aff90d79ff2db0c0e1866f7e68d8ded2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

aff90d79ff2db0c0e1866f7e68d8ded2_JaffaCakes118
Size

264KB
MD5

aff90d79ff2db0c0e1866f7e68d8ded2
SHA1

6f5a4b8b8148f5134c3bfa10db69d6a2fc04dc5e
SHA256

f0ccce3f0c0a9aa28a691ed4056db778e907bc71d8bf02e205d86c59be4194f6
SHA512

994ffbe6d4a2ee7d4a2d260760647e6d413f0757c818ea5a17aa7d6e5fe40c362719818bf9b34f37e7be73048758d816b1601c72fedce321080f4554e5001cd1
SSDEEP

6144:homKB3UBfU/fmpgVp14fOfm/CodHqETdI2CL/yS:8qBM3Lxfm/pHqyG2CLqS

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/JkDefrag.exe
unpack001/JkDefragCmd.exe
unpack001/JkDefragScreenSaver.exe
unpack001/JkDefragScreenSaver.scr

Files

aff90d79ff2db0c0e1866f7e68d8ded2_JaffaCakes118
.rar
JkDefrag.exe
.exe windows:5 windows x86 arch:x86

ead96d400dfee134a61c6cea43fb45d3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

EndPaint
GetMessageA
SetTimer
RegisterClassExA
PostQuitMessage
FillRect
LoadIconA
GetClientRect
BeginPaint
GetDC
TranslateMessage
InvalidateRect
ReleaseDC
DefWindowProcA
ShowWindow
CreateWindowExW
DispatchMessageA
MessageBoxW
LoadCursorA

gdi32

MoveToEx
GetTextExtentPoint32W
LineTo
SetTextColor
CreateFontA
SetBkColor
SetBkMode
DeleteObject
SelectObject
SetDCPenColor
TextOutW
GetStockObject
CreateSolidBrush

shell32

CommandLineToArgvW

advapi32

RegCreateKeyExW
RegQueryValueExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

kernel32

GetLocaleInfoA
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
HeapSize
GetStringTypeW
GetStringTypeA
SetEndOfFile
GetProcessHeap
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
LocalFileTimeToFileTime
GetCommandLineW
Process32First
WaitForSingleObject
SetThreadExecutionState
GetModuleFileNameW
GetLastError
GetLongPathNameW
Process32Next
CreateMutexA
CreateToolhelp32Snapshot
GetShortPathNameW
ReleaseMutex
GetVersionExA
CloseHandle
GetCurrentProcessId
CreateThread
FormatMessageW
Sleep
CreateFileW
DeviceIoControl
GetFileInformationByHandle
FlushFileBuffers
FindClose
FindNextFileW
FindFirstFileW
SystemTimeToFileTime
GetSystemTime
GetFileAttributesExW
GetSystemTimeAsFileTime
GetDiskFreeSpaceExW
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
GetCurrentProcess
FindVolumeMountPointClose
FindNextVolumeMountPointW
FindFirstVolumeMountPointW
GetVolumeInformationW
GetDriveTypeW
GetLogicalDriveStringsW
ReadFile
DosDateTimeToFileTime
DeleteFileW
GetTimeZoneInformation
GetModuleHandleW
GetProcAddress
ExitProcess
HeapReAlloc
HeapAlloc
HeapFree
GetCommandLineA
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
WideCharToMultiByte
WriteFile
GetConsoleCP
GetConsoleMode
DeleteCriticalSection
GetStdHandle
GetModuleFileNameA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapCreate
VirtualFree
VirtualAlloc
GetModuleHandleA
MultiByteToWideChar
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
LCMapStringA
LCMapStringW

Exports

Exports

AddArrayString
CallShowStatus
ColorizeItem
DeleteItemTree
FragmentCount
GetItemLcn
GetLongPath
GetShortPath
IsFragmented
MatchMask
RunJkDefrag
ShowDiskmap
ShowHex
SlowDown
StopJkDefrag
SystemErrorStr
TreeBiggest
TreeDetach
TreeFirst
TreeInsert
TreeNext
TreeNextPrev
TreePrev
TreeSmallest
stristr
stristrW

