010d997cea9109376c90f8b34ea5f9f4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

010d997cea9109376c90f8b34ea5f9f4_JaffaCakes118
Size

2.5MB
MD5

010d997cea9109376c90f8b34ea5f9f4
SHA1

065925a583841e0f24b3edd2709bd6afc741bd07
SHA256

26be15ebba88f97ed9c94cf0ca897a8c9dae179af0e8de4dfd417e6b97c3cdb9
SHA512

ee8b1a787f30af6d1f7b5fc45de4e82898e85332700bedcbafdebd2cdfdb37a9a59458de2254cea62c0f06032010f43ead4906b41144be6f0399527082714838
SSDEEP

49152:dIAXKPRh6IsN2IKbUMqurZqsCaoVVd7CJaPGYdtdwCJeE1x/kS:d+Rh67NZKbUMqIHovF4Ydtdwke

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
010d997cea9109376c90f8b34ea5f9f4_JaffaCakes118

Files

010d997cea9109376c90f8b34ea5f9f4_JaffaCakes118
.exe windows:5 windows x86 arch:x86

5c79e9f7ee99ebe293c16b9e34ed8151

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\去秀网络\VS\剑姬下载器\JJDownLoader\Bin\JJDownLoader_a.pdb

Imports

kernel32

FlushConsoleInputBuffer
SetConsoleMode
DeleteCriticalSection
DecodePointer
GlobalMemoryStatus
ReadConsoleInputA
RaiseException
SetFilePointer
FindNextFileW
GetDiskFreeSpaceExW
GetDriveTypeW
GetLogicalDriveStringsW
FreeLibrary
LoadLibraryW
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
GetTempPathW
ReadFile
CreateProcessW
GetStartupInfoW
Sleep
WriteFile
CreateFileW
FindClose
FindFirstFileW
FreeResource
SetCurrentDirectoryW
WideCharToMultiByte
GetSystemInfo
GetModuleHandleW
GetProcAddress
GetComputerNameW
GetSystemDirectoryW
WritePrivateProfileStringW
GetTickCount
CreateDirectoryW
GetLocalTime
CloseHandle
GetPrivateProfileStringW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentProcessId
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetModuleFileNameW
GetLastError
MultiByteToWideChar
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetSystemTime
HeapDestroy
SetEndOfFile
GetFileAttributesExW
WriteConsoleW
SetConsoleCtrlHandler
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
FlushFileBuffers
SetStdHandle
GetFullPathNameW
EnumSystemLocalesW
GetUserDefaultLCID
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
GetACP
GlobalLock
GlobalUnlock
lstrlenW
GetCurrentDirectoryW
ExitProcess
MulDiv
GetFileSize
LocalFree
FormatMessageW
VerSetConditionMask
GetCurrentProcess
GetFileType
SetFileTime
DuplicateHandle
SystemTimeToFileTime
DosDateTimeToFileTime
GlobalAlloc
InterlockedIncrement
InterlockedDecrement
lstrcpyW
InitializeCriticalSection
SleepEx
ExpandEnvironmentStringsA
WaitForMultipleObjects
GetStdHandle
PeekNamedPipe
SetLastError
FormatMessageA
LoadLibraryA
GetModuleHandleA
GetSystemDirectoryA
VerifyVersionInfoA
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetConsoleCP
GetStringTypeW
GetTimeZoneInformation
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale

