a191e82ab4f30466fc5306b18e787727_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a191e82ab4f30466fc5306b18e787727_JaffaCakes118
Size

2.9MB
MD5

a191e82ab4f30466fc5306b18e787727
SHA1

5d334a4b178be94ccccb31f902e424db3fdc95c8
SHA256

fdaa1049c41d3d7e133a7cb4b62c1f01e984b69b814a0e9a3f10dc24c1055343
SHA512

fc0ba5fcb977d2dc404596d7d43241a04e2013ef71b7c75cd806bee85fad7ad319f52c62f74eba8f7f7b6ec0d138f6f4ab03b0dbe4a5eb7f6fa6f0a0fd37d9c8
SSDEEP

49152:ulUicqrzRAJRdmflHmVjBz+kLFoi42ZOVD:uWicqhIKa1tGD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a191e82ab4f30466fc5306b18e787727_JaffaCakes118

Files

a191e82ab4f30466fc5306b18e787727_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f4cee640dad28d64ac6f28d98d1a7798

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\SVN\networkService\CDN\FullSystem\CommonDownloadSetup_China\release\CayenneBB.pdb

Imports

ws2_32

bind
htons
setsockopt
WSAEventSelect
WSACreateEvent
WSAGetLastError
WSASocketW
__WSAFDIsSet
connect
closesocket
WSACloseEvent
WSAStartup
WSACleanup
listen
accept
getsockopt
select
ntohs
gethostname
gethostbyname
inet_ntoa
htonl
inet_addr
ntohl
socket
ioctlsocket
recv
send

iphlpapi

GetAdaptersInfo
GetIpNetTable

kernel32

FileTimeToSystemTime
FileTimeToLocalFileTime
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
SetErrorMode
GlobalFlags
InterlockedIncrement
GetThreadLocale
FlushFileBuffers
GetFullPathNameW
GetModuleHandleA
GetProcessHeap
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
ExitThread
HeapReAlloc
HeapSize
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
VirtualFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
VirtualAlloc
GetCurrentDirectoryA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetDriveTypeA
SetEnvironmentVariableA
GlobalFindAtomW
CompareStringW
LoadLibraryA
GlobalUnlock
FreeResource
lstrlenW
WritePrivateProfileStringW
GlobalAddAtomW
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
GlobalLock
lstrcmpW
ReadDirectoryChangesW
RaiseException
GetModuleFileNameA
CreateFileA
IsProcessorFeaturePresent
GetModuleHandleW
GetSystemInfo
lstrcmpiW
GlobalMemoryStatus
FindFirstFileW
FindNextFileW
FindClose
SetLastError
GetDriveTypeW
GetFileTime
SetFileTime
MoveFileExW
GetVersionExA
GetCurrentProcess
GlobalMemoryStatusEx
SetFilePointerEx
SetEndOfFile
GetFileSizeEx
GetCurrentThreadId
GlobalAlloc
GlobalFree
LocalAlloc
ResetEvent
CreateNamedPipeW
ExitProcess
GetExitCodeProcess
TerminateProcess
OpenMutexW
GetCurrentProcessId
OpenEventW
GetFileSize
SetFilePointer
ReadFile
CreateProcessW
GetVolumeInformationW
GetLocalTime
GetModuleFileNameW
GetVersionExW
LoadLibraryW
GetProcAddress
FreeLibrary
lstrlenA
InterlockedDecrement
Module32FirstW
Module32NextW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
QueryPerformanceFrequency
QueryPerformanceCounter
MoveFileW
CreateFileW
WriteFile
DeleteFileW
LocalFree
CreateMutexW
ReleaseMutex
CreateThread
CreateEventW
CloseHandle
SetEvent
WaitForSingleObject
TerminateThread
SuspendThread
SetThreadPriority
GetLastError
ResumeThread
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
HeapAlloc
HeapDestroy
HeapFree
HeapCreate
MulDiv
CreateDirectoryW
MultiByteToWideChar
GetDiskFreeSpaceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetTickCount
Sleep
WideCharToMultiByte
GetVersion
FormatMessageW

