a1641efad66bef6a5d4234e04032f35b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a1641efad66bef6a5d4234e04032f35b_JaffaCakes118
Size

1.4MB
MD5

a1641efad66bef6a5d4234e04032f35b
SHA1

12f3b811d052ff190d9e19c59670cbe90e29ea87
SHA256

98e1f2f49fb3f4ec6daabbfc2e4c3c6409a1987aa85836f6aaaa264b848dd5cf
SHA512

bc5d923384c60fb956aa5f7d025ef6378532825a6dc8264e5278684a1543f7c62dd00d6d99bc90b130567bc308f138045d61c39d5ac4065808fc740ab35b0083
SSDEEP

24576:BwK+NadNWBMpVPiRKg9o2RexnVUU4g2vednxt5f5m2zncSvSioRei8I:O/QdNyMpBsti0exnVXh/nx/5m2zCio

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a1641efad66bef6a5d4234e04032f35b_JaffaCakes118

Files

a1641efad66bef6a5d4234e04032f35b_JaffaCakes118
.exe windows:5 windows x86 arch:x86

0aedaaac7140024ab7ac568f10811944

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\QQMusic-Git-1770\QQMusicPC\pdbRelease\QQMusic.pdb

Imports

kernel32

CloseHandle
RaiseException
HeapAlloc
DecodePointer
HeapDestroy
GetFileSize
DeleteCriticalSection
GetProcessHeap
SizeofResource
HeapCreate
WritePrivateProfileStringW
SetLastError
GetCurrentProcess
DeviceIoControl
TerminateProcess
GetModuleFileNameW
VirtualUnlock
WaitForSingleObject
GetCurrentThreadId
GetVersionExW
UnmapViewOfFile
SetCurrentDirectoryA
CreateEventW
MultiByteToWideChar
GetPrivateProfileStringW
CreateFileA
SetEvent
LoadLibraryA
WaitForSingleObjectEx
LockResource
ReadFileEx
LoadLibraryW
FindResourceExW
ResetEvent
LoadResource
FindResourceW
HeapReAlloc
GetProcAddress
FreeLibrary
WideCharToMultiByte
SetProcessWorkingSetSize
CreateFileMappingW
MapViewOfFile
GetTickCount
GetCurrentThread
GetModuleHandleW
VirtualProtect
VirtualFree
InterlockedCompareExchange
VirtualAlloc
SuspendThread
ResumeThread
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQuery
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LeaveCriticalSection
EnterCriticalSection
GetLastError
HeapSize
CreateFileW
SetFilePointer
InitializeCriticalSectionAndSpinCount
HeapFree
VirtualLock
ReadFile

user32

PostThreadMessageW
FindWindowW
SendMessageTimeoutW

shell32

SHGetSpecialFolderPathW
ShellExecuteExW

ole32

CoCreateInstance
CoReleaseServerProcess
CoAddRefServerProcess

wintrust

WinVerifyTrust

crypt32

CryptMsgGetParam
CryptQueryObject
CertFreeCertificateContext
CryptMsgClose
CertCreateCertificateContext
CertGetNameStringW
CertCloseStore

msvcp140

?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z

shlwapi

PathCombineW
PathFileExistsW
PathCombineA

vcruntime140

__std_exception_copy
__std_exception_destroy
memset
_except_handler4_common
_local_unwind4
__CxxFrameHandler3
wcsrchr
__std_terminate
memmove
_CxxThrowException
__vcrt_InitializeCriticalSectionEx
memcpy

api-ms-win-crt-runtime-l1-1-0

_beginthreadex
_cexit
_seh_filter_exe
_set_app_type
_register_onexit_function
_configure_wide_argv
_initialize_onexit_table
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
_c_exit
_register_thread_local_exe_atexit_callback
_crt_atexit
_invalid_parameter_noinfo_noreturn
terminate
_controlfp_s
_errno
_invalid_parameter_noinfo
_initialize_wide_environment

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf
_set_fmode
__p__commode
__stdio_common_vswprintf_s

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_callnewh
malloc
free

api-ms-win-crt-string-l1-1-0

_wcsicmp
wmemcpy_s
wcscpy_s
wcsnlen
strcpy_s
_wcsnicmp

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dtc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dtd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 169KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text0
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0aedaaac7140024ab7ac568f10811944

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

ole32

wintrust

crypt32

msvcp140

shlwapi

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 35KB - Virtual size: 35KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 1024B - Virtual size: 1KB

.tls Size: 512B - Virtual size: 9B

.gfids Size: 512B - Virtual size: 88B

.dtc Size: 4KB - Virtual size: 4KB

.dtd Size: 512B - Virtual size: 12B

.rsrc Size: 169KB - Virtual size: 168KB

.reloc Size: 3KB - Virtual size: 3KB

.text0 Size: 1.2MB - Virtual size: 1.2MB

.text
Size: 35KB - Virtual size: 35KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 1024B - Virtual size: 1KB

.tls
Size: 512B - Virtual size: 9B

.gfids
Size: 512B - Virtual size: 88B

.dtc
Size: 4KB - Virtual size: 4KB

.dtd
Size: 512B - Virtual size: 12B

.rsrc
Size: 169KB - Virtual size: 168KB

.reloc
Size: 3KB - Virtual size: 3KB

.text0
Size: 1.2MB - Virtual size: 1.2MB