d20e785093e45c565505bf152d1ea6d2_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

d20e785093e45c565505bf152d1ea6d2_JaffaCakes118
Size

476KB
MD5

d20e785093e45c565505bf152d1ea6d2
SHA1

784d6cef665fc712078e909215367800ef15da84
SHA256

7a99071acc3efb8fcf9f0f3d2b5bd09793b1725c16a91928d87946173bb5f524
SHA512

59c54f81bb537effbfa4a2ccc71b2b5d61b80bfbeeb5548858f536ea4f32171d985f57f7c587cee5e5c87c12479a14c4ff50c0ed55d8ebd31697f2fc334fd89a
SSDEEP

12288:xeiHKdXlgCw118JKM3rW5Y/OYgG03prBfwGUewaI:XioaKM3rWi/OYgGkBoFaI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d20e785093e45c565505bf152d1ea6d2_JaffaCakes118

Files

d20e785093e45c565505bf152d1ea6d2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

be252bbfed0f98a11840a00e5b047722

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHDeleteKeyW
PathRemoveArgsW
PathUnquoteSpacesW
PathQuoteSpacesW
PathRemoveFileSpecW
SHDeleteValueW
PathRemoveBlanksW
PathAppendW

wininet

InternetOpenUrlW
InternetGetConnectedState
InternetOpenW
InternetQueryDataAvailable
HttpQueryInfoW
InternetCloseHandle
InternetReadFile

pcscm

?GetNextPhoneManufacturer@CPCSL2InfoReader@@QAEPBGXZ
??0CNBitmapUtil@@QAE@XZ
?PcsLoadColor@@YAKPAUHINSTANCE__@@I@Z
?GetBitmapHandle@CNBitmapUtil@@QAEPAUHBITMAP__@@W4BitmapType@@H@Z
?GetFirstPhoneManufacturer@CPCSL2InfoReader@@QAEPBGXZ
??1CPCSL2InfoReader@@QAE@XZ
?MirrorSection@CNBitmapUtil@@QAEHW4BitmapType@@HHHHHHH@Z
?DeleteBitmap@CNBitmapUtil@@QAEPAUHBITMAP__@@W4BitmapType@@H@Z
??1CNBitmapUtil@@QAE@XZ
?GetBitmapHeight@CNBitmapUtil@@QAEHW4BitmapType@@@Z
?AlphaBlendBitmapsBGPos@CNBitmapUtil@@QAEHHHHHH@Z
?LoadBitmapFromRes@CNBitmapUtil@@IAEPAUHBITMAP__@@PAUHINSTANCE__@@HW4BitmapType@@H@Z
?CreateBitmapFromHandle@CNBitmapUtil@@QAEHPAUHBITMAP__@@W4BitmapType@@H@Z
?BitmapToRegion@CNBitmapUtil@@QAEPAUHRGN__@@W4BitmapType@@HKK@Z
?GetBitmapWidth@CNBitmapUtil@@QAEHW4BitmapType@@@Z
?PcsInitializeWER@@YAHXZ
??0CRTLHelper@@QAE@PBG@Z
?IsRTL@CRTLHelper@@QAEHXZ
??1CRTLHelper@@UAE@XZ
?GetNumberOfPhoneManufacturers@CPCSL2InfoReader@@QAEHXZ
?ReadPCSL@CPCSL2InfoReader@@QAEHPAG@Z
??0CPCSL2InfoReader@@QAE@XZ
?GetUIManufacturer@CPCSL2InfoReader@@QAEPBGXZ
??1CCommonAboutDlg@@UAE@XZ
?DoModal@CCommonAboutDlg@@QAEHXZ
?SetAboutBoxParams@CCommonAboutDlg@@QAEHPAUtagABOUTBOXPARAMS@@@Z
??0CCommonAboutDlg@@QAE@XZ
??1CNMessageBoxDlg@@QAE@XZ
?FreeMemory@CNMessageBoxDlg@@SAXXZ
?MessageBoxW@CNMessageBoxDlg@@QAEHPAUHWND__@@PBG1I@Z
?SetStaticMembers@CNMessageBoxDlg@@SAHPAUHINSTANCE__@@0HHHHHHHHHHHHHHHHHHHH@Z
??0CNMessageBoxDlg@@QAE@XZ
?NLoadBitmap@CNBitmapUtil@@QAEPAUHBITMAP__@@PAUHINSTANCE__@@HW4BitmapType@@H@Z

