e9fe97a2d0d7a63df4d469d98d722db9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e9fe97a2d0d7a63df4d469d98d722db9_JaffaCakes118
Size

3.0MB
MD5

e9fe97a2d0d7a63df4d469d98d722db9
SHA1

6f30900da053cfdcec965445131ebf9c2a41f3d0
SHA256

c6dee2cf2106606392f5471d60f41b1c309e45b96433a41b2a23192b59c41afc
SHA512

d5e3efa9461b334a29436fbaf23f560aae9ec417b7968ac7d2e56b4835b05de74a98a161400b12870ef626076309c2140586450fed4e1e708853a9975b8c30d2
SSDEEP

98304:3JjzAwqX9of3xCh9ZVg1Ebe/1pIR0K3o/5zy6ZgZExR:lfqNoE9ZGqbip7SoB3Z3X

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/cvery.com/crack/eye.exe
unpack001/cvery.com/setup.exe

Files

e9fe97a2d0d7a63df4d469d98d722db9_JaffaCakes118
.rar
cvery.com/crack/eye.exe
.exe windows:4 windows x86 arch:x86

d4005afc9c74883cfdb439adc6505467

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

QueryServiceStatus
AddAce
OpenProcessToken
GetTokenInformation
RegCreateKeyExA
RegSetValueExA
RegConnectRegistryA
OpenSCManagerA
GetServiceKeyNameA
OpenServiceA
CloseServiceHandle
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyA
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
LookupAccountSidA
QueryServiceConfigA
AllocateAndInitializeSid
EqualSid
FreeSid
RegDeleteKeyA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceA
RegDeleteValueA
ControlService
DeleteService
RegCreateKeyA
CreateServiceA
StartServiceCtrlDispatcherA
GetUserNameA
LookupAccountNameA
IsValidSid
AddAccessAllowedAce
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
CopySid
SetSecurityDescriptorDacl
GetAce

comctl32

ImageList_Draw
ImageList_GetImageInfo
_TrackMouseEvent
ImageList_GetIcon
ImageList_Remove
ImageList_LoadImageA
ImageList_BeginDrag
ImageList_Destroy
ImageList_AddMasked
ImageList_Create
ImageList_Add
ImageList_ReplaceIcon
ImageList_GetImageCount

gdi32

SetBkColor
SetTextColor
SetBkMode
DeleteDC
CreateBitmapIndirect
CreateDIBitmap
GetDIBits
Polygon
PtInRegion
CreatePolygonRgn
PtVisible
Polyline
CreateCompatibleBitmap
GetTextMetricsA
CreateRectRgn
CreateBitmap
CreatePatternBrush
GetWindowOrgEx
SetBrushOrgEx
StretchDIBits
PatBlt
FillRgn
OffsetRgn
CombineRgn
CreateRectRgnIndirect
GetStockObject
Ellipse
CreateSolidBrush
CreateFontA
DeleteObject
CreatePen
BitBlt
DPtoLP
GetMapMode
RealizePalette
GetDeviceCaps
CreateCompatibleDC
SelectObject
SelectPalette
GetTextExtentPoint32A
ExtTextOutA
CreateFontIndirectA
GetObjectA

kernel32

GetStartupInfoA
SizeofResource
ResumeThread
CreatePipe
DuplicateHandle
GetFileType
EnumSystemCodePagesA
GetLocaleInfoA
ReadFile
MoveFileA
GetFileSize
SetFilePointer
SetEndOfFile
WriteFile
SetErrorMode
AllocConsole
GetStdHandle
SetConsoleCtrlHandler
FreeConsole
lstrcmpiA
MulDiv
ResetEvent
CreateThread
FlushInstructionCache
GetCurrentProcess
lstrcpynA
FindResourceA
LoadResource
LockResource
FreeResource
GetTempPathA
GetTempFileNameA
CreateFileA
TerminateThread
InterlockedIncrement
SetThreadPriority
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetPrivateProfileIntA
OpenMutexA
CreateMutexA
WritePrivateProfileStringA
GetPrivateProfileStringA
lstrcpyA
LoadLibraryW
lstrlenA
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateEventA
SetEvent
InterlockedDecrement
ExpandEnvironmentStringsA
GetDiskFreeSpaceA
GetTimeFormatA
GetDateFormatA
GetVersion
GetVersionExA
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryExA
FormatMessageA
LocalFree
GetSystemTime
GetCurrentThreadId
EnterCriticalSection
FindFirstFileA
FindNextFileA
FindClose
CreateProcessA
CloseHandle
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
GetFileAttributesA
SetLastError
SystemTimeToFileTime
GetSystemTimeAsFileTime
GlobalFree
GlobalAlloc
GetTickCount
GetModuleHandleA
GetLastError
InterlockedExchange
Sleep
GetComputerNameA
FreeLibrary
LoadLibraryA
GetProcAddress

