4351acbb7e7e2a3c103e14deb70693b8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4351acbb7e7e2a3c103e14deb70693b8_JaffaCakes118
Size

3.1MB
MD5

4351acbb7e7e2a3c103e14deb70693b8
SHA1

c6c564099d6522dca7a527d006e0e41dab114a3a
SHA256

72eb658b121a95d4caa1a363d9658e68f5b5279a914b6dfee62a888093ec2e6a
SHA512

5524a7acbc0ccfb3cf08ee327d2b9eb29d555b12674752fd20700ca0185893cfb0fe6b1a8e975b187acc4020684608fefea9dfe33e9e7d1004f33708707c4625
SSDEEP

98304:AgylX0QjLrpPhOiae6VN4EfLtigD/Wm3rD:Ajb1j5sZJigD+m3rD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4351acbb7e7e2a3c103e14deb70693b8_JaffaCakes118

Files

4351acbb7e7e2a3c103e14deb70693b8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d27005fc1fede44c4f151232aa1944a4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

i:\自动编译_1.57_1.56SP3.1\HummerPack\QQ1.57_1961\AutoProject\HummerSetup.pdb

Imports

msimg32

TransparentBlt

shell32

SHCreateDirectoryExW
CommandLineToArgvW
SHFileOperationW
SHBrowseForFolderW
SHGetSpecialFolderPathW
Shell_NotifyIconW
ShellExecuteW
SHGetPathFromIDListW
SHGetSpecialFolderLocation

msi

ord32
ord159
ord118
ord8
ord92
ord160
ord195
ord137
ord169
ord141
ord70
ord88

advapi32

QueryServiceStatus
RegOpenKeyExW
StartServiceW
OpenServiceW
ChangeServiceConfigW
OpenSCManagerW
RegCreateKeyW
CloseServiceHandle
RegSetValueExW
RegDeleteValueW
RegEnumKeyW
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey

shlwapi

PathFileExistsW
PathStripToRootW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

ws2_32

htons
closesocket
connect
WSAStartup
socket
recv
htonl
send
inet_addr
WSACleanup

kernel32

GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetUserDefaultLCID
GetLocaleInfoA
GetStartupInfoA
GetFileType
SetHandleCount
FlushFileBuffers
GetStdHandle
HeapCreate
HeapDestroy
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetConsoleMode
GetConsoleCP
ExitProcess
GetStringTypeW
FormatMessageW
LocalFree
GetLastError
CloseHandle
EnterCriticalSection
FindFirstFileW
CreateMutexW
GetCurrentDirectoryW
GetFileAttributesW
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
SetFileAttributesW
GetSystemDirectoryW
GetVersionExW
LeaveCriticalSection
CreateProcessW
GetModuleFileNameW
VirtualFree
VirtualAlloc
ReadFile
CreateFileW
MultiByteToWideChar
LockResource
FreeResource
GetDriveTypeW
FindResourceW
LoadResource
CreateDirectoryW
WriteFile
EnumSystemLocalesA
GlobalAlloc
GlobalLock
GlobalUnlock
CreateThread
Sleep
FindClose
GetPrivateProfileIntW
GetDiskFreeSpaceExW
FreeEnvironmentStringsA
FindNextFileW
FreeLibrary
GetPrivateProfileStringW
LoadLibraryW
MoveFileExW
GetProcAddress
RemoveDirectoryW
DeleteFileW
WritePrivateProfileStringW
CopyFileW
GetWindowsDirectoryW
MoveFileW
QueryPerformanceCounter
QueryPerformanceFrequency
IsBadWritePtr
IsBadReadPtr
RemoveDirectoryA
WaitForSingleObject
Process32NextW
lstrcmpiW
TerminateProcess
DeleteFileA
OpenProcess
lstrcatA
GetACP
lstrcmpW
Process32FirstW
CreateToolhelp32Snapshot
GetCommandLineW
GetModuleHandleW
GetTickCount
GetSystemTimeAsFileTime
GetProcessTimes
GetCurrentProcessId
SetFilePointer
LoadLibraryA
GetCurrentProcess
GetModuleFileNameA
GetModuleHandleA
RaiseException
InterlockedIncrement
InterlockedDecrement
GlobalFree
GetStringTypeA
GetCPInfo
LCMapStringW
LCMapStringA
RtlUnwind
GetStartupInfoW
GetProcessHeap
GetVersionExA
HeapSize
HeapReAlloc
IsDebuggerPresent
IsValidLocale
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapAlloc
HeapFree
InterlockedExchange
InterlockedCompareExchange
WideCharToMultiByte
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
CreateFileA
SetEndOfFile
GetThreadLocale
SizeofResource
LocalAlloc

user32

ExitWindowsEx
GetClassInfoExW
DefWindowProcW
GetDesktopWindow
RegisterClassExW
CharNextW
GetKeyboardLayoutList
EnumWindows
PtInRect
GetCursorPos
GetWindowDC
ReleaseDC
IsWindowVisible
LoadCursorW
SetWindowLongW
BringWindowToTop
GetWindowThreadProcessId
LoadBitmapW
OffsetRect
SetWindowPos
DestroyWindow
SetDlgItemTextW
TrackMouseEvent
GetDC
CallNextHookEx
GetClassNameW
SetWindowsHookExW
MapVirtualKeyW
UnhookWindowsHookEx
SetCursor
SetWindowRgn
GetParent
PostMessageW
GetClientRect
DrawTextW
GetWindowLongW
GetWindowRect
CreateDialogParamW
GetDlgItem
SetWindowTextW
GetWindowTextW
ShowWindow
TranslateAcceleratorW
GetMessageW
SendMessageW
TranslateMessage
DispatchMessageW
LoadAcceleratorsW
EndDialog
MessageBoxW
DialogBoxParamW
DestroyIcon
ReleaseCapture
KillTimer
InvalidateRect
SetTimer
UpdateWindow
IsWindow
GetFocus
GetDlgItemTextW
GetKeyState
DrawIconEx
CreateWindowExW
SetFocus
SetClassLongW
PostQuitMessage
GetWindow
LoadImageW
GetActiveWindow
GetDlgCtrlID
EnableWindow

gdi32

CreateFontW
CreateCompatibleDC
CreateRoundRectRgn
SetBkColor
GetObjectW
BitBlt
SelectObject
DeleteDC
CreateCompatibleBitmap
GetStockObject
DeleteObject
GetTextExtentExPointW
SetTextColor
SetBkMode

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
StringFromCLSID
CreateStreamOnHGlobal

oleaut32

SysStringLen
SysAllocString
SysFreeString

imm32

ImmGetDescriptionW

Sections

.text
Size: 292KB - Virtual size: 291KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33.9MB - Virtual size: 33.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d27005fc1fede44c4f151232aa1944a4

Headers

File Characteristics

PDB Paths

Imports

msimg32

shell32

msi

advapi32

shlwapi

version

ws2_32

kernel32

user32

gdi32

ole32

oleaut32

imm32

Sections

.text Size: 292KB - Virtual size: 291KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 12KB - Virtual size: 49KB

.rsrc Size: 33.9MB - Virtual size: 33.9MB

.text
Size: 292KB - Virtual size: 291KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 12KB - Virtual size: 49KB

.rsrc
Size: 33.9MB - Virtual size: 33.9MB