Sections

.text
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 599KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
JkDefragCmd.exe
.exe windows:5 windows x86 arch:x86

d72dfec31d076dd1c2c13dc92af6e6f5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
AdjustTokenPrivileges

kernel32

CloseHandle
Process32Next
Process32First
GetCurrentProcessId
GetLastError
CreateToolhelp32Snapshot
GetVersionExA
SetConsoleCtrlHandler
GetModuleFileNameW
FormatMessageW
Sleep
CreateFileW
DeviceIoControl
GetFileInformationByHandle
FlushFileBuffers
FindClose
FindNextFileW
FindFirstFileW
SystemTimeToFileTime
GetSystemTime
GetFileAttributesExW
GetSystemTimeAsFileTime
GetDiskFreeSpaceExW
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
GetCurrentProcess
FindVolumeMountPointClose
FindNextVolumeMountPointW
FindFirstVolumeMountPointW
GetVolumeInformationW
GetDriveTypeW
GetLogicalDriveStringsW
ReadFile
LocalFileTimeToFileTime
DosDateTimeToFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteFileW
HeapReAlloc
HeapAlloc
GetTimeZoneInformation
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WideCharToMultiByte
WriteFile
GetConsoleCP
GetConsoleMode
DeleteCriticalSection
RtlUnwind
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleHandleW
GetProcAddress
ExitProcess
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetModuleHandleA
HeapCreate
VirtualFree
VirtualAlloc
GetModuleFileNameA
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
QueryPerformanceCounter
GetTickCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
InitializeCriticalSectionAndSpinCount
LoadLibraryA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
CreateFileA
SetEndOfFile
GetProcessHeap
HeapSize
CompareStringA
CompareStringW
SetEnvironmentVariableA

Exports

Exports

AddArrayString
CallShowStatus
ColorizeItem
DeleteItemTree
FragmentCount
GetItemLcn
GetLongPath
GetShortPath
IsFragmented
MatchMask
RunJkDefrag
ShowDiskmap
ShowHex
SlowDown
StopJkDefrag
SystemErrorStr
TreeBiggest
TreeDetach
TreeFirst
TreeInsert
TreeNext
TreeNextPrev
TreePrev
TreeSmallest
stristr
stristrW

Sections

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
JkDefragScreenSaver.exe
.exe windows:5 windows x86 arch:x86

105af1cbf212f8054524a559bfb28966

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CharNextA
LoadIconA
GetSystemMetrics
FindWindowA
SetForegroundWindow
RegisterWindowMessageA
RegisterClassA
CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
GetForegroundWindow
PeekMessageA
SendMessageA
DialogBoxParamA
GetParent
IsWindow
PostMessageA
DefWindowProcA
SetCursor
PostQuitMessage
GetCursorPos
SystemParametersInfoA
SetTimer
FillRect
GetClientRect
GetWindowTextLengthA
GetDC
ReleaseDC
GetDlgItem
EndDialog
LoadStringW
SendMessageW

gdi32

TextOutW
GetClipBox
MoveToEx
LineTo
SetTextColor
CreateFontA
SetBkColor
SetBkMode
DeleteObject
SelectObject
SetDCPenColor
GetStockObject
CreateSolidBrush

shell32

CommandLineToArgvW

advapi32

LookupPrivilegeValueA
RegOpenKeyExA
RegQueryValueExA
OpenProcessToken
RegCreateKeyExW
AdjustTokenPrivileges
RegSetValueExW
RegCloseKey
RegQueryValueExW

comctl32

InitCommonControlsEx

powrprof

CallNtPowerInformation

kernel32

LCMapStringW
LCMapStringA
VirtualQuery
QueryPerformanceCounter
GetStringTypeA
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
HeapSize
GetLocaleInfoA
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetEnvironmentStrings
FreeEnvironmentStringsA
SetEndOfFile
GetProcessHeap
CreateFileA
GetExitCodeProcess
CreateProcessW
GetFileAttributesW
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetFileType
GetVolumePathNameW
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
FindFirstFileW
FreeLibrary
Process32First
WaitForSingleObject
SetThreadExecutionState
LoadLibraryW
Sleep
GetModuleFileNameW
GetLastError
GetLongPathNameW
FindClose
Process32Next
CreateMutexA
FindNextFileW
CreateToolhelp32Snapshot
GetShortPathNameW
ReleaseMutex
GetVersionExA
CloseHandle
GetCurrentProcessId
CreateThread
FormatMessageW
CreateFileW
DeviceIoControl
GetFileInformationByHandle
FlushFileBuffers
SystemTimeToFileTime
GetSystemTime
GetFileAttributesExW
GetSystemTimeAsFileTime
GetDiskFreeSpaceExW
GetVolumeNameForVolumeMountPointW
GetCurrentProcess
FindVolumeMountPointClose
FindNextVolumeMountPointW
FindFirstVolumeMountPointW
GetVolumeInformationW
GetDriveTypeW
GetLogicalDriveStringsW
ReadFile
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetProcAddress
GetModuleHandleA
LoadLibraryA
GetTickCount
GetSystemPowerStatus
UnhandledExceptionFilter
ExitProcess
GetStartupInfoA
GetCommandLineA
HeapFree
HeapAlloc
DeleteFileW
GetTimeZoneInformation
GetModuleHandleW
HeapReAlloc
TerminateProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
WriteFile
GetStdHandle
GetModuleFileNameA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode

Exports

Exports

AddArrayString
CallShowStatus
ColorizeItem
DeleteItemTree
FragmentCount
GetItemLcn
GetLongPath
GetShortPath
IsFragmented
MatchMask
RunJkDefrag
ShowDiskmap
ShowHex
SlowDown
StopJkDefrag
SystemErrorStr
TreeBiggest
TreeDetach
TreeFirst
TreeInsert
TreeNext
TreeNextPrev
TreePrev
TreeSmallest
stristr
stristrW

Sections

.text
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 600KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
JkDefragScreenSaver.scr
.exe windows:5 windows x86 arch:x86

12801de287126a6b34e2da85cbbe86b5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

CommandLineToArgvW

advapi32

RegCloseKey
RegCreateKeyExW
RegQueryValueExW

kernel32

FreeEnvironmentStringsA
GetCommandLineW
GetModuleFileNameW
GetLongPathNameW
GetShortPathNameW
HeapAlloc
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetLastError
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapFree
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
RtlUnwind
LoadLibraryA
GetExitCodeProcess
WaitForSingleObject
CloseHandle
CreateProcessW
GetFileAttributesW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
CreateFileA
FlushFileBuffers
CompareStringW
SetEnvironmentVariableA
SetEnvironmentVariableW

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
doc/License gpl.txt
doc/License lgpl.txt
doc/history.txt
doc/images/Bar.gif
.gif
doc/images/Bar01.gif
.gif
doc/images/Bar02.gif
.gif
doc/images/Bullit.gif
.gif
doc/images/Snapshot.gif
.gif
doc/images/gnu-head-sm.jpg
.jpg
doc/images/logo.gif
.gif
doc/index.html
.html
doc/新云软件.url
.url

Sharing

General

Malware Config

Signatures

Files

ead96d400dfee134a61c6cea43fb45d3

Headers

DLL Characteristics

File Characteristics

Imports

user32

gdi32

shell32

advapi32

kernel32

Exports

Exports

Sections

.text Size: 133KB - Virtual size: 133KB

.rdata Size: 37KB - Virtual size: 36KB

.data Size: 5KB - Virtual size: 599KB

.rsrc Size: 40KB - Virtual size: 39KB

d72dfec31d076dd1c2c13dc92af6e6f5

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

Exports

Exports

Sections

.text Size: 129KB - Virtual size: 129KB

.rdata Size: 35KB - Virtual size: 35KB

.data Size: 11KB - Virtual size: 19KB

.rsrc Size: 40KB - Virtual size: 39KB

105af1cbf212f8054524a559bfb28966

Headers

DLL Characteristics

File Characteristics

Imports

user32

gdi32

shell32

advapi32

comctl32

powrprof

kernel32

Exports

Exports

Sections

.text Size: 147KB - Virtual size: 147KB

.rdata Size: 40KB - Virtual size: 39KB

.data Size: 5KB - Virtual size: 600KB

.rsrc Size: 39KB - Virtual size: 38KB

12801de287126a6b34e2da85cbbe86b5

Headers

DLL Characteristics

File Characteristics

Imports

shell32

advapi32

kernel32

Sections

.text Size: 43KB - Virtual size: 43KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 10KB

.rsrc Size: 39KB - Virtual size: 38KB

.text
Size: 133KB - Virtual size: 133KB

.rdata
Size: 37KB - Virtual size: 36KB

.data
Size: 5KB - Virtual size: 599KB

.rsrc
Size: 40KB - Virtual size: 39KB

.text
Size: 129KB - Virtual size: 129KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 11KB - Virtual size: 19KB

.rsrc
Size: 40KB - Virtual size: 39KB

.text
Size: 147KB - Virtual size: 147KB

.rdata
Size: 40KB - Virtual size: 39KB

.data
Size: 5KB - Virtual size: 600KB

.rsrc
Size: 39KB - Virtual size: 38KB

.text
Size: 43KB - Virtual size: 43KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 10KB

.rsrc
Size: 39KB - Virtual size: 38KB