fce5cea4992efb502872b96817bd47d9_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

fce5cea4992efb502872b96817bd47d9_JaffaCakes118
Size

44KB
MD5

fce5cea4992efb502872b96817bd47d9
SHA1

f45a46f71f17de32c46f2cc4e88592c8b7c4e445
SHA256

18c0a2a2856a3c328fc5dd72a34dcc1823772e856b8b343012fda9e529230237
SHA512

335a650e5747928f77dbc19575ed61cf8d957d8fe5d262c8d9200cf9637378ae036c66fd07cb03d96da4f96d1d09598078c309d8c23f9ef965b74637d889a71f
SSDEEP

768:ZftPNRpChZDdSi232fDoXg0qZC3I9PlhNl+0Z2wWP9ZoE:xWi4b+gF6I9Plrl5ulZr

Score

1^/10

Malware Config

Signatures

Files

fce5cea4992efb502872b96817bd47d9_JaffaCakes118
.dll windows:4 windows x86 arch:x86

baf4dc805cbc959c585ba1669e184fca

Code Sign

11:f3:af:c3:27:d0:1e:a0:4b:6d:03:1a:ce:d9:5c:a2
Certificate

Issuer

CN=Root Agency

Not Before

08-12-2009 07:34

Not After

31-12-2039 23:59

Subject

CN=Microsofft 模块

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
lstrcatA
InterlockedIncrement
GetCurrentThreadId
InitializeCriticalSection
HeapDestroy
LoadLibraryA
InterlockedDecrement
FlushInstructionCache
GetCurrentProcess
DebugBreak
OutputDebugStringA
lstrlenW
GetProcAddress
FreeLibrary
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
MultiByteToWideChar
lstrlenA
DisableThreadLibraryCalls
DeleteCriticalSection
Sleep

user32

wsprintfA
CharNextA
DestroyWindow
DefWindowProcA
RegisterClassExA
LoadCursorA
GetClassInfoExA
IsChild
GetFocus
ReleaseDC
GetDC
CharLowerA
CallWindowProcA
GetWindowLongA
CreateWindowExA
EndPaint
GetClientRect
BeginPaint
SetWindowLongA
wvsprintfA
PostMessageA
LoadStringA

advapi32

RegCloseKey
RegCreateKeyExA
RegSetValueExA

ole32

StringFromIID
CoGetMalloc
CoCreateInstance

oleaut32

RegisterTypeLi
LoadTypeLi
SysAllocString
LoadRegTypeLi
SysStringLen
DispCallFunc
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayAccessData
VariantCopy
VariantClear
SafeArrayGetDim
SafeArrayGetElemsize
SysFreeString

gdi32

RestoreDC
SetViewportOrgEx
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
GetDeviceCaps
CreateDCA
DeleteDC

msvcrt

memmove
_adjust_fdiv
malloc
_initterm
_onexit
__dllonexit
atoi
_ismbcdigit
wcslen
_mbsicmp
_mbsstr
free
_purecall
memcmp
??2@YAPAXI@Z
memset
memcpy
__CxxFrameHandler
strlen
strcpy
fopen
strstr
strncpy
strftime
localtime
time
strchr
fclose
??3@YAXPAX@Z

