28d8f1f214234dd84791c7700a825d2d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

28d8f1f214234dd84791c7700a825d2d_JaffaCakes118
Size

92KB
MD5

28d8f1f214234dd84791c7700a825d2d
SHA1

25148f0b32b60989c1acebac4f4ddc35ddd69094
SHA256

669f944d0fe460833e56d3d061d0f9bf8b7fbc1d8540a6a6149c21bb1a5debf6
SHA512

32006199b22e7ad5544c800345632dbeff34e2c14eb4ac04244a7c84b36b56cb93377c92fca52ba584aa28a29cdc9b40d8b168185bb5456c4685c8b4896cccda
SSDEEP

768:408q0Bfi+A5Vu7A/4OIOq4ffEYhKBzxsQuQZtkZu6VfZ0QszLAlcZsq97oyl0gL/:CqQq+A5AmiOxsYQwQFkZkB7Q6QMG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28d8f1f214234dd84791c7700a825d2d_JaffaCakes118

Files

28d8f1f214234dd84791c7700a825d2d_JaffaCakes118
.dll windows:4 windows x86 arch:x86

49570ad3d40a057bed5789863e000cb9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\documents and settings\jo\바탕 화면\posneserv\release\posneserv.pdb

Imports

wininet

InternetReadFile
InternetOpenA
InternetConnectA
HttpOpenRequestA
InternetCloseHandle
DeleteUrlCacheEntry
InternetQueryDataAvailable
HttpSendRequestA

urlmon

URLDownloadToFileA

kernel32

WriteConsoleA
RaiseException
SetStdHandle
Sleep
lstrlenA
LoadResource
LockResource
SizeofResource
FindResourceA
FindResourceExA
GetLastError
InterlockedExchange
GetConsoleOutputCP
CompareStringA
LoadLibraryA
CompareStringW
FreeLibrary
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryW
GetLocaleInfoA
WriteConsoleW
SetEnvironmentVariableA
CreateFileA
CloseHandle
FlushFileBuffers
GetThreadLocale
GetProcAddress
GetCommandLineA
GetStringTypeW
GetStringTypeA
LCMapStringW
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapAlloc
HeapFree
VirtualAlloc
GetModuleHandleA
GetLocalTime
GetTimeZoneInformation
GetCurrentThreadId
LCMapStringA
GetProcessHeap
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
HeapCreate
VirtualFree
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSection
RtlUnwind
SetFilePointer

user32

UnregisterClassA

advapi32

RegCreateKeyExA
RegisterServiceCtrlHandlerExA
StartServiceCtrlDispatcherA
RegCloseKey
RegSetValueExA
RegQueryValueExA
SetServiceStatus

shell32

ShellExecuteA
SHGetSpecialFolderPathA

Exports

Exports

ServiceMain
_HandlerEx@16

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

49570ad3d40a057bed5789863e000cb9

Headers

File Characteristics

PDB Paths

Imports

wininet

urlmon

kernel32

user32

advapi32

shell32

Exports

Exports

Sections

.text Size: 52KB - Virtual size: 51KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 8KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 176B

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 52KB - Virtual size: 51KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 8KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 8KB - Virtual size: 6KB