ad1e6586da26a059db3bbd73bb9f54e8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ad1e6586da26a059db3bbd73bb9f54e8_JaffaCakes118
Size

80KB
MD5

ad1e6586da26a059db3bbd73bb9f54e8
SHA1

2d7c3e6abbde6469712f168d11e623e883c7e41e
SHA256

ecde5563ad59ee31d8b205c6e49bd6040280f42ecb6a06ff3ad67b91f82b6ef5
SHA512

d79205b61a80e6bd63cc463f1b641bad598dae28b6febf888f6a36e0a782c7866e17799dde74a0d1103163459ba850d7b5100b76ba3a25208c53d1847aa9ca29
SSDEEP

768:yEib6cab8/dZsATLhFt1IfoPYX8tO77jjZkiUqYgh3D/eLvgCIITQhBM:KFrNLJ1lYX4Atkjrb1QhBM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad1e6586da26a059db3bbd73bb9f54e8_JaffaCakes118

Files

ad1e6586da26a059db3bbd73bb9f54e8_JaffaCakes118
.dll windows:4 windows x86 arch:x86

ddaffaecd08881f3e47faba09a31d7b3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\업무관련\update_module\03_4개대표\21_박정석대표_김희상대표_서비스1개_20110307\03_김희상대표\Service\release\sorecvc.pdb

Imports

wininet

InternetQueryDataAvailable
InternetOpenA
InternetCloseHandle
InternetReadFile
DeleteUrlCacheEntry
HttpSendRequestA
HttpOpenRequestA
InternetConnectA

urlmon

URLDownloadToFileA

kernel32

GetStringTypeW
GetStringTypeA
LCMapStringW
GetLastError
InterlockedExchange
CompareStringA
CompareStringW
GetVersionExA
MultiByteToWideChar
Sleep
lstrlenA
LoadResource
LockResource
SizeofResource
FindResourceA
FindResourceExA
FreeLibrary
GetProcAddress
LoadLibraryW
LoadLibraryA
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentProcessId
SetEnvironmentVariableA
WideCharToMultiByte
RaiseException
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
GetACP
GetLocaleInfoA
GetThreadLocale
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
FreeEnvironmentStringsW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
VirtualAlloc
GetModuleHandleA
GetTimeZoneInformation
GetLocalTime
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapCreate
VirtualFree
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
LCMapStringA

user32

UnregisterClassA

advapi32

RegQueryValueExA
RegCreateKeyExA
SetServiceStatus
RegCloseKey
RegisterServiceCtrlHandlerExA
StartServiceCtrlDispatcherA
RegSetValueExA

shell32

ShellExecuteA
SHGetSpecialFolderPathA

Exports

Exports

ServiceMain
_HandlerEx@16

Sections

.text
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ddaffaecd08881f3e47faba09a31d7b3

Headers

File Characteristics

PDB Paths

Imports

wininet

urlmon

kernel32

user32

advapi32

shell32

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 46KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 4KB - Virtual size: 176B

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 48KB - Virtual size: 46KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 8KB - Virtual size: 5KB