mfc42

ord5465
ord5194
ord533
ord3996
ord2515
ord355
ord3286
ord3301
ord6907
ord2080
ord3089
ord6880
ord6905
ord859
ord2448
ord5834
ord2044
ord2071
ord3610
ord2582
ord4402
ord3370
ord3640
ord6007
ord3998
ord1229
ord1146
ord6874
ord6282
ord939
ord536
ord6876
ord6197
ord2864
ord2086
ord1942
ord4589
ord4588
ord4899
ord4370
ord4892
ord5076
ord4341
ord4349
ord4890
ord4531
ord4545
ord4543
ord4526
ord4529
ord4524
ord4964
ord4961
ord4108
ord5240
ord3748
ord1726
ord4432
ord384
ord686
ord4272
ord5259
ord4723
ord3287
ord1642
ord6270
ord4220
ord2584
ord3654
ord2438
ord2863
ord1644
ord4507
ord3914
ord6140
ord4000
ord6008
ord4532
ord3399
ord3734
ord303
ord813
ord1228
ord5608
ord2454
ord6389
ord801
ord703
ord403
ord541
ord1907
ord5161
ord5162
ord5160
ord4905
ord4742
ord4976
ord4948
ord4358
ord4377
ord4835
ord809
ord795
ord768
ord556
ord489
ord4258
ord1088
ord2122
ord4854
ord5287
ord3721
ord2826
ord3584
ord543
ord803
ord1099
ord539
ord6493
ord755
ord6172
ord5875
ord470
ord6453
ord4284
ord1816
ord4375
ord4852
ord4229
ord5232
ord5268
ord3356
ord6615
ord1871
ord6571
ord5460
ord882
ord879
ord2801
ord2740
ord6400
ord5856
ord1259
ord4615
ord4612
ord4610
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord4622
ord3738
ord815
ord561
ord4159
ord4160
ord1247
ord2725
ord5715
ord617
ord5214
ord296
ord2558
ord2233
ord2621
ord6215
ord4202
ord810
ord1825
ord4238
ord4696
ord3058
ord3065
ord6336
ord2510
ord5243
ord5740
ord1746
ord5577
ord3172
ord4420
ord4953
ord4387
ord3454
ord3198
ord6080
ord6175
ord4623
ord4426
ord713
ord652
ord414
ord338
ord5859
ord5821
ord3662
ord5604
ord4823
ord4858
ord4083
ord5653
ord5583
ord2540
ord3337
ord603
ord273
ord791
ord523
ord5858
ord2763
ord6141
ord1187
ord2721
ord4614
ord4613
ord1849
ord4244
ord2583
ord4403
ord5253
ord3371
ord3641
ord818
ord2535
ord4508
ord3910
ord2867
ord3754
ord1918
ord2404
ord5341
ord2964
ord2995
ord4882
ord6381
ord2642
ord5062
ord4939
ord4941
ord4630
ord4587
ord4898
ord4369
ord4722
ord4888
ord4107
ord5257
ord3282
ord5828
ord515
ord4261
ord6136
ord6385
ord6010
ord2824
ord4448
ord4671
ord4676
ord1842
ord4242
ord2723
ord2390
ord3059
ord5100
ord4303
ord3350
ord5012
ord975
ord5472
ord3403
ord2879
ord2878
ord4151
ord4077
ord5237
ord5282
ord2649
ord1665
ord4436
ord4427
ord794
ord807
ord796
ord1997
ord527
ord554
ord529
ord366
ord3495
ord2800
ord2455
ord2494
ord2627
ord2626
ord5871
ord6000
ord2117
ord6625
ord4457
ord3571
ord5252
ord5030
ord4287
ord5910
ord6120
ord3481
ord3916
ord2252
ord4413
ord3566
ord2975
ord6146
ord5883
ord955
ord5066
ord3499
ord1908
ord1690
ord2528
ord5288
ord4439
ord2054
ord4431
ord497
ord771
ord4259
ord4715
ord3742
ord2827
ord1265
ord2365
ord2301
ord5802
ord1779
ord6888
ord2463
ord1651
ord4224
ord1008
ord5787
ord3573
ord4205
ord3464
ord3706
ord1945
ord4273
ord560
ord5260
ord1233
ord1126
ord5445
ord1969
ord1989
ord404
ord3752
ord4133
ord4297
ord4023
ord2246
ord2537
ord3517
ord3220
ord4464
ord3497
ord5799
ord6128
ord5768
ord610
ord6139
ord287
ord6458
ord6209
ord816
ord2714
ord5782
ord3021
ord6605
ord562
ord777
ord4317
ord6272
ord3223
ord3221
ord4386
ord1093
ord2593
ord2042
ord3903
ord2405
ord2753
ord1576
ord772
ord500
ord6675
ord5860
ord1994
ord3171
ord775
ord5192
ord503
ord1180
ord1176
ord1568
ord1270
ord3803
ord5981
ord4299
ord3398
ord3733
ord2362
ord2298
ord3097
ord2294
ord3753
ord2822
ord2713
ord1232
ord1153
ord6129
ord2393
ord4125
ord2580
ord3630
ord682
ord6242
ord4243
ord4400
ord2096
ord4476
ord6696
ord6515
ord6442
ord5873
ord283
ord472
ord6743
ord3507
ord2363
ord2571
ord5603
ord3981
ord3708
ord781
ord5937
ord6154
ord4364
ord4056
ord5471
ord4121
ord2389
ord1709
ord5234
ord6369
ord5279
ord2444
ord3583
ord620
ord298
ord6887
ord5248
ord1716
ord5227
ord4230
ord4454
ord4759
ord1949
ord2884
ord5655
ord5852
ord2152
ord5308
ord4779
ord5811
ord5482
ord2032
ord4411
ord4447
ord4335
ord4863
ord4975
ord5797
ord5479
ord1995
ord967
ord3717
ord4919
ord1105
ord925

