f011c5de27d9f4c88565f06fd540bfa4_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

f011c5de27d9f4c88565f06fd540bfa4_JaffaCakes118
Size

472KB
MD5

f011c5de27d9f4c88565f06fd540bfa4
SHA1

8c74c04f8f2d1639bc5adc551585c5f46af12554
SHA256

c3ba8388144a511183302c4a2f274baa55fa5f203f95b6980b111d82ca56d1cd
SHA512

34fc3812d23c568b6e731b6402afdb38583b20089bdb516029d7b5d7a668612a315fe0d2bd37fdf10ddf977030a4d05da223e4d94207b9edda40a0c09979009d
SSDEEP

12288:E1s6f9ZobxQrXoZWBgReoizwtUlW6svUx:8PobirXAWBgRe3wtUlWdMx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f011c5de27d9f4c88565f06fd540bfa4_JaffaCakes118

Files

f011c5de27d9f4c88565f06fd540bfa4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b67abd55bf24c2534eddb7c2649bb9bf

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\Visual Studio Projects\CVS\thunder6\BHO_ADV\FLVPlayer\Release\FLVPlayer.pdb

Imports

kernel32

FindResourceA
lstrcpynA
GetCurrentThreadId
IsDBCSLeadByte
InterlockedIncrement
SetEvent
InterlockedDecrement
SetLastError
FreeLibrary
SizeofResource
LoadResource
LoadLibraryExA
GetModuleHandleA
GetModuleFileNameA
LockResource
ExitProcess
lstrcatA
MulDiv
GlobalUnlock
GlobalLock
lstrcmpA
GlobalFree
GlobalHandle
lstrcpyA
LocalFree
LCMapStringW
LCMapStringA
lstrcmpiA
GetStringTypeW
GetStringTypeA
GetCPInfo
GetOEMCP
IsBadCodePtr
IsBadReadPtr
LoadLibraryA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
WriteFile
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
SetUnhandledExceptionFilter
HeapSize
TerminateProcess
GetProcAddress
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetCommandLineA
GetStartupInfoA
HeapReAlloc
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
RtlUnwind
lstrlenA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedExchange
GetCurrentProcess
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
GetLastError
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
GlobalAlloc
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP

user32

EndDialog
DestroyWindow
PostThreadMessageA
DefWindowProcA
CharNextA
GetWindowLongA
SetWindowLongA
UnregisterClassA
PostMessageA
LoadBitmapA
GetSysColor
GetActiveWindow
MapDialogRect
SetWindowContextHelpId
DialogBoxIndirectParamA
RegisterWindowMessageA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
GetClassInfoExA
LoadCursorA
wsprintfA
RegisterClassExA
CreateWindowExA
CreateAcceleratorTableA
GetParent
GetClassNameA
SetWindowPos
RedrawWindow
DestroyAcceleratorTable
IsWindow
SetFocus
GetFocus
IsChild
GetWindow
BeginPaint
EndPaint
CallWindowProcA
GetDesktopWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
FillRect
SetCapture
ReleaseCapture
SendMessageA
MessageBoxA
GetDlgItem
GetWindowRect
GetClientRect
MoveWindow
SendDlgItemMessageA

gdi32

GetObjectA
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
DeleteObject
CreateSolidBrush
GetStockObject
SelectObject

comdlg32

GetOpenFileNameA

advapi32

RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyA
RegQueryValueExA

shell32

ShellExecuteA

ole32

OleInitialize
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
CreateStreamOnHGlobal
OleLockRunning
OleUninitialize
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2

oleaut32

SysFreeString
SysAllocString
SysStringLen
VarUI4FromStr
SysAllocStringByteLen
GetErrorInfo
VarBstrCat
LoadTypeLi
LoadRegTypeLi
VariantInit
VariantClear
OleCreateFontIndirect
SysStringByteLen
SysAllocStringLen

shlwapi

PathRemoveFileSpecA
PathCombineA
PathFileExistsA

Sections

.text
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 128KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

`.=
Size: 240KB - Virtual size: 240KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b67abd55bf24c2534eddb7c2649bb9bf

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

Sections

.text Size: 80KB - Virtual size: 78KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 128KB - Virtual size: 124KB

`.= Size: 240KB - Virtual size: 240KB

.text
Size: 80KB - Virtual size: 78KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 128KB - Virtual size: 124KB

`.=
Size: 240KB - Virtual size: 240KB