user32

ShowWindow
SetCursor
InflateRect
UnionRect
OffsetRect
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
DefWindowProcW
PostQuitMessage
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
IsWindow
SetWindowPos
SetFocus
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
KillTimer
GetWindowRect
GetWindowLongW
SetWindowLongW
GetParent
GetWindow
LoadImageW
MonitorFromWindow
GetMonitorInfoW
DestroyWindow
IsWindowVisible
IsZoomed
CharNextW
GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetCursorPos
CreateCaret
GetCaretBlinkTime
SetCaretPos
GetClientRect
MapWindowPoints
GetSysColor
IntersectRect
IsRectEmpty
PtInRect
SetWindowRgn
LoadIconW
ScreenToClient
MoveWindow
GetWindowRgn
CharPrevW
DrawTextW
FillRect
SetRect
CreatePopupMenu
DestroyMenu
EnableMenuItem
AppendMenuW
TrackPopupMenu
HideCaret
ShowCaret
GetCaretPos
ClientToScreen
IsWindowEnabled
GetWindowTextLengthW
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
SetForegroundWindow
GetKeyboardLayout
GetKeyNameTextW
MapVirtualKeyExW
BringWindowToTop
SetTimer
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetWindowTextW
FindWindowW
IsIconic
PostMessageW
UpdateLayeredWindow
MessageBoxW
GetDC
SetWindowTextW
wsprintfW

gdi32

SetWindowOrgEx
CreateRoundRectRgn
CreateRectRgn
PtInRegion
CreateDIBSection
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
LineTo
RoundRect
SelectClipRgn
GetObjectW
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
GetObjectA
MoveToEx
TextOutW
GdiFlush
GetBitmapBits
SetBitmapBits
GetTextMetricsW
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateEnhMetaFileW
CloseEnhMetaFile
SaveDC
RestoreDC
GetStockObject
GetDeviceCaps
DeleteObject
GetTextExtentPoint32W
SelectObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateDIBitmap
CreateCompatibleDC
ExtSelectClipRgn
BitBlt
CreateCompatibleBitmap

advapi32

DeregisterEventSource
RegisterEventSourceA
ReportEventA
RegOpenKeyW
RegOpenKeyExW
RegEnumValueW
RegCloseKey
RegQueryValueExW

shell32

DragQueryFileW
ShellExecuteW
SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
Shell_NotifyIconW

ole32

CoCreateGuid
OleLockRunning
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
ReleaseStgMedium
OleDuplicateData
CoInitialize
RevokeDragDrop
RegisterDragDrop
DoDragDrop
CoCreateInstance
CoUninitialize

shlwapi

PathIsDirectoryW
PathRemoveFileSpecW
PathFileExistsW

imagehlp

MakeSureDirectoryPathExists

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

urlmon

URLDownloadToFileW

ws2_32

bind
getservbyname
htonl
shutdown
ioctlsocket
sendto
recvfrom
listen
accept
freeaddrinfo
getaddrinfo
WSAIoctl
socket
setsockopt
ntohs
htons
gethostbyname
gethostname
WSAStartup
WSACleanup
WSAGetLastError
__WSAFDIsSet
select
WSASetLastError
recv
send
getsockname
getpeername
connect
closesocket
getsockopt

wldap32

ord32
ord22
ord41
ord27
ord26
ord50
ord33
ord35
ord60
ord211
ord46
ord79
ord30
ord200
ord301
ord143

oleaut32

VariantClear
SysAllocString
SysFreeString
VariantInit

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow

comctl32

InitCommonControlsEx
_TrackMouseEvent
ord17

gdiplus

GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipCloneBrush
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipDrawRectangleI
GdipFillRectangleI
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipDrawImageRectI
GdipFree
GdipAlloc
GdiplusShutdown
GdiplusStartup
GdipCreateFromHDC

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 445KB - Virtual size: 444KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 199KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5c79e9f7ee99ebe293c16b9e34ed8151

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

imagehlp

version

urlmon

ws2_32

wldap32

oleaut32

imm32

comctl32

gdiplus

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 445KB - Virtual size: 444KB

.data Size: 44KB - Virtual size: 58KB

.gfids Size: 512B - Virtual size: 480B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 199KB - Virtual size: 199KB

.reloc Size: 86KB - Virtual size: 85KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 445KB - Virtual size: 444KB

.data
Size: 44KB - Virtual size: 58KB

.gfids
Size: 512B - Virtual size: 480B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 199KB - Virtual size: 199KB

.reloc
Size: 86KB - Virtual size: 85KB