mpr

WNetCancelConnectionA
WNetAddConnection2A

msvcp60

??1_Winit@std@@QAE@XZ
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@E@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??0Init@ios_base@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1Init@ios_base@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ

msvcrt

_setmbcp
__CxxFrameHandler
free
malloc
memcpy
memset
strlen
_purecall
isspace
isalpha
isalnum
_strnicmp
isdigit
atof
atol
atoi
strcpy
_CxxThrowException
strcmp
_stricmp
sprintf
memmove
time
rand
srand
strchr
strtod
_i64toa
memcmp
memchr
printf
wcslen
mktime
fclose
fputs
fopen
realloc
strpbrk
strncpy
strtol
strstr
sscanf
strncmp
_strdup
_beginthreadex
strcat
_ftol
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
strrchr
strspn
strcspn
vfprintf
_snprintf
abs
iscntrl
_itoa
sqrt
strtoul
setvbuf
_fdopen
_open_osfhandle
_iob
toupper
_strupr
_stricoll
mbstowcs
isprint
strcoll
_mbsnbcpy
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler3
?terminate@@YAXXZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
??0exception@@QAE@ABQBD@Z

msvfw32

DrawDibOpen
DrawDibDraw
DrawDibClose

odbc32

ord15
ord57
ord54
ord4
ord16
ord11
ord9
ord3
ord13
ord7
ord14
ord1
ord2

oleaut32

VariantChangeType
SafeArrayCreate
SysFreeString
VariantClear
SysAllocString
SysAllocStringByteLen
SysStringByteLen
VariantCopy
VariantInit
GetErrorInfo

shell32

SHGetFileInfoA
Shell_NotifyIconA
SHGetDesktopFolder
SHBrowseForFolderA
SHGetPathFromIDListA
DuplicateIcon
ExtractIconA
DoEnvironmentSubstA
SHGetSpecialFolderLocation
SHGetMalloc
ShellExecuteA

