26652998d0a1484af6c44223730ad514_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

26652998d0a1484af6c44223730ad514_JaffaCakes118
Size

2.4MB
MD5

26652998d0a1484af6c44223730ad514
SHA1

15cf2f10bf44ab2bedc30f800dd012bb8fe7eb8c
SHA256

14def5dbeebf32ed793a8ca36080596234a04ebfc05cb7e5492de9dd1eecf569
SHA512

b51c82feacb708888592aa1e170f85695067d260cb590e8c23d7ca59e1ee6cad43ef802fa9052217f9c0b9a18fb12683ff4206e04bff13dbd80fe6bf6a5fa494
SSDEEP

24576:dhWhrh4hrhbhsOu4hrbATa4eePREsC1s37X/urzNozyX7AYYHhL3h1H2hhj8+xGS:NC9ThY4Z1rMfOSL4I11TgIJYAzPdGWL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
26652998d0a1484af6c44223730ad514_JaffaCakes118

Files

26652998d0a1484af6c44223730ad514_JaffaCakes118
.exe windows:4 windows x86 arch:x86

472cba4cac727da11186e839314e1d71

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Gunz Works\Publish_Brazil\Gunz\Runtime\WorldGpdb

Imports

fmod

_FSOUND_Stream_SetBufferSize@4
_FSOUND_Sample_Free@4
_FSOUND_GetMaxChannels@0
_FSOUND_Stream_GetMode@4
_FSOUND_Stream_SetMode@8
_FSOUND_Stream_PlayEx@16
_FSOUND_Stream_Close@4
_FSOUND_Stream_Stop@4
_FSOUND_SetDriver@4
_FSOUND_SetHWND@4
_FSOUND_StopSound@4
_FSOUND_3D_Listener_SetAttributes@32
_FSOUND_Update@0
_FSOUND_3D_SetMinMaxDistance@12
_FSOUND_SetMute@8
_FSOUND_3D_SetDopplerFactor@4
_FSOUND_SetVolume@8
_FSOUND_SetPaused@8
_FSOUND_Sample_Load@20
_FSOUND_GetError@0
_FSOUND_Sample_SetMinMaxDistance@12
_FSOUND_GetDriverName@4
_FSOUND_SetOutput@4
_FSOUND_SetMinHardwareChannels@4
_FSOUND_GetVersion@0
_FSOUND_GetVolume@4
_FSOUND_Close@0
_FSOUND_Stream_SetEndCallback@12
_FSOUND_Stream_Open@16
_FSOUND_Init@12
_FSOUND_GetNumDrivers@0
_FSOUND_SetMaxHardwareChannels@4
_FSOUND_GetDriverCaps@8
_FSOUND_3D_SetDistanceFactor@4
_FSOUND_3D_SetRolloffFactor@4
_FSOUND_Sample_GetMode@4
_FSOUND_PlaySoundEx@16
_FSOUND_3D_SetAttributes@12
_FSOUND_SetPriority@8

