f5f14a8ee526556b5b1f4107a51a1168_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

f5f14a8ee526556b5b1f4107a51a1168_JaffaCakes118
Size

1.7MB
MD5

f5f14a8ee526556b5b1f4107a51a1168
SHA1

9a39dafb1bdb795bf4b4e052c52dd9c91e08d7b3
SHA256

b9ef6e5afda3a799e7b878f993f43878263e82d17119450bc13831191c5fb2de
SHA512

fb113596a8aa73d6fc49d4cf30cc4597f4c5f4e98d5471fa5eaf90797acb924cbb050fc0c2b5ba1db0f86250dde96de30c50e4f04321d2508fa3ac62cf08909b
SSDEEP

49152:/r0AzokKrZh3VwZcX7G+F5vrJXN4hi9LNT:9KrZLHG+BXqhiL

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/小飞机挂机/dll/qq.dll
unpack001/小飞机挂机/fei.dll
unpack001/小飞机挂机/飞起来吧.exe

Files

f5f14a8ee526556b5b1f4107a51a1168_JaffaCakes118
.rar
小飞机挂机/config.ini
小飞机挂机/dll/0.net
小飞机挂机/dll/1.net
小飞机挂机/dll/2.net
小飞机挂机/dll/3.net
小飞机挂机/dll/4.net
小飞机挂机/dll/5.net
小飞机挂机/dll/qq.dll
.dll windows:5 windows x86 arch:x86

ef1fc5f35601d466d98c3e3cb90802ed

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\Project\Captcha\Doc\100809\100809_QQ_Src&Demo\QQ\Src\CaptchaSolution\qq.pdb

Imports

kernel32

TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
RtlUnwind
RaiseException
HeapReAlloc
HeapSize
ExitProcess
HeapCreate
HeapDestroy
VirtualFree
GetStdHandle
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
GetACP
IsValidCodePage
LCMapStringA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
GetLocaleInfoW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
VirtualAlloc
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
GetOEMCP
GetCPInfo
GetLocaleInfoA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
GetVersionExA
GlobalFlags
GetFileTime
GetFileSizeEx
GetFileAttributesA
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcmpA
GlobalGetAtomNameA
GetCurrentProcessId
InterlockedIncrement
GetModuleHandleW
CompareStringA
SetErrorMode
GetCurrentThreadId
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
FreeLibrary
InterlockedDecrement
GetModuleFileNameW
GetProcAddress
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
LoadLibraryA
SetLastError
FormatMessageA
LocalFree
GlobalUnlock
LockResource
SizeofResource
LoadResource
FindResourceA
GetLastError
WideCharToMultiByte
InterlockedExchange
MultiByteToWideChar
lstrlenA
LeaveCriticalSection
EnterCriticalSection
GlobalLock
GlobalFree
GlobalAlloc
Sleep
CreateFileA
GetModuleFileNameA
GetModuleHandleA
LCMapStringW
CloseHandle

user32

SetForegroundWindow
GetClientRect
PostMessageA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
DefWindowProcA
CallWindowProcA
GetMenu
SystemParametersInfoA
IsIconic
GetWindowPlacement
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
CopyRect
GetWindowRect
GetClassNameA
PtInRect
GetFocus
SetWindowPos
SetWindowLongA
GetDlgCtrlID
IsWindow
SetWindowTextA
GetWindow
GetWindowTextA
GetWindowThreadProcessId
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxA
LoadCursorA
GetSysColorBrush
UnregisterClassA
SetWindowsHookExA
CallNextHookEx
DispatchMessageA
SendMessageA
GetKeyState
PeekMessageA
ValidateRect
UnhookWindowsHookEx
GetSysColor
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
CharUpperA
GetSystemMetrics
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetDlgItem
PostQuitMessage
DestroyMenu
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu

gdi32

SaveDC
RestoreDC
SetBkColor
SetTextColor
SetMapMode
GetClipBox
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SetViewportOrgEx
OffsetViewportOrgEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
CreateBitmap
GetStockObject
GetDeviceCaps
SelectObject
DeleteObject
SetViewportExtEx
DeleteDC

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

shlwapi

PathIsUNCA
PathFindFileNameA
PathFindExtensionA
PathStripToRootA

ole32

CreateStreamOnHGlobal

oleaut32

VariantChangeType
VariantClear
VariantInit

gdiplus

GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromStream
GdiplusShutdown
GdipFree
GdipAlloc
GdipDisposeImage
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight

Exports

Exports

rate
recognize

Sections

.text
Size: 206KB - Virtual size: 206KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
小飞机挂机/fei.dll
.dll windows:4 windows x86 arch:x86

9797f0bc8bd5fa13ea39daaec6ee04fa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpy
FindFirstFileA

version

VerQueryValueA

psapi

GetModuleInformation

iphlpapi

GetAdaptersInfo

user32

DestroyMenu

gdi32

ScaleViewportExtEx

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA

advapi32

RegEnumKeyA

comctl32

ord17

shlwapi

PathFindExtensionA

oleaut32

VariantChangeType

Exports

Exports

A6F86D2D67D9403eA725820C4EF210A2
A6F92A92B69B4082AB0F9C7A9C1FF10C
CheckRuntime
EC1DB9C1620C48588C4701045B242FA9
GetCpuID
GetCpuIDW
GetDiskID
GetDiskIDW
GetMacID
GetMacIDW
GetModuleBase
MainDLL
_CorExeMain

Sections

.text
Size: 112KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 648KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 468KB - Virtual size: 468KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
小飞机挂机/更新18W文本.txt
小飞机挂机/飞起来吧.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ef1fc5f35601d466d98c3e3cb90802ed

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

shlwapi

ole32

oleaut32

gdiplus

Exports

Exports

Sections

.text Size: 206KB - Virtual size: 206KB

.rdata Size: 45KB - Virtual size: 45KB

.data Size: 10KB - Virtual size: 25KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 31KB - Virtual size: 31KB

9797f0bc8bd5fa13ea39daaec6ee04fa

Headers

File Characteristics

Imports

kernel32

version

psapi

iphlpapi

user32

gdi32

comdlg32

winspool.drv

advapi32

comctl32

shlwapi

oleaut32

Exports

Exports

Sections

.text Size: 112KB - Virtual size: 248KB

.rsrc Size: 20KB - Virtual size: 17KB

.idata Size: 4KB - Virtual size: 4KB

.data Size: 4KB - Virtual size: 648KB

.data Size: 468KB - Virtual size: 468KB

.data Size: 4KB - Virtual size: 4KB

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 160KB - Virtual size: 160KB

.rsrc Size: 16KB - Virtual size: 16KB

.reloc Size: 88KB - Virtual size: 88KB

.text
Size: 206KB - Virtual size: 206KB

.rdata
Size: 45KB - Virtual size: 45KB

.data
Size: 10KB - Virtual size: 25KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 31KB - Virtual size: 31KB

.text
Size: 112KB - Virtual size: 248KB

.rsrc
Size: 20KB - Virtual size: 17KB

.idata
Size: 4KB - Virtual size: 4KB

.data
Size: 4KB - Virtual size: 648KB

.data
Size: 468KB - Virtual size: 468KB

.data
Size: 4KB - Virtual size: 4KB

.text
Size: 160KB - Virtual size: 160KB

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 88KB - Virtual size: 88KB