a912ff803c698517ad426599d23146c3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a912ff803c698517ad426599d23146c3_JaffaCakes118
Size

505KB
MD5

a912ff803c698517ad426599d23146c3
SHA1

9d7b580f922d223a6c5353b1b76b414baf8a5b31
SHA256

69a3b879f6207f536e2526607c9e4875237237bb4afbd28382faf020efe24a08
SHA512

5c1bf8e304d1c2c5d2750db074671df7eecbe8706f0e93817ea54f9e8a8731cebb00ed9adafea4f95932bfd714497fdfb6fd1fe7397d901730a44650e4357d01
SSDEEP

12288:u5u70Kzw/SexZpqX+a7PfkO2ARxPxgUkUt:u8QTZpqXLjjRxPfkUt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/QQMsgEx.TK.exe

Files

a912ff803c698517ad426599d23146c3_JaffaCakes118
.rar
QQMsgEx.TK.exe
.exe windows:4 windows x86 arch:x86

722dd71bb7c3456f42b751a7e2a27281

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAEnumNetworkEvents
WSAEventSelect
WSARecv
WSASend
closesocket
send
connect
WSAWaitForMultipleEvents
socket
recv
WSACleanup
WSAStartup
htons
gethostbyname
ntohl
WSACreateEvent
WSACloseEvent
setsockopt

kernel32

LocalAlloc
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
GetFileSize
DuplicateHandle
GetCurrentProcess
GetVolumeInformationW
GetFullPathNameW
GetFileTime
GetTickCount
SetErrorMode
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoW
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetDriveTypeW
GetConsoleCP
GetThreadLocale
RtlUnwind
GetFileType
GetDriveTypeA
CreateFileA
GetFullPathNameA
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
VirtualProtect
VirtualAlloc
VirtualQuery
ExitProcess
HeapSize
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCPInfo
GetACP
GetOEMCP
SetStdHandle
GetCurrentDirectoryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetEnvironmentVariableA
GlobalFlags
FileTimeToLocalFileTime
FileTimeToSystemTime
WritePrivateProfileStringW
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
GetCurrentProcessId
GetModuleHandleA
RaiseException
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LoadLibraryA
GetModuleHandleW
GetProcAddress
GetVersionExA
GlobalAlloc
FormatMessageW
LocalFree
MulDiv
GlobalLock
GlobalUnlock
GlobalFree
FreeResource
LockFile
LockFileEx
UnlockFile
GetSystemInfo
FindFirstFileW
FindNextFileW
FindClose
ResetEvent
SignalObjectAndWait
ReleaseMutex
CreateMutexW
GetSystemTime
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
GetEnvironmentVariableW
GetTempPathW
FlushFileBuffers
GetFileInformationByHandle
GetDiskFreeSpaceW
WriteFile
ReadFile
SetFilePointer
SetEndOfFile
CreateFileW
GetFileAttributesW
MoveFileW
MoveFileExW
DeleteFileW
GetCurrentThreadId
GetVersionExW
GetVersion
FormatMessageA
SetLastError
PulseEvent
InterlockedExchange
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
GetSystemDirectoryW
GetModuleFileNameA
MultiByteToWideChar
lstrlenA
GetLastError
WideCharToMultiByte
lstrcmpW
lstrlenW
WaitForSingleObject
CreateEventW
SetEvent
FreeLibrary
LoadLibraryW
GetWindowsDirectoryW
Sleep
CreateThread
CloseHandle
FindResourceW
LoadResource
LockResource
SizeofResource
GetConsoleMode

user32

UnregisterClassW
RegisterClipboardFormatW
PostThreadMessageW
TranslateMessage
ValidateRect
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
GetWindowThreadProcessId
GetCursorPos
WindowFromPoint
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
UnregisterClassA
GetPropW
RemovePropW
GetForegroundWindow
GetLastActivePopup
DispatchMessageW
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
GetKeyState
SetForegroundWindow
IsWindowVisible
GetMenu
PostMessageW
MessageBoxW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
ScreenToClient
EqualRect
CopyRect
DefWindowProcW
CallWindowProcW
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetWindowTextLengthW
GetWindowTextW
GetFocus
SetWindowPos
SetFocus
ShowWindow
MoveWindow
GetDlgCtrlID
SetWindowTextW
IsDialogMessageW
SendDlgItemMessageW
GetWindow
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetWindowLongW
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
RegisterWindowMessageW
GetNextDlgGroupItem
CharUpperW
CharNextW
InvalidateRgn
SetRect
IsRectEmpty
CopyAcceleratorTableW
DestroyMenu
GetSysColorBrush
GetMessageW
DrawIcon
GetSystemMetrics
IsIconic
LoadIconW
CopyIcon
LoadCursorW
InflateRect
ReleaseDC
GetDC
GetParent
GetWindowRect
InvalidateRect
IsWindow
SetWindowLongW
SetCursor
SetCapture
RedrawWindow
ReleaseCapture
PtInRect
GetClientRect
MessageBeep
GetSysColor
UpdateWindow
SendMessageW
EnableWindow
OffsetRect
SetPropW

gdi32

SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreateRectRgnIndirect
ScaleViewportExtEx
GetRgnBox
GetBkColor
GetTextColor
GetMapMode
GetWindowExtEx
GetViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
GetTextExtentPoint32W
CreateFontIndirectW
GetObjectW
TextOutW
PtVisible
GetStockObject
DeleteObject
SetMapMode
SetBkMode
RestoreDC
SaveDC
CreateBitmap
RectVisible

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegQueryValueW

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteW

comctl32

InitCommonControlsEx

shlwapi

PathIsDirectoryW
StrStrIA
PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathFileExistsW
PathIsUNCW

oledlg

OleUIBusyW

ole32

StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CLSIDFromString
CLSIDFromProgID
CoFreeUnusedLibraries
StgIsStorageFile
StgOpenStorage
CoTaskMemFree
CoGetClassObject
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize
CoTaskMemAlloc
OleUninitialize

oleaut32

SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
SafeArrayCreate
SafeArrayGetElemsize
SafeArrayAccessData
SafeArrayUnaccessData
LoadRegTypeLi
DispCallFunc
SysAllocString
VariantCopy
VariantInit
VariantChangeType
VariantClear
SysAllocStringLen
OleCreateFontIndirect
SysFreeString

wsock32

ioctlsocket
bind
listen
accept
htonl
WSASetLastError
inet_ntoa
ntohs
gethostname
WSAGetLastError

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 960KB - Virtual size: 959KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 148KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
新云软件.url
.url

Sharing

General

Malware Config

Signatures

Files

722dd71bb7c3456f42b751a7e2a27281

Headers

File Characteristics

Imports

ws2_32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

wsock32

iphlpapi

Sections

.text Size: 960KB - Virtual size: 959KB

.rdata Size: 148KB - Virtual size: 145KB

.data Size: 16KB - Virtual size: 28KB

.rsrc Size: 24KB - Virtual size: 22KB

.text
Size: 960KB - Virtual size: 959KB

.rdata
Size: 148KB - Virtual size: 145KB

.data
Size: 16KB - Virtual size: 28KB

.rsrc
Size: 24KB - Virtual size: 22KB