user32

PtInRect
GetMessageA
GetSystemMetrics
IsWindowVisible
RegisterWindowMessageA
FindWindowA
SystemParametersInfoA
GetClientRect
SetCursorPos
FrameRect
GetSysColorBrush
SetRect
EqualRect
IntersectRect
UnionRect
IsRectEmpty
SetRectEmpty
OffsetRect
SetMenuDefaultItem
InflateRect
KillTimer
DefWindowProcA
GetCursorPos
SetThreadDesktop
GetUserObjectSecurity
SetUserObjectSecurity
OpenWindowStationA
GetProcessWindowStation
SetProcessWindowStation
OpenDesktopA
CloseDesktop
CloseWindowStation
LoadBitmapA
SetMenuItemBitmaps
GetForegroundWindow
GetMenu
GetSystemMenu
AppendMenuA
DeleteMenu
CreateMenu
GetMenuItemCount
InsertMenuA
LoadImageA
DestroyWindow
CreateWindowExA
RegisterClassA
wsprintfA
SetFocus
IsWindowEnabled
GetFocus
CreatePopupMenu
MessageBeep
ExitWindowsEx
WinHelpA
SetTimer
ReleaseDC
GetDC
GetKeyState
ScreenToClient
PostMessageA
SetForegroundWindow
GetWindowThreadProcessId
PostThreadMessageA
CreateIconIndirect
GetIconInfo
GetWindowDC
FillRect
GetClassInfoA
DrawIconEx
SetWindowPos
GetClassNameA
SetMenuItemInfoA
GetMenuItemInfoA
FindWindowExA
SetWindowTextA
GetWindowTextA
CopyIcon
CallWindowProcA
SetWindowLongA
DrawStateA
DrawEdge
DrawTextA
TranslateMessage
DispatchMessageA
InvalidateRect
DrawFocusRect
GetParent
LoadIconA
DestroyIcon
LoadMenuA
GetSubMenu
IsWindow
SetActiveWindow
LoadCursorA
GetCapture
SetCapture
GetCursor
ChildWindowFromPoint
MapWindowPoints
SetCursor
DestroyCursor
ReleaseCapture
CopyRect
GetSysColor
UpdateWindow
GetDlgItem
GetWindowRect
ClientToScreen
EnableWindow
SendMessageA
CharToOemA
GetMenuStringA
MsgWaitForMultipleObjects
PeekMessageA
GetWindow

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

winmm

sndPlaySoundA

wsock32

__WSAFDIsSet
listen
ntohs
WSAAsyncSelect
getsockname
setsockopt
recvfrom
sendto
gethostbyaddr
ord1111
inet_addr
shutdown
inet_ntoa
select
ioctlsocket
gethostbyname
WSAGetLastError
recv
send
connect
bind
closesocket
socket
htons
htonl
gethostname
ntohl
WSASetLastError

ole32

CoInitialize
OleRun
CoCreateInstance
CoUninitialize

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 192KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 130KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 390KB - Virtual size: 392KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
cvery.com/setup.exe
.exe windows:4 windows x86 arch:x86

678986d7fe8eb1ebce8a0b924f59474d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempPathA
VirtualFree
lstrcpyA
ExitProcess
DeleteFileA
FreeLibrary
GetProcAddress
LoadLibraryA
CloseHandle
WriteFile
lstrlenA
VirtualAlloc
ReadFile
CreateFileA
GetModuleFileNameA
GetLastError
CreateMutexA

user32

SetCursor
LoadCursorA
wsprintfA
MessageBoxA

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 574B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
cvery.com/下载说明.htm
.html .js polyglot
cvery.com/非常世纪资源网.url
.url

Sharing

General

Malware Config

Signatures

Files

d4005afc9c74883cfdb439adc6505467

Headers

File Characteristics

Imports

advapi32

comctl32

gdi32

kernel32

mfc42

mpr

msvcp60

msvcrt

msvfw32

odbc32

oleaut32

shell32

user32

version

winmm

wsock32

ole32

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.data Size: 192KB - Virtual size: 196KB

Size: 130KB - Virtual size: 140KB

.rsrc Size: 390KB - Virtual size: 392KB

.idata Size: 13KB - Virtual size: 16KB

678986d7fe8eb1ebce8a0b924f59474d

Headers

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 512B - Virtual size: 32B

.data Size: 512B - Virtual size: 9KB

.idata Size: 1024B - Virtual size: 574B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 896B

.text
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 192KB - Virtual size: 196KB

.rsrc
Size: 390KB - Virtual size: 392KB

.idata
Size: 13KB - Virtual size: 16KB

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 512B - Virtual size: 32B

.data
Size: 512B - Virtual size: 9KB

.idata
Size: 1024B - Virtual size: 574B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 896B