pandastealer | 1433e00fcda892d320cedb8f5d9a7dba_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

1433e00fcda892d320cedb8f5d9a7dba_JaffaCakes118
Size

2.0MB
MD5

1433e00fcda892d320cedb8f5d9a7dba
SHA1

00f2c19d7c957a72c34e502a1069ec608e4faafd
SHA256

923f38fa26bfa39648c2d66b1813edffbc1205a25945fa154258016017c8d365
SHA512

9a24f6a30d125bfef186e548acfa14d57ef127438c74c15cc7fbab203dfcba6f418130c40b95ae5128dc8f81323373b2c427201dbe6acdb74e8d049bc49452db
SSDEEP

49152:U7DXeCo9NJUMB/d4FS6VH0TmfedxzH06:U7TeCEf2o6VgY

Score

10^/10

pandastealer

Malware Config

Signatures

Panda Stealer payload 1 IoCs

Processes:

resource yara_rule

sample family_pandastealer
Pandastealer family
pandastealer

resource	yara_rule
sample	family_pandastealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
1433e00fcda892d320cedb8f5d9a7dba_JaffaCakes118

Files

1433e00fcda892d320cedb8f5d9a7dba_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a322cd85c91f85d15c707696bd9d1e2c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlUnwind
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
GetStartupInfoA
GetCommandLineA
ExitProcess
TerminateProcess
SetStdHandle
GetFileType
HeapSize
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
GetTickCount
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
GetTimeZoneInformation
IsBadReadPtr
IsBadCodePtr
SetEnvironmentVariableA
SetErrorMode
GetFileTime
FileTimeToLocalFileTime
WritePrivateProfileStringA
GetFullPathNameA
GetVolumeInformationA
GetCurrentProcess
DuplicateHandle
UnlockFile
LockFile
GetOEMCP
GetCPInfo
GlobalFlags
FindResourceExA
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
EnterCriticalSection
GlobalHandle
GlobalReAlloc
LeaveCriticalSection
LocalAlloc
InterlockedIncrement
InterlockedDecrement
GetCurrentThread
lstrcmpA
ConvertDefaultLocale
EnumResourceLanguagesA
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
GetModuleHandleA
FreeResource
VirtualProtect
GlobalFree
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
Sleep
DeleteCriticalSection
InitializeCriticalSection
RaiseException
CompareStringW
CompareStringA
GetVersion
MultiByteToWideChar
GetModuleFileNameA
LoadLibraryA
GetProcAddress
CreateThread
GetTempPathA
CreateProcessA
WaitForSingleObject
TerminateThread
GetFileSize
CopyFileA
GetFileAttributesA
ReadFile
FreeLibrary
lstrcpyA
lstrcatA
GetLocalTime
FindFirstFileA
FindClose
FileTimeToSystemTime
DeleteFileA
CreateFileA
SystemTimeToFileTime
SetFileTime
SetFilePointer
SetEndOfFile
WriteFile
FlushFileBuffers
CloseHandle
lstrcmpiA
SetFileAttributesA
MoveFileA
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
lstrlenA
SetLastError
lstrcpynA
CreateDirectoryA
GetLastError
GetProcessHeap
HeapAlloc
IsBadWritePtr
HeapFree

user32

MessageBeep
GetNextDlgGroupItem
InvalidateRgn
InvalidateRect
CopyAcceleratorTableA
SetRect
IsRectEmpty
CharNextA
ReleaseCapture
SetCapture
DestroyMenu
LoadCursorA
GetSysColorBrush
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
SetWindowContextHelpId
GetMessageA
TranslateMessage
GetCursorPos
ValidateRect
SetCursor
PostQuitMessage
ReleaseDC
GetDC
SetMenuItemBitmaps
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
MoveWindow
SetWindowTextA
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
CheckDlgButton
RegisterWindowMessageA
WinHelpA
CreateWindowExA
SetWindowsHookExA
GetClassLongA
GetClassInfoExA
SetPropA
GetPropA
RemovePropA
SendDlgItemMessageA
IsChild
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
DispatchMessageA
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
MessageBoxA
GetKeyState
SetForegroundWindow
IsWindowVisible
UpdateWindow
GetMenu
GetSysColor
AdjustWindowRectEx
ScreenToClient
EqualRect
GetClassInfoA
RegisterClassA
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
CopyRect
PtInRect
GetWindow
GetDesktopWindow
PostThreadMessageA
RegisterClipboardFormatA
CreateDialogIndirectParamA
DestroyWindow
GetNextDlgTabItem
EndDialog
MapDialogRect
SetWindowPos
ShowWindow
GetCapture
GetActiveWindow
SetActiveWindow
GetAsyncKeyState
GetFocus
SetFocus
GetWindowRect
GetWindowLongA
CallNextHookEx
GetDlgItem
IsWindowEnabled
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
UnregisterClassA
GetSystemMetrics
LoadIconA
GetClientRect
IsIconic
EnableWindow
GetParent
PostMessageA
CharUpperA
SendMessageA
wsprintfA
IsWindow
GetClassNameA

gdi32

EnumFontFamiliesExA
GetMapMode
GetBkColor
GetTextColor
GetRgnBox
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
DeleteObject
TextOutA
GetStockObject
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
GetDeviceCaps
SetMapMode
RestoreDC
SaveDC
CreateRectRgnIndirect
CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetClipBox
ExtTextOutA

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegSetValueExA
RegOpenKeyA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegCreateKeyExA
RegCloseKey

comctl32

PropertySheetA
DestroyPropertySheetPage
CreatePropertySheetPageA
ord17
ImageList_Destroy

shlwapi

PathSkipRootA
PathFindFileNameA
PathFindExtensionA
PathStripToRootA
PathRemoveFileSpecA
PathFileExistsA
PathIsUNCA

oledlg

ord8

ole32

CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoTaskMemFree
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize

oleaut32

OleCreateFontIndirect
SysAllocString
SystemTimeToVariantTime
SafeArrayDestroy
VariantCopy
SysAllocStringLen
VariantInit
VariantChangeType
VariantClear
SysAllocStringByteLen
SysStringLen
SysFreeString

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

wininet

InternetOpenA
InternetCrackUrlA
InternetAttemptConnect
InternetCloseHandle
InternetReadFile
HttpQueryInfoA
InternetConnectA
InternetSetOptionA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA

Sections

.text
Size: 184KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a322cd85c91f85d15c707696bd9d1e2c

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

comctl32

shlwapi

oledlg

ole32

oleaut32

version

wininet

Sections

.text Size: 184KB - Virtual size: 180KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 12KB - Virtual size: 24KB

.rsrc Size: 1.8MB - Virtual size: 1.8MB

.text
Size: 184KB - Virtual size: 180KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 12KB - Virtual size: 24KB

.rsrc
Size: 1.8MB - Virtual size: 1.8MB