69b093070990da60720fe060a962dc57_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

69b093070990da60720fe060a962dc57_JaffaCakes118
Size

2.6MB
MD5

69b093070990da60720fe060a962dc57
SHA1

d422dbbcde4cab67e0936dbf628d0506a0160e68
SHA256

af9867a82447da89f505969d598cd932e13b6cd7d816fb85d74b2cd6d42beeb9
SHA512

ab6ef88f558a0847bf93f95ece81890052fbc81dcbac3cc39b440cf43ba13704d5eec1c0251b3f2f780a5ba289a75ae9afd5c3622c3247c9586434e35d24cf57
SSDEEP

49152:wZqad90kec8KqgDeNMwIX0b6nt98X5VC3a51q9SG6QRVeYVeL1:6n90RHNMwIXXtipY3aOMceCeL1

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/SRO_CL~1.EXE
unpack001/SRO_CL~2.EXE

Files

69b093070990da60720fe060a962dc57_JaffaCakes118
.cab
SRO_CL~1.EXE
.exe windows:4 windows x86 arch:x86

86632da30434ccfc050190a47fb559c4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
_acmdln
__p__fmode
__set_app_type
_except_handler3
_controlfp
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
calloc
exit
memcpy
memset
_itow
??2@YAPAXI@Z
_wcsdup
??3@YAXPAX@Z
free
__p__commode

kernel32

GetModuleHandleA
GetTempPathW
GetModuleHandleW
GetModuleFileNameW
CreateFileW
SetFilePointer
CloseHandle
GetTempFileNameW
FreeLibrary
DeleteFileW
WriteFile
ReadFile
LoadLibraryW
GetProcAddress
GetStartupInfoA

user32

MessageBoxW

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SRO_CL~2.EXE
.exe windows:4 windows x86 arch:x86

d769cfb4c607a2fba72ddd688a40a6e0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

g:\vss-od\Silkroad\Client\Out\SRO_Client.pdb

Imports

gdi32

RemoveFontResourceA
AddFontResourceA
GetTextExtentPoint32A
GetTextExtentPoint32W
GetTextMetricsA
CreateFontIndirectA
CreateFontA
SetBkMode
SetPixel
GetPixel
GetStockObject
CreatePalette
RealizePalette
SelectPalette
CreateDIBitmap
GetObjectA
SetPaletteEntries
CreateDIBSection
GetDeviceGammaRamp
GetDIBits
SetBkColor
CreateSolidBrush
DeleteDC
BitBlt
SetDIBColorTable
DeleteObject
SetDeviceGammaRamp
SelectObject
SetTextColor
GetGlyphOutlineW
CreateCompatibleDC

advapi32

GetUserNameA
OpenProcessToken
GetTokenInformation
EqualSid
RegCloseKey
RegSetValueExA
RegCreateKeyExA
FreeSid
RegOpenKeyExA
RegOpenKeyA
RegQueryValueExA
AllocateAndInitializeSid

user32

CreateWindowExA
IsCharAlphaW
IsCharAlphaNumericW
SetCursorPos
ClientToScreen
PostMessageA
GetWindowThreadProcessId
EndDialog
SetWindowPos
GetActiveWindow
SetRect
GetKeyState
GetWindowRect
AdjustWindowRect
GetClientRect
GetDesktopWindow
IsClipboardFormatAvailable
SendMessageA
GetWindow
IsWindow
FindWindowA
SetFocus
CallNextHookEx
CallWindowProcA
UnhookWindowsHookEx
SetWindowLongA
GetWindowLongA
GetWindowTextA
KillTimer
SetWindowTextA
SetTimer
MapDialogRect
DefWindowProcA
CreateDialogIndirectParamA
EndPaint
BeginPaint
PostQuitMessage
wsprintfA
SetCursor
OpenClipboard
SystemParametersInfoA
EnumDisplaySettingsA
ClipCursor
GetClassLongA
GetMenu
SetMenu
DestroyAcceleratorTable
LoadMenuA
RegisterClassA
DestroyMenu
GetIconInfo
EnableWindow
CheckRadioButton
AppendMenuA
CreatePopupMenu
CreateMenu
CharNextExA
SetWindowsHookExA
DestroyWindow
GetFocus
GetKeyboardLayout
ShowCaret
RegisterClassExA
HideCaret
LoadCursorA
LoadIconA
ShowWindow
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
GetMessageA
PeekMessageA
RegisterHotKey
LoadAcceleratorsA
MessageBoxA
SetForegroundWindow
LoadStringA
MoveWindow
GetSystemMetrics
SetWindowTextW
GetClipboardData
CloseClipboard
ChangeDisplaySettingsA
MessageBoxW
GetDC
ReleaseDC
UpdateWindow
GetDlgItem
GetCursorPos
ScreenToClient
CharNextA
CharNextW
DialogBoxParamA
IsDlgButtonChecked

imm32

ImmGetConversionStatus
ImmNotifyIME
ImmSetCandidateWindow
ImmGetCompositionStringW
ImmGetContext
ImmReleaseContext
ImmGetProperty
ImmAssociateContext
ImmSetConversionStatus