Exports

Exports

AHtJthIpVrVAiXt
BAFGcoVdopgifOb
BHJeVpEXJQqFGXA
BVEnYsaTdWNoAlh
DVHdZshGZYPbWDK
DiNZfQOgbQLWbgs
DllCanUnloadNow
DllGetClassObject
DllSSS
DllUnregisterServer
EjKorlMGQKWmRDo
EkaEAKHgVjEjDae
FDhhkMUTbBVGfIt
FPfhNQPpKYbhIdn
FbpCtMcBbSrVUEt
FfQiEYVlPiGXAJK
FgEEjDbFWJRWanG
FpGRCrFafVmTLQg
GVChWcOBQjOrIDM
GchDqXAKHRnhLAP
GhjbEUPQSDgmLWe
GsrlZiiZrllcdXZ
HBFJLLBBKIXeAdG
HOXehSZtNIBaaVE
HhBmnMGkKiJLsIB
HiQNTSeIATIKlaD
HqUefqegMgtIXEm
HrXlUKCRjWWtJkQ
IBTCkTIbULkbTPS
IEPhVDokZ_6
IFaIXThrKalHVmQ
IJSOddpWTJoLlpT
IOsPSEIeLYiYhVh
IOtTDXgQRWSOJUS
IarGXCcgdlihhpF
IhSNMKEfrMDLbrG
JoIreQcWhffNYrZ
KfCnnBUncqNYaUr
KqARUNPZXjTTTmE
LRGMnIBAVcLTqgf
LZdsfCalXKprabF
LhfmCiUGB_4
MXteljdlO_m
MbRNkHOnmYPOVGe
MjkNgBMgbkLlKCa
MjtfeEDPfSdnimM
MmNQiHdCmZnPNso
MpXrUOGDZ_n
NDhsVLmlW_e
NNqIHVZEHJOPJAn
NUlQpkDrcCVOVnD
OrhXorHMnKUGrXb
OtAbHcFqApMLZNb
PGFKXFXIULJkjnt
PpDPMeCSt_k
QCBYeIXPAKLmIOC
QXILUqrHlaMkSYP
QhGDgCPVekgBRCV
QmRXRMfZBLTNBIE
RCQWBagFYLWmMaO
RDnNjWKSkftsDJL
RJGWahnLPbZTbFD
RXFOJcAUXWCZrcK
SANFJjNjWPgFLeM
TVDoJQcKQ_l
UWidLSKFtdeblWE
UbVcYkRKA_7
UjXHkIsSOUONqth
UkRBDGlmN_i
UrjElKEMC_c
WOPdpXJnjrJRYCA
WclLNHPRUlAnUgO
WdlEDFeYrgjZYaB
WgqYrRBgBhGqNMR
XcLUcjBlrcqDopH
YqaogiGniGQPZDg
YraCLkTkFmcZlKE
ZHgQTTXDaJrBFeK
ZQnYREefApaCdmb
ZkJJDOsMhYkHtrt
aafnWcKZsOOAEEj
adtYZfFMjVXWdKB
arVUOKGOMoLZKOi
cWhmmgmibIqDHDq
cYTWOLEWhLCUNhg
cnIeDQQOrOgSAaS
ctoGRmfHU_8
dIaZUCOkXbOlhef
eFKCpDPeK_2
eaqefYgSgbJqcFB
ejaWfggXL_a
elCtZokAqNYDDrt
eoAikkHssIcEJcl
fDPUSIIClKkhHre
fSkClCtkr_3
fqQntGRlYSEWBNp
gIrqtJYYToqDjnn
gNhoZUKNfeceWSo
ghYQsbNHPGtAHMh
gpXNpQdCUEhIdcP
hioAYoPsQjGlUsg
hmLhfbSLSJCbMBY
iCSJkdlgiedgdtj
iQRlocjZrFSmkQt
isXKSMQGTTgjMNU
itdlereRHJbghXp
jMrbOHHtr_j
kImQqTPqFQanNYW
kQkeFgCBB_d
kWrYdECFb_9
kiSKeQrpOXiVMWY
lZEEGZbsYBhcCVe
mKXUtRRmMGkRmfJ
mLsFtSsABeCqPAr
mfKdILFbBWlrenZ
mgdbXMntJ_b
nfanLPPYHREJAQP
oAtdfDLVGbpCUEF
oCXXeWHYQNOVDZi
oFPBccKSK_5
oaRcLbVSSUmVafG
ofWaqeCVDLFRckJ
pQQniHGRpGHPGLp
qFXUWCYbQsdShan
rVBcjMcIVNOGVaG
rZidrnJDkFIMUTr
raFneNDeqeUJFqh
rcAgKpjMD_1
rcoOtHAgeYpnDeQ
rctNYdibh_h
sBJbFsCBe_g
sLmNkSLDW_f
tKkNOhBJXDEVjJQ
tUtPssVomLUOkPG

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

baf4dc805cbc959c585ba1669e184fca

Code Sign

11:f3:af:c3:27:d0:1e:a0:4b:6d:03:1a:ce:d9:5c:a2Certificate

Signer

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

gdi32

msvcrt

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 18KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 2KB

11:f3:af:c3:27:d0:1e:a0:4b:6d:03:1a:ce:d9:5c:a2
Certificate

.text
Size: 20KB - Virtual size: 18KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 2KB