kernel32

GetThreadLocale
GetLocaleInfoA
MultiByteToWideChar
InterlockedExchange
GetCurrentProcess
SetPriorityClass
WideCharToMultiByte
GetVersion
CompareStringA
CompareStringW
GetACP
lstrlenA
GetVersionExA
GlobalMemoryStatus
InitializeCriticalSection
DeleteCriticalSection
Sleep
lstrcmpiA
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThreadId
SetCurrentDirectoryA
CreateMutexA
WaitForSingleObject
CloseHandle
GetModuleFileNameA
GetWindowsDirectoryA
FindFirstFileA
CreateDirectoryA
FindClose
GetCurrentDirectoryA
GetVolumeInformationA
GetTickCount
GetLastError
WinExec
IsDebuggerPresent
OutputDebugStringA
FreeLibrary
LoadLibraryA
GetProcAddress
GetModuleHandleA
EnterCriticalSection
LeaveCriticalSection
TlsFree
FileTimeToSystemTime
GetStringTypeA
GlobalFlags
GlobalFindAtomA
GlobalGetAtomNameA
GetCPInfo
GetOEMCP
GetFullPathNameA
FileTimeToLocalFileTime
RtlUnwind
GetSystemTimeAsFileTime
GetStartupInfoA
GetCommandLineA
HeapReAlloc
HeapSize
LCMapStringA
IsProcessorFeaturePresent
SetEnvironmentVariableA
IsBadCodePtr
GetStringTypeW
LocalReAlloc
GetDriveTypeA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
IsBadWritePtr
HeapCreate
TlsSetValue
TlsAlloc
TlsGetValue
HeapDestroy
GetTimeZoneInformation
GetFileType
SetHandleCount
MulDiv
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
CreateFileA
CreateEventA
IsDBCSLeadByte
SetEvent
ResetEvent
ExitThread
WaitForMultipleObjects
SizeofResource
LockResource
LoadResource
FindResourceA
GetLocalTime
TerminateThread
TerminateProcess
CreateThread
GetSystemInfo
GlobalUnlock
GlobalLock
lstrcatA
LocalAlloc
FormatMessageA
InterlockedDecrement
ReadFile
SetFileTime
GetFileAttributesA
FindNextFileA
GetCurrentProcessId
WriteFile
SystemTimeToFileTime
GetCurrentThread
GlobalAlloc
GlobalSize
GlobalAddAtomA
GlobalDeleteAtom
lstrcpyA
DeleteFileA
ExitProcess
SetThreadPriority
GetExitCodeThread
GetSystemDefaultLangID
VirtualQuery
FindNextChangeNotification
OpenEventA
FindCloseChangeNotification
FindFirstChangeNotificationA
SetUnhandledExceptionFilter
SetEndOfFile
SetFilePointer
lstrcmpA
IsBadReadPtr
VirtualAlloc
VirtualFree
VirtualProtect
HeapFree
GetProcessHeap
HeapAlloc
FlushFileBuffers
SetStdHandle
GetStdHandle
LocalFree
lstrcpynA
GlobalFree
SetLastError
GlobalReAlloc
lstrcmpW
RaiseException
InterlockedIncrement
GlobalHandle
LCMapStringW

user32

UnhookWindowsHookEx
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
ValidateRect
CallNextHookEx
SetWindowsHookExA
SetWindowTextA
GetFocus
PtInRect
GetDlgCtrlID
GetDlgItem
CopyRect
SystemParametersInfoA
RegisterWindowMessageA
AdjustWindowRectEx
LoadBitmapA
GetMenuCheckMarkDimensions
CheckMenuItem
EnableMenuItem
ModifyMenuA
SetMenuItemBitmaps
GetWindowPlacement
IsIconic
CallWindowProcA
GetClassInfoA
GetMenu
SetForegroundWindow
MapWindowPoints
GetMessagePos
GetMessageTime
DestroyWindow
LoadCursorA
RemovePropA
GetPropA
SetPropA
GetClassInfoExA
GetClassLongA
GetCapture
WinHelpA
DestroyMenu
SetClipboardData
GetSystemMetrics
GetSysColor
GetSysColorBrush
UnregisterClassA
GetParent
GetLastActivePopup
MoveWindow
GetClientRect
SetWindowLongA
GetWindowLongA
UpdateWindow
GetActiveWindow
SetWindowPos
CreateWindowExA
RegisterClassA
LoadIconA
TranslateMessage
PeekMessageA
DispatchMessageA
ReleaseDC
IsWindowEnabled
EnableWindow
GetMenuState
SetCursorPos
ClientToScreen
GetKeyState
GetWindowTextA
EnumWindows
PostMessageA
GetWindowRect
wsprintfA
GetAsyncKeyState
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
MessageBoxA
DefWindowProcA
SetFocus
PostQuitMessage
ShowCursor
GetWindow
ShowWindow
FindWindowExA
GetClassNameA
GetTopWindow
GetMenuItemID
GetDC
GetMenuItemCount
GetSubMenu
MapVirtualKeyA
GetKeyNameTextA
ScreenToClient
SendMessageA
GetKeyboardLayout
UnregisterHotKey
GetCursorPos
GetForegroundWindow
EmptyClipboard