pcssupportsetup

Install

msi

ord205
ord70

wintrust

WinVerifyTrust

kernel32

InterlockedExchange
LocalFree
GetModuleHandleA
GetStartupInfoW
ExitProcess
RaiseException
InitializeCriticalSection
DeleteCriticalSection
HeapFree
GetProcessHeap
lstrlenW
InterlockedDecrement
CreateProcessW
GetModuleHandleW
TerminateThread
WaitForSingleObject
SetEvent
CloseHandle
WaitForMultipleObjects
CreateEventW
CreateThread
FlushInstructionCache
GetCurrentProcess
HeapAlloc
InterlockedIncrement
DebugBreak
OutputDebugStringW
lstrlenA
WideCharToMultiByte
GetProcAddress
LoadLibraryW
lstrcpyW
FindClose
FindNextFileW
FindFirstFileW
GetVersionExW
EnterCriticalSection
LeaveCriticalSection
GlobalLock
GlobalAlloc
GlobalFree
GlobalUnlock
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
GetCurrentThreadId
GetVersionExA
GetACP
GetLocaleInfoA
GetThreadLocale
GetShortPathNameW
UnmapViewOfFile
ReleaseMutex
OpenMutexW
MapViewOfFile
GetLastError
CreateFileMappingW
OpenFileMappingW
CreateMutexW
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
lstrcmpiW
lstrcpynW
DeleteFileW
CompareFileTime
SystemTimeToFileTime
GetTempPathW
GetTempPathA
GetLocalTime
WriteFile
CreateFileW
Sleep
CompareStringW
GetLongPathNameW
LoadLibraryA
ExitThread
ResetEvent
CreateEventA
OpenEventA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime

user32

FindWindowW
GetWindowThreadProcessId
SetWindowRgn
SetCapture
SetActiveWindow
SetLayeredWindowAttributes
InflateRect
KillTimer
SetTimer
IsWindowVisible
CopyRect
GetCursorPos
PtInRect
GetLastActivePopup
IsIconic
SetForegroundWindow
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
RegisterWindowMessageW
SetProcessDefaultLayout
LoadIconW
PostQuitMessage
RegisterClipboardFormatW
RegisterClassExW
MessageBoxW
GetClassInfoExW
wsprintfW
SetDlgItemTextW
IsDlgButtonChecked
CharNextW
wvsprintfW
SetRect
DestroyWindow
UpdateWindow
FillRect
GetDesktopWindow
GetDC
ReleaseDC
SetFocus
CallWindowProcW
GetMessagePos
DefWindowProcW
ShowWindow
InvalidateRect
ScreenToClient
LoadCursorW
SetCursor
DrawTextW
EndPaint
BeginPaint
UnregisterClassW
LoadStringW
SetWindowLongW
GetWindow
GetWindowRect
SystemParametersInfoW
MapWindowPoints
SetWindowPos
GetDlgItem
GetParent
GetClientRect
SetWindowTextW
PostMessageW
GetWindowLongW
SendMessageW
EndDialog
ReleaseCapture
GetKeyState
DrawIconEx
DialogBoxParamW
GetActiveWindow
MonitorFromWindow
EnableMenuItem
GetSubMenu
CheckMenuItem
DeleteMenu
GetMenuItemCount
DestroyMenu
GetMenuStringW
RemoveMenu
GetSysColor
UnhookWindowsHookEx
InsertMenuW
CallNextHookEx
TrackPopupMenu
SetWindowsHookExW
LoadMenuW
SetRectEmpty
OffsetRect
EnableWindow
IsWindow
DrawFocusRect
IsRectEmpty
RegisterClassW
DrawTextExW
DestroyIcon
MoveWindow
CreateWindowExW

