmSetCompositionStringA
ImmGetContext
ImmGetCandidateListA
ImmSetOpenStatus

ddraw

DirectDrawCreate

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

urlmon

URLDownloadToFileA

wininet

DeleteUrlCacheEntry

kernel32

GetFileAttributesA
HeapReAlloc
FatalAppExitA
GetCPInfo
LCMapStringW
LCMapStringA
RaiseException
RtlUnwind
GetCommandLineA
GetStartupInfoA
GetSystemInfo
HeapSize
GetDateFormatA
GetTimeFormatA
ExitThread
GetSystemDefaultLangID
CreateEventA
CreateThread
SetEvent
GetExitCodeThread
GetCurrentProcess
TerminateProcess
ExitProcess
TlsAlloc
SetLastError
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetTimeZoneInformation
GetOEMCP
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
GetStringTypeW
FlushFileBuffers
UnhandledExceptionFilter
SetHandleCount
CreateFileA
GetFileSize
SetFilePointer
MapViewOfFile
UnmapViewOfFile
WriteFile
GetStdHandle
CreateFileMappingA
GetVersionExA
CloseHandle
lstrcpyA
GetTickCount
IsBadReadPtr
InitializeCriticalSection
LeaveCriticalSection
CreateDirectoryA
GetLastError
EnterCriticalSection
SetFileAttributesA
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
CreateMutexA
GetCurrentDirectoryA
DeleteCriticalSection
GetTempPathA
DeleteFileA
lstrlenA
lstrcpynA
Sleep
lstrcatA
lstrcmpA
FindResourceA
LoadResource
SizeofResource
LockResource
GetFullPathNameA
QueryPerformanceCounter
WideCharToMultiByte
MultiByteToWideChar
QueryPerformanceFrequency
GetWindowsDirectoryA
FileTimeToDosDateTime
FindFirstFileA
FindClose
GetPrivateProfileStringA
WritePrivateProfileStringA
FindNextFileA
FileTimeToLocalFileTime
OutputDebugStringA
VirtualQuery
SetUnhandledExceptionFilter
FormatMessageA
IsBadWritePtr
VirtualProtect
GetLocaleInfoA
GetACP
InterlockedExchange
GetThreadLocale
WaitForSingleObject
SetThreadPriority
ResumeThread
HeapAlloc
HeapFree
GlobalLock
GetProcessHeap
GlobalUnlock
FreeLibrary
GetLocaleInfoW
GetVersionExW
GetSystemDirectoryA
GetProcAddress
LoadLibraryA
CompareStringA
CopyFileA
GlobalAlloc
OpenFile
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
ResetEvent
GetFileType
SetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsBadCodePtr
SetConsoleCtrlHandler
GetCurrentProcessId
GetSystemTimeAsFileTime
SetEndOfFile
CompareStringW
SetEnvironmentVariableA
WaitForMultipleObjects
DebugBreak
OutputDebugStringW
GetDriveTypeA
ReadFile
SetCurrentDirectoryA

user32

wsprintfA
ReleaseDC
GetDC
GetIconInfo
wvsprintfA
MessageBoxA
SetForegroundWindow
CopyRect
OffsetRect
PtInRect
ReleaseCapture
SetCapture
GetFocus
GetKeyState
OpenClipboard
GetClipboardData
GetAsyncKeyState
IsClipboardFormatAvailable
CloseClipboard
GetKeyboardLayout
keybd_event
SetClipboardData
EmptyClipboard
MoveWindow
CallWindowProcA
GetDlgItem
LoadIconA
EnumChildWindows
IsDlgButtonChecked
SetWindowsHookExA
GetForegroundWindow
SetFocus
CallNextHookEx
FillRect
GetCursorPos
LoadAcceleratorsA
SetMenu
ClipCursor
DispatchMessageA
AdjustWindowRect
DestroyMenu
LoadCursorA
RegisterClassA
GetClassLongA
ClientToScreen
GetWindowRect
GetClientRect
SendMessageA
GetKeyboardState
GetDesktopWindow
PostMessageA
UnhookWindowsHookEx
EndDialog
MessageBoxW
UnregisterClassA
TranslateMessage
GetMenu
SetWindowLongA
CheckRadioButton
EnableWindow
DestroyWindow
SetWindowPos
DestroyAcceleratorTable
ScreenToClient
RedrawWindow
PostQuitMessage
GetWindowLongA
CreateWindowExA
PeekMessageA
TranslateAcceleratorA
ShowWindow
DefWindowProcA
SetRect
SetCursor

gdi32

DeleteDC
GetDIBits
GetStockObject
SelectObject
CreateCompatibleDC
GetObjectA
AddFontResourceA
CreateHatchBrush
DeleteObject

advapi32

RegEnumValueA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey

shell32

ShellExecuteA

ole32

CLSIDFromProgID
CoUninitialize
CoCreateInstance
CoInitialize
CoTaskMemAlloc

oleaut32

VarCmp
VariantInit
VariantCopy
VariantClear
SysAllocString
SysFreeString
VariantChangeType

karasx2

KARAS_Initialize

ws2_32

WSACleanup
ntohs
select
ntohl
WSAStartup
ioctlsocket
__WSAFDIsSet
gethostname
getsockopt
listen
inet_addr
accept
WSACloseEvent
getpeername
connect
send
inet_ntoa
gethostbyname
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
htonl
WSAGetLastError
htons
WSAEventSelect
getsockname
shutdown
setsockopt
recv
bind
socket
WSACreateEvent
closesocket

atl71

ord47
ord31
ord42
ord66
ord64
ord61
ord23
ord65

msacm32

acmStreamOpen
acmStreamPrepareHeader
acmStreamConvert
acmFormatSuggest
acmStreamSize
acmStreamUnprepareHeader

libvorbisfile

ov_comment
ov_clear
ov_open_callbacks
ov_pcm_seek
ov_read
ov_info
ov_pcm_total

Exports

Exports

fcEXP

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 673KB - Virtual size: 672KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 4.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

33cfec46e87925d2b81e093fed444f20

Headers

File Characteristics

PDB Paths

Imports

dsound

dinput8

d3dx9_30

d3d9

winmm

imm32

ddraw

version

urlmon

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

karasx2

ws2_32

atl71

msacm32

libvorbisfile

Exports

Exports

Sections

.text Size: 3.3MB - Virtual size: 3.3MB

.rdata Size: 673KB - Virtual size: 672KB

.data Size: 64KB - Virtual size: 4.4MB

.rsrc Size: 20KB - Virtual size: 19KB

.text
Size: 3.3MB - Virtual size: 3.3MB

.rdata
Size: 673KB - Virtual size: 672KB

.data
Size: 64KB - Virtual size: 4.4MB

.rsrc
Size: 20KB - Virtual size: 19KB