53e9923d877ddc57fb1fe96660696c87_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

53e9923d877ddc57fb1fe96660696c87_JaffaCakes118
Size

84KB
MD5

53e9923d877ddc57fb1fe96660696c87
SHA1

276dcae9ce1ec8637121686b3f1b2320e34cab74
SHA256

bd6f46f35dc9b40cca178649e4392e2f3ad5ee551d960240b2f808db6e75e46c
SHA512

410d960db71d0efd45ec38041c8b66ec14c19a5d692319bf2e070e622092b0f8df423490be8eb371fd9c80b7769d59aada947ae1cee49479c0aa78199ac0bc34
SSDEEP

768:UF/ZQWF3YIFHGqGE6Uxb4KBxK76cTQTG/6grS4tk0fSDcntFOzwJcCp/duWMD3tE:UO+6Gb4Ce/6ckeSP0dW9QNQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
53e9923d877ddc57fb1fe96660696c87_JaffaCakes118

Files

53e9923d877ddc57fb1fe96660696c87_JaffaCakes118
.dll windows:4 windows x86 arch:x86

d8cf1b0b6528ac69f94c801038b12dcf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\업무관련\update_module\03_4개대표\20_박정석대표(서비스_런방식)_creativity도메인_20110228\service\release\ptsport.pdb

Imports

wininet

InternetQueryDataAvailable
InternetOpenA
InternetCloseHandle
InternetReadFile
DeleteUrlCacheEntry
HttpSendRequestA
HttpOpenRequestA
InternetConnectA

urlmon

URLDownloadToFileA

kernel32

GetLastError
InterlockedExchange
CompareStringA
CompareStringW
GetVersionExA
MultiByteToWideChar
GetLocaleInfoA
Sleep
lstrlenA
LoadResource
LockResource
SizeofResource
FindResourceA
FindResourceExA
FreeLibrary
GetProcAddress
LoadLibraryW
GetStringTypeA
LCMapStringW
LCMapStringA
LoadLibraryA
RaiseException
SetEnvironmentVariableA
GetThreadLocale
WideCharToMultiByte
HeapFree
RtlUnwind
InitializeCriticalSection
GetSystemTimeAsFileTime
GetLocalTime
HeapAlloc
VirtualAlloc
GetModuleHandleA
GetTimeZoneInformation
HeapReAlloc
GetCurrentProcessId
GetCurrentThreadId
GetCommandLineA
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
HeapCreate
VirtualFree
ExitProcess
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetStringTypeW

user32

UnregisterClassA

advapi32

RegQueryValueExA
RegCreateKeyExA
SetServiceStatus
RegCloseKey
RegisterServiceCtrlHandlerExA
StartServiceCtrlDispatcherA
RegSetValueExA

shell32

ShellExecuteA
SHGetSpecialFolderPathA

Exports

Exports

ServiceMain
_HandlerEx@16

Sections

.text
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d8cf1b0b6528ac69f94c801038b12dcf

Headers

File Characteristics

PDB Paths

Imports

wininet

urlmon

kernel32

user32

advapi32

shell32

Exports

Exports

Sections

.text Size: 52KB - Virtual size: 49KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 4KB - Virtual size: 176B

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 52KB - Virtual size: 49KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 8KB - Virtual size: 6KB