gozi | c8b4bebdd7cad87c66527064e2dfd343_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

c8b4bebdd7cad87c66527064e2dfd343_JaffaCakes118
Size

880KB
MD5

c8b4bebdd7cad87c66527064e2dfd343
SHA1

c6f0a7116aff4bd35fa6946c39ee9269a8dd147e
SHA256

5f4fbd1e46d887e0b3360a37edc9b6ad21a497b8e5746017b8ce08cc8d3d87ac
SHA512

b4b8cdaf7abaa572ee37487fd34a8af6300931610e73283ca13795104b9b6795b0229125d7fd747be0212f9867306abe2295fb3c6edf9d6749b5f976f6c48cfb
SSDEEP

24576:peJvTAWGNJOOvvuQrQMyOQqeAAJrZgarkI:aTAWgsMOzZgJ

Score

10^/10

isfb gozi

Malware Config

Extracted

Family

gozi

Signatures

Gozi family
gozi

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c8b4bebdd7cad87c66527064e2dfd343_JaffaCakes118

Files

c8b4bebdd7cad87c66527064e2dfd343_JaffaCakes118
.exe windows:4 windows x86 arch:x86

99c886adb824d17ed93383a6fa86408e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

audiocodec

?createInstance@CAudioCodecIf@@SAPAV1@H@Z
?destroyInstance@CAudioCodecIf@@SAXPAPAV1@@Z

videocodecdecoder

?destroyInstance@Mpeg4CodecIf@@SAXAAPAV1@@Z
?createInstance@Mpeg4CodecIf@@SAPAV1@H@Z

mp4filelib

?createInstance@CMp4File@@SA?AW4MP4Err@@PAPAV1@@Z
?destroyInstance@CMp4File@@SA?AW4MP4Err@@PAPAV1@@Z

streamio

?destroyInstance@CInStrmPin@@SAXAAPAV1@@Z
?getData@CIOStrmPin@@SAXPBVCBufferElem@@AAPAEAAI@Z
?allocateBufferElem@CIOStrmPin@@SAHAAPAVCBufferElem@@I@Z
?createInstance@COutStrmPin@@SAPAV1@I@Z
?createInstance@CInStrmPin@@SAPAV1@I@Z
?freeBufferElem@CIOStrmPin@@SAHAAPAVCBufferElem@@@Z
?destroyInstance@COutStrmPin@@SAXAAPAV1@@Z
?getDesc@CIOStrmPin@@SAXPBVCBufferElem@@AAPAVCVidStreamPayloadDesc@@@Z

ddraw

DirectDrawCreate

winmm

timeGetTime
timeBeginPeriod
timeSetEvent
timeEndPeriod
timeKillEvent
mciGetErrorStringA
mciSendCommandA
joyGetDevCapsA
waveInGetNumDevs
waveOutGetNumDevs
waveOutGetPosition
waveInGetPosition
waveInUnprepareHeader
waveInClose
waveOutReset
waveInReset
waveInStart
waveOutPause
waveOutRestart
waveInPrepareHeader
waveInAddBuffer
waveInGetDevCapsA
waveInOpen
waveOutGetDevCapsA
waveOutOpen
joyGetPosEx
waveOutClose
waveOutUnprepareHeader
waveOutWrite
waveOutGetErrorTextA
joyGetNumDevs
waveOutPrepareHeader

ws2_32

WSAStartup
gethostbyname
ntohl
inet_addr
htons
htonl
setsockopt
ntohs
closesocket
bind
socket
sendto
WSACleanup
connect
WSAGetLastError
send
recv
select
recvfrom
ioctlsocket
gethostname

kernel32

GetStdHandle
SetHandleCount
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
GetCPInfo
GetOEMCP
GetACP
GetTimeZoneInformation
SetConsoleCtrlHandler
GetCommandLineA
GetStartupInfoA
HeapReAlloc
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
GetCurrentProcess
TerminateProcess
ExitProcess
FindNextFileA
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
LoadLibraryA
CreateThread
GetFileType
CreateMutexA
CloseHandle
WaitForSingleObject
ReleaseMutex
GetCurrentThreadId
TerminateThread
CreateSemaphoreA
ReleaseSemaphore
QueryPerformanceCounter
QueryPerformanceFrequency
GetDriveTypeA
SetThreadPriority
GetCurrentThread
FreeLibrary
GetProcAddress
GetVersionExA
GetModuleHandleA
CreateEventA
InterlockedExchange
GlobalFree
GlobalAlloc
GetEnvironmentVariableA
GetLastError
DeleteCriticalSection
GetVersion
LeaveCriticalSection
EnterCriticalSection
WaitForMultipleObjects
InitializeCriticalSection
SetPriorityClass
ResetEvent
RtlUnwind
SetFilePointer
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
HeapSize
WriteFile
ReadFile
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
VirtualProtect
GetSystemInfo
VirtualQuery
LCMapStringA
MultiByteToWideChar
LCMapStringW
FlushFileBuffers
GetStringTypeA
GetStringTypeW
SetStdHandle
CreateFileA
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetTickCount
GetCurrentProcessId
GetLocaleInfoA
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
Sleep

