beeada55701e69e832af4444788de7d4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

beeada55701e69e832af4444788de7d4_JaffaCakes118
Size

531KB
MD5

beeada55701e69e832af4444788de7d4
SHA1

ecae14b664e617aed867bd21bab8921b743a40a5
SHA256

cced78eff472f56fb84fd6be4565dc1a1ea255af2b909efaaa084ef55a3c1ed1
SHA512

da9a0933b61c3a7bbee8154c0306651028232f524658f59b39ee9d1511603615075485faa0c906ccb8d3747d87526711bad9c10ebd6ebd52a19aefc693d6fd83
SSDEEP

12288:uiB/1Qi8PtTmcijX5L8PJHP+XNzGIIC8RQq8L2uPtEMryXanaI:JB8PIbr5smdiIIC8RlacMaI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ETSetup.exe

Files

beeada55701e69e832af4444788de7d4_JaffaCakes118
.rar
ETSetup.exe
.exe windows:5 windows x86 arch:x86

bde5686b40c5a336bbb398b532986608

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

s:\DeskSoft\Internal\Components\Setup\Release\Setup.pdb

Imports

shlwapi

PathIsRelativeA
PathIsNetworkPathA
SHDeleteKeyA

kernel32

ReadFile
CopyFileA
SetFilePointer
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
CreateDirectoryA
GetSystemDirectoryA
GetWindowsDirectoryA
OpenProcess
GetCurrentProcess
GetDiskFreeSpaceA
ResumeThread
SetPriorityClass
GetCurrentThread
SetThreadPriority
lstrlenA
GetTempPathA
MultiByteToWideChar
GetVersionExA
GetModuleFileNameA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
RaiseException
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
CreateFileA
GetStringTypeA
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetStdHandle
HeapReAlloc
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
VirtualFree
HeapCreate
HeapSize
LCMapStringW
WideCharToMultiByte
LCMapStringA
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetFileSize
CreateFileMappingA
MapViewOfFile
WriteFile
UnmapViewOfFile
TerminateProcess
CreateProcessA
GetExitCodeProcess
CloseHandle
GetModuleHandleA
GetProcAddress
RemoveDirectoryA
FindFirstFileA
DeleteFileA
Sleep
FindNextFileA
FindClose
GetFileAttributesA
FindResourceA
LoadResource
LockResource
SizeofResource
FlushFileBuffers
GetStringTypeW
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoA
GetCommandLineA
ExitProcess
GetModuleHandleW
GetSystemTimeAsFileTime
RtlUnwind
GetLastError
HeapFree
HeapAlloc
ExitThread
CreateThread

user32

DialogBoxParamA
SystemParametersInfoA
EnumWindows
GetClassNameA
ExitWindowsEx
FindWindowExA
GetWindowThreadProcessId
PostMessageA
LoadIconA
SetClassLongA
CreateDialogParamA
EnableWindow
SetDlgItemTextA
ShowWindow
EndDialog
SendDlgItemMessageA
LoadStringA
SetForegroundWindow
MessageBoxA
EnumChildWindows
SetWindowTextA
PeekMessageA
DispatchMessageA
TranslateMessage
SendMessageA
GetDlgItemTextA
GetDC
ReleaseDC
MoveWindow
CreateIconFromResource
GetFocus
DrawFocusRect
InvalidateRect
SetFocus
GetDlgItem
GetClientRect
MapWindowPoints
CreateWindowExA
SetWindowLongA
GetWindowTextA
RegisterClassA
GetWindowLongA
BeginPaint
FillRect
DrawTextA
DrawIconEx
EndPaint
DefWindowProcA
LookupIconIdFromDirectoryEx
CreateIconFromResourceEx
DestroyWindow

gdi32

CreateFontA
CreateFontIndirectA
SetBkMode
SetTextColor
GetStockObject
SelectObject
DeleteObject

advapi32

GetUserNameA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
ImpersonateLoggedOnUser
RevertToSelf
RegEnumValueA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
ControlService
RegDeleteValueA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey

shell32

SHGetSpecialFolderLocation
SHChangeNotify
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetMalloc
ShellExecuteA
ord680

ole32

CoCreateInstance
CoInitialize
CoUninitialize

Sections

.text
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Readme.txt
新云软件.url
.url

Sharing

General

Malware Config

Signatures

Files

bde5686b40c5a336bbb398b532986608

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

kernel32

user32

gdi32

advapi32

shell32

ole32

Sections

.text Size: 95KB - Virtual size: 95KB

.rdata Size: 17KB - Virtual size: 17KB

.data Size: 7KB - Virtual size: 24KB

.rsrc Size: 61KB - Virtual size: 60KB

.text
Size: 95KB - Virtual size: 95KB

.rdata
Size: 17KB - Virtual size: 17KB

.data
Size: 7KB - Virtual size: 24KB

.rsrc
Size: 61KB - Virtual size: 60KB