gdi32

PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
CreateBitmap
GetStockObject
GetClipBox
SetTextColor
SetBkColor
RestoreDC
SaveDC
GetTextMetricsA
GetDeviceCaps
CreateFontA
CreateCompatibleDC
AddFontResourceA
RemoveFontResourceA
CreateDIBSection
SetMapMode
GetObjectA
GetTextExtentPoint32A
SelectObject
DeleteObject
DeleteDC

shell32

SHGetSpecialFolderPathA
SHChangeNotify
ShellExecuteA

ole32

CoCreateInstance
CoInitialize
OleRun
CoUninitialize

comctl32

ord17

shlwapi

StrStrIA
PathRemoveFileSpecA
PathStripPathA
PathIsDirectoryA
PathSearchAndQualifyA

urlmon

URLDownloadToFileA

imm32

ImmGetCompositionStringA
ImmGetDefaultIMEWnd
ImmSetConversionStatus
ImmAssociateContext
ImmNotifyIME
ImmGetCandidateListA
ImmGetContext
ImmGetOpenStatus
ImmReleaseContext
ImmGetConversionStatus

winmm

timeGetTime
timeEndPeriod
timeBeginPeriod
timeGetDevCaps

ws2_32

htons
bind
recv
htonl
socket
gethostbyname
inet_addr
ntohs
inet_ntoa
ioctlsocket
setsockopt
WSACleanup
WSAStartup
closesocket
WSAGetLastError
connect
WSACloseEvent
send
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
WSAEventSelect
WSACreateEvent
shutdown
sendto
recvfrom
getsockname
gethostname

gdiplus

GdipGetImageEncoders
GdipCloneBrush
GdipGetFamily
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawString
GdipFillPath
GdipGraphicsClear
GdipDrawPath
GdipSetSmoothingMode
GdipCreateFromHDC
GdipAddPathString
GdipCreateSolidFill
GdipDeleteFont
GdipDeleteFontFamily
GdipDeleteGraphics
GdipDeletePath
GdipCreatePath
GdipStringFormatGetGenericTypographic
GdipDeletePen
GdipCreatePen1
GdipDeleteBrush
GdipDisposeImage
GdipSaveImageToFile
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipGetImageEncodersSize
GdipBitmapUnlockBits
GdipFree
GdipAlloc
GdiplusStartup
GdiplusShutdown

dbghelp

MiniDumpWriteDump

wininet

InternetCloseHandle
InternetSetStatusCallback
InternetReadFileExA
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
DeleteUrlCacheEntry
InternetCrackUrlA

oleacc

LresultFromObject
CreateStdAccessibleObject

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyA
RegOpenKeyA

oleaut32

VariantChangeType
VariantClear
VariantInit
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysFreeString
GetErrorInfo

Exports

Exports

fcEXP

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 380KB - Virtual size: 376KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 156KB - Virtual size: 26.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.zrdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

472cba4cac727da11186e839314e1d71

Headers

File Characteristics

PDB Paths

Imports

fmod

kernel32

user32

gdi32

shell32

ole32

comctl32

shlwapi

urlmon

imm32

winmm

ws2_32

gdiplus

dbghelp

wininet

oleacc

winspool.drv

advapi32

oleaut32

Exports

Exports

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 380KB - Virtual size: 376KB

.data Size: 156KB - Virtual size: 26.0MB

.rsrc Size: 8KB - Virtual size: 5KB

.zrdata Size: 20KB - Virtual size: 20KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 380KB - Virtual size: 376KB

.data
Size: 156KB - Virtual size: 26.0MB

.rsrc
Size: 8KB - Virtual size: 5KB

.zrdata
Size: 20KB - Virtual size: 20KB