user32

SetWindowLongA
IsZoomed
GetWindowLongA
IsWindowVisible
GetForegroundWindow
PostMessageA
KillTimer
WindowFromPoint
PtInRect
GetCursorPos
MapWindowPoints
GetKeyboardState
ReleaseCapture
SetCapture
SetCursorPos
SetCursor
ClipCursor
RegisterClassA
PeekMessageA
ToAscii
SetClassLongA
CreateIconFromResourceEx
DestroyCursor
CreateCursor
ScreenToClient
MsgWaitForMultipleObjects
MapVirtualKeyA
CheckDlgButton
GetMessageA
TranslateMessage
DispatchMessageA
TranslateAcceleratorA
LoadIconA
LoadCursorA
RegisterClassExA
PostQuitMessage
AdjustWindowRect
DialogBoxParamA
ClientToScreen
TrackPopupMenu
GetDlgItemTextA
GetDlgItem
SendMessageA
SetDlgItemTextA
ReleaseDC
SetTimer
GetSystemMetrics
LoadMenuA
DestroyMenu
SetMenu
LoadAcceleratorsA
DeleteMenu
CreatePopupMenu
RemoveMenu
AppendMenuA
DrawMenuBar
CreateWindowExA
BeginPaint
GetClientRect
DrawTextA
EndPaint
DefWindowProcA
LoadStringA
LoadImageA
GetDC
SetWindowTextA
SetWindowPos
GetWindowRect
ShowWindow
UpdateWindow
GetMenu
CheckMenuItem
GetSubMenu
MessageBoxA
SetForegroundWindow
EnumDisplaySettingsA
InvalidateRect
ChangeDisplaySettingsA
EndDialog
DestroyIcon
GetDesktopWindow
OffsetRect
DrawTextExA
EnableWindow
MoveWindow
SendDlgItemMessageA
GetDlgItemInt
SetDlgItemInt
DestroyWindow
IsDlgButtonChecked

gdi32

SetBkColor
SetTextColor
CreateRectRgn
CreatePen
LineTo
MoveToEx
CreateFontA
CreateSolidBrush
SelectClipRgn
Rectangle
TextOutA
SetTextAlign
CreateCompatibleDC
BitBlt
SetStretchBltMode
CreatePalette
GetSystemPaletteEntries
GetDIBits
CreateCompatibleBitmap
SelectPalette
SetDIBColorTable
RealizePalette
SetPaletteEntries
GetDeviceGammaRamp
SetDeviceGammaRamp
GetDeviceCaps
SwapBuffers
DescribePixelFormat
SetPixelFormat
ChoosePixelFormat
SelectObject
DeleteDC
DeleteObject
GetObjectA
CreateDIBSection
GetTextMetricsA
StretchBlt

comdlg32

GetOpenFileNameA

advapi32

RegCloseKey
RegQueryValueExA
GetUserNameA
RegSetValueExA
RegCreateKeyExA

shell32

DragAcceptFiles
DragQueryFileA
DragFinish

Exports

Exports

SDL_AddTimer
SDL_AudioDelayMsec
SDL_AudioDriverName
SDL_AudioInit
SDL_AudioQuit
SDL_BuildAudioCVT
SDL_CDClose
SDL_CDEject
SDL_CDName
SDL_CDNumDrives
SDL_CDOpen
SDL_CDPause
SDL_CDPlay
SDL_CDPlayTracks
SDL_CDResume
SDL_CDStatus
SDL_CDStop
SDL_ClearError
SDL_CloseAudio
SDL_ConvertAudio
SDL_ConvertSurface
SDL_CreateCursor
SDL_CreateMutex
SDL_CreateRGBSurface
SDL_CreateRGBSurfaceFrom
SDL_CreateSemaphore
SDL_CreateThread
SDL_CreateYUVOverlay
SDL_Delay
SDL_DestroyMutex
SDL_DestroySemaphore
SDL_DisplayFormat
SDL_DisplayFormatAlpha
SDL_DisplayYUVOverlay
SDL_EnableKeyRepeat
SDL_EnableUNICODE
SDL_EventState
SDL_FillRect
SDL_Flip
SDL_FreeCursor
SDL_FreeSurface
SDL_FreeYUVOverlay
SDL_GL_GetAttribute
SDL_GL_GetProcAddress
SDL_GL_LoadLibrary
SDL_GL_Lock
SDL_GL_SetAttribute
SDL_GL_SwapBuffers
SDL_GL_Unlock
SDL_GL_UpdateRects
SDL_GetAppState
SDL_GetAudioStatus
SDL_GetClipRect
SDL_GetCursor
SDL_GetError
SDL_GetEventFilter
SDL_GetKeyName
SDL_GetKeyState
SDL_GetModState
SDL_GetMouseState
SDL_GetRGB
SDL_GetRGBA
SDL_GetRelativeMouseState
SDL_GetThreadID
SDL_GetTicks
SDL_GetVideoInfo
SDL_GetVideoSurface
SDL_GetWMInfo
SDL_HasAudioDelayMsec
SDL_Init
SDL_InitSubSystem
SDL_JoystickClose
SDL_JoystickEventState
SDL_JoystickGetAxis
SDL_JoystickGetBall
SDL_JoystickGetButton
SDL_JoystickGetHat
SDL_JoystickIndex
SDL_JoystickName
SDL_JoystickNumAxes
SDL_JoystickNumBalls
SDL_JoystickNumButtons
SDL_JoystickNumHats
SDL_JoystickOpen
SDL_JoystickOpened
SDL_JoystickUpdate
SDL_KillThread
SDL_Linked_Version
SDL_ListModes
SDL_LockAudio
SDL_LockSurface
SDL_LockYUVOverlay
SDL_LowerBlit
SDL_MapRGB
SDL_MapRGBA
SDL_NumJoysticks
SDL_OpenAudio
SDL_PauseAudio
SDL_PeepEvents
SDL_PollEvent