user32

LoadCursorW
GetSysColorBrush
UnregisterClassW
MoveWindow
SetWindowTextW
IsDialogMessageW
DestroyMenu
EndPaint
BeginPaint
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
GetCapture
GetClassNameW
SetPropW
GetPropW
RemovePropW
SetFocus
GetWindowTextLengthW
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
GetMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
ScreenToClient
GetDlgCtrlID
SystemParametersInfoA
GetWindowPlacement
GetWindow
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamW
GetDlgItem
GetNextDlgTabItem
EndDialog
GetLastActivePopup
IsWindowEnabled
SetWindowsHookExW
CallNextHookEx
GetMessageW
GetActiveWindow
GetCursorPos
PostQuitMessage
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
GetFocus
ModifyMenuW
GetMenuState
CheckMenuItem
RegisterWindowMessageW
EnumWindows
GetWindowThreadProcessId
GetWindowTextW
AttachThreadInput
GetForegroundWindow
ShowWindow
SetForegroundWindow
SetWindowPos
ReleaseDC
EnableMenuItem
GetKeyState
RegisterClassExW
CreateWindowExW
DestroyWindow
DefWindowProcW
IsWindowVisible
PeekMessageW
TranslateMessage
DispatchMessageW
LoadImageW
InflateRect
CallWindowProcW
MessageBoxW
IsWindow
SetWindowLongW
GetWindowLongW
PtInRect
GetDC
CopyRect
InvalidateRect
RedrawWindow
GetSysColor
GetParent
SetCursor
UpdateWindow
LoadIconW
GetClassLongW
SetClassLongW
GetClientRect
GetSystemMetrics
AppendMenuW
SendMessageW
IsIconic
wsprintfW
EnableWindow
KillTimer
GetWindowRect
GetSystemMenu
PostMessageW
LoadBitmapW
SetTimer
DrawIcon
UnregisterClassA
ValidateRect

gdi32

SetWindowExtEx
ScaleWindowExtEx
ScaleViewportExtEx
OffsetViewportOrgEx
SetViewportExtEx
IntersectClipRect
SetViewportOrgEx
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
SelectClipRgn
SaveDC
GetClipBox
SetTextColor
SetBkMode
GetDIBits
Rectangle
RoundRect
CreatePen
GetTextExtentPoint32W
CreateRectRgn
SetBkColor
SetMapMode
CreateCompatibleBitmap
CreateBitmap
DPtoLP
SelectObject
GetDeviceCaps
DeleteDC
DeleteObject
CreateFontIndirectW
CreateSolidBrush
GetStockObject
BitBlt
StretchBlt
GetObjectW
CreateCompatibleDC
RestoreDC

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

advapi32

ConvertSidToStringSidW
RegQueryValueW
RegOpenKeyW
QueryServiceConfigW
DeleteService
ControlService
CreateServiceW
QueryServiceStatus
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
StartServiceW
CloseServiceHandle
LookupAccountNameW
RegEnumValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
RegConnectRegistryW
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExA
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegEnumKeyW

shell32

SHGetSpecialFolderPathW
ShellExecuteW

comctl32

InitCommonControlsEx

shlwapi

PathIsDirectoryW
PathFileExistsW
PathFindExtensionW
PathFindFileNameW
StrFormatByteSizeW
PathStripToRootW

version

GetFileVersionInfoW
VerQueryValueW

ole32

OleRun
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
CoUninitialize
CoInitializeEx
CoInitialize

oleaut32

SysFreeString
VariantChangeType
SysStringLen
VariantInit
VariantClear
SysAllocString
SysAllocStringLen
GetErrorInfo

Sections

.text
Size: 992KB - Virtual size: 989KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 224KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.3MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 432KB - Virtual size: 430KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f4cee640dad28d64ac6f28d98d1a7798

Headers

File Characteristics

PDB Paths

Imports

ws2_32

iphlpapi

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

version

ole32

oleaut32

Sections

.text Size: 992KB - Virtual size: 989KB

.rdata Size: 224KB - Virtual size: 222KB

.data Size: 1.3MB - Virtual size: 2.4MB

.rsrc Size: 432KB - Virtual size: 430KB

.text
Size: 992KB - Virtual size: 989KB

.rdata
Size: 224KB - Virtual size: 222KB

.data
Size: 1.3MB - Virtual size: 2.4MB

.rsrc
Size: 432KB - Virtual size: 430KB