kernel32

LCMapStringA
HeapSize
IsValidCodePage
GetOEMCP
GetCPInfo
HeapCreate
LCMapStringW
HeapReAlloc
VirtualAlloc
VirtualFree
FatalAppExitA
GetCurrentThread
TlsFree
SetHandleCount
GetFileType
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
SetConsoleCtrlHandler
FreeEnvironmentStringsA
GetEnvironmentStrings
HeapDestroy
FreeEnvironmentStringsW
InterlockedExchange
Sleep
ReadFile
CloseHandle
GetFileSize
CreateFileA
lstrlenA
GetLastError
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetFilePointer
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
ResetEvent
CreateEventA
DeleteFileA
WriteFile
CreateDirectoryA
SetCurrentDirectoryA
MultiByteToWideChar
SetEvent
WaitForSingleObject
CreateThread
OutputDebugStringA
GetTickCount
GetModuleFileNameA
GetEnvironmentStringsW
GetACP
GetVersion
GlobalUnlock
GlobalLock
FileTimeToSystemTime
SystemTimeToFileTime
Beep
GetProcAddress
GetModuleHandleA
CreateMutexA
WinExec
GetCurrentProcess
GetCurrentProcessId
GetLocalTime
SetUnhandledExceptionFilter
CompareStringA
FindClose
FindFirstFileA
FileTimeToLocalFileTime
GetFileTime
GetSystemDirectoryA
GetCommandLineA
FreeLibrary
LoadLibraryA
GetLocaleInfoA
GetThreadLocale
GetVersionExA
lstrcmpA
lstrcmpW
MapViewOfFile
CreateFileMappingA
CreateFileW
UnmapViewOfFile
LockResource
LoadResource
SizeofResource
FindResourceA
FindResourceW
GetSystemInfo
IsProcessorFeaturePresent
GetFullPathNameA
lstrcmpiA
HeapAlloc
GetProcessHeap
HeapFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStdHandle
IsDebuggerPresent
TerminateProcess
GetStartupInfoA
UnhandledExceptionFilter
ExitProcess
GetSystemTimeAsFileTime
RtlUnwind
RaiseException
GetCurrentDirectoryA
CopyFileA
SetFileAttributesA
GetFileAttributesA
GlobalMemoryStatus
SetLastError
GlobalAlloc
GlobalFree
Process32First
Process32Next
CreateToolhelp32Snapshot
Module32First
Module32Next
QueryPerformanceCounter
VirtualQuery
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
GetLocaleInfoW
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
CompareStringW
SetEnvironmentVariableA
_lwrite
QueryPerformanceFrequency
MulDiv
ExitThread
lstrcpyA
lstrcatA
lstrcpynA
SuspendThread
ResumeThread
TerminateThread
GetExitCodeThread
SetThreadPriority
GetWindowsDirectoryA
FlushViewOfFile
ReleaseSemaphore
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
SleepEx
FlushInstructionCache
FindNextFileA
GetCurrentThreadId

shell32

ShellExecuteW
ShellExecuteA
SHGetSpecialFolderPathA
ExtractIconExA

wininet

InternetCloseHandle
InternetGetLastResponseInfoA
FtpSetCurrentDirectoryA
FtpCreateDirectoryA
FtpRemoveDirectoryA
FtpDeleteFileA
FtpRenameFileA
InternetOpenA
FtpOpenFileA
FtpPutFileA
FtpGetFileA
FtpGetCurrentDirectoryA
InternetFindNextFileA
FtpFindFirstFileA
InternetCrackUrlA
InternetConnectA
InternetWriteFile

urlmon

URLDownloadToFileA

ws2_32

WSARecvFrom
gethostname
WSASendTo
WSAWaitForMultipleEvents
gethostbyaddr
ntohs
inet_addr
WSACleanup
closesocket
bind
htonl
htons
socket
WSAStartup
WSACloseEvent
WSASetEvent
WSAGetOverlappedResult
WSAResetEvent
inet_ntoa
gethostbyname
sendto
recvfrom
WSAGetLastError
listen
WSASocketA
shutdown
WSAIoctl
WSARecv
setsockopt
WSACreateEvent
getsockname
connect
accept
getpeername
getsockopt
WSASend
ioctlsocket

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

ddraw

DirectDrawCreateEx

iphlpapi

GetTcpTable
GetAdaptersInfo

winmm

timeGetTime
mmioRead
mmioDescend
mmioGetInfo
mmioCreateChunk
mmioSeek
mmioSetInfo
mmioAdvance
mmioWrite
mmioClose
mmioOpenA
timeSetEvent
timeKillEvent
mmioAscend

d3d9

Direct3DCreate9

ole32

CoCreateGuid
CoInitialize
CoUninitialize

dsound

ord11

Sections

.text
Size: 7.6MB - Virtual size: 7.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 948KB - Virtual size: 946KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 180KB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

86632da30434ccfc050190a47fb559c4

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

Sections

.text Size: 9KB - Virtual size: 9KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 1024B - Virtual size: 5KB

.rsrc Size: 2KB - Virtual size: 2KB

d769cfb4c607a2fba72ddd688a40a6e0

Headers

File Characteristics

PDB Paths

Imports

gdi32

advapi32

user32

imm32

kernel32

shell32

wininet

urlmon

ws2_32

version

ddraw

iphlpapi

winmm

d3d9

ole32

dsound

Sections

.text Size: 7.6MB - Virtual size: 7.6MB

.rdata Size: 948KB - Virtual size: 946KB

.data Size: 180KB - Virtual size: 2.6MB

.rsrc Size: 40KB - Virtual size: 39KB

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1024B - Virtual size: 5KB

.rsrc
Size: 2KB - Virtual size: 2KB

.text
Size: 7.6MB - Virtual size: 7.6MB

.rdata
Size: 948KB - Virtual size: 946KB

.data
Size: 180KB - Virtual size: 2.6MB

.rsrc
Size: 40KB - Virtual size: 39KB