gdi32

GetDeviceCaps
GetLayout
GetStretchBltMode
SetBrushOrgEx
GetBkMode
GetRgnBox
OffsetRgn
GetTextExtentPoint32W
SetStretchBltMode
SelectClipRgn
MoveToEx
TextOutW
CreatePen
LineTo
SetBkColor
ExtTextOutW
ExtCreateRegion
CombineRgn
GetDIBits
SetDIBits
PtInRegion
CreateCompatibleBitmap
BitBlt
CreateFontIndirectW
SetTextColor
CreateCompatibleDC
SetBkMode
GetObjectW
SelectObject
StretchBlt
GetStockObject
DeleteDC
DeleteObject
CreateSolidBrush
SetLayout
CreateRectRgn

advapi32

RegDeleteValueW
RegEnumValueW
RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegSetValueExW
RegOpenKeyExW

shell32

SHGetFolderPathW
ord680
ShellExecuteExW
SHChangeNotify
Shell_NotifyIconW
SHGetSpecialFolderPathW
ShellExecuteW
SHGetDesktopFolder

ole32

CoTaskMemRealloc
CLSIDFromString
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoCreateInstance
CoUninitialize
ReleaseStgMedium
DoDragDrop
OleRun
CLSIDFromProgID

oleaut32

GetErrorInfo
VariantClear
VariantCopy
VariantInit
VariantTimeToSystemTime
SystemTimeToVariantTime
VarUI4FromStr
SysAllocStringLen
SysFreeString
SysAllocString
SysStringLen

comctl32

InitCommonControlsEx
_TrackMouseEvent

msvcp71

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
?_Nomemory@std@@YAXXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

msvcr71

??3@YAXPAX@Z
__CxxFrameHandler
_except_handler3
??_V@YAXPAX@Z
??1exception@@UAE@XZ
??0exception@@QAE@XZ
wcscspn
malloc
_vsnwprintf
fclose
fread
ftell
fseek
_wfopen
iswspace
_wtof
_wtol
_wcsnicoll
wcschr
wcsncat
ceil
wcsncpy
memset
_callnewh
??1type_info@@UAE@XZ
__dllonexit
_onexit
?terminate@@YAXXZ
_c_exit
_exit
_XcptFilter
_cexit
exit
_wcmdln
_amsg_exit
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
__security_error_handler
_controlfp
free
??0exception@@QAE@ABV0@@Z
_CxxThrowException
memmove
wcsstr
_wcsicmp
_itow
isspace
_wtoi
wcscmp
iswdigit
wcslen
_wcsdup
wcscpy
wcsrchr
wcscat
realloc
_wcsupr
_purecall

urlmon

CopyStgMedium

Sections

.text
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

fnnqwwa
Size: 31KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pfxapng
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 153KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

be252bbfed0f98a11840a00e5b047722

Headers

File Characteristics

Imports

shlwapi

wininet

pcscm

pcssupportsetup

msi

wintrust

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

msvcp71

msvcr71

urlmon

Sections

.text Size: 208KB - Virtual size: 207KB

.rdata Size: 35KB - Virtual size: 35KB

.data Size: 1KB - Virtual size: 3KB

.rsrc Size: 46KB - Virtual size: 47KB

fnnqwwa Size: 31KB - Virtual size: 32KB

pfxapng Size: - Virtual size: 4KB

.text Size: 153KB - Virtual size: 156KB

.text
Size: 208KB - Virtual size: 207KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 1KB - Virtual size: 3KB

.rsrc
Size: 46KB - Virtual size: 47KB

fnnqwwa
Size: 31KB - Virtual size: 32KB

pfxapng
Size: - Virtual size: 4KB

.text
Size: 153KB - Virtual size: 156KB