44f7111b0775b5f72368667e4b113f71_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

44f7111b0775b5f72368667e4b113f71_JaffaCakes118
Size

220KB
MD5

44f7111b0775b5f72368667e4b113f71
SHA1

2dd3a5d713ed8c5c8f9e56db3830a750a81fa90f
SHA256

a207a2031ab2ba08ec9a8a587dfbced06f38ac182e7407640069300be5afa876
SHA512

3b580777b5791eafa1e1097e8da69865e4ba873dc6412ad498474fad5a2ffc77b65a07d99d5ade2b78a2f673f901b0f5a21d32cb5073a7df9c9932088dbd54df
SSDEEP

3072:If75QQ6RxyguPt4suq3aqK5lvf4i+iFnlIdxzlYXROdxzlYXR/dxzlYXRz0:IDIyguPuB+aPp+ikdlIOdlI/dlIz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44f7111b0775b5f72368667e4b113f71_JaffaCakes118

Files

44f7111b0775b5f72368667e4b113f71_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1348ed79a07faeb6e665f3564724702f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Documents and Settings\Nguyen Huy Khanh\My Documents\Visual Studio Projects\TuChoi(BanMau)\Tu danh\Debug\Tu danh.pdb

Imports

winmm

PlaySoundA

kernel32

GetModuleFileNameA
LCMapStringW
CloseHandle
DeviceIoControl
CreateFileA
ReadProcessMemory
OpenProcess
Sleep
LCMapStringA
GetLocaleInfoA
GetSystemInfo
VirtualProtect
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetStdHandle
InterlockedExchange
VirtualQuery
GetOEMCP
GetACP
GetCPInfo
VirtualAlloc
HeapReAlloc
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
FreeLibrary
GetProcessHeap
HeapAlloc
SetConsoleCtrlHandler
SetFilePointer
RtlUnwind
VirtualFree
HeapFree
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
FlushFileBuffers
RaiseException
IsBadWritePtr
IsBadReadPtr
HeapValidate
TerminateProcess
GetCurrentProcess
ExitProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate

user32

SetDlgItemInt
FlashWindow
DialogBoxParamA
SendDlgItemMessageA
VkKeyScanA
MapVirtualKeyA
SetWindowTextA
GetCursorPos
ScreenToClient
PostMessageA
FindWindowA
GetWindowThreadProcessId
LoadIconA
SendMessageA
GetDlgItemInt
SetDlgItemTextA
EndDialog
IsDlgButtonChecked
SetTimer
IsWindow
GetDlgItem
GetFocus
KillTimer

nguyen

?Hook@@YAHPAUHWND__@@@Z
?WM_HOOK_WRITE@@3IA
?UnHook@@YAXPAUHWND__@@@Z

Sections

.textbss
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1348ed79a07faeb6e665f3564724702f

Headers

File Characteristics

PDB Paths

Imports

winmm

kernel32

user32

nguyen

Sections

.textbss Size: - Virtual size: 64KB

.text Size: 124KB - Virtual size: 123KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 8KB - Virtual size: 16KB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 64KB - Virtual size: 62KB

.textbss
Size: - Virtual size: 64KB

.text
Size: 124KB - Virtual size: 123KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 8KB - Virtual size: 16KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 64KB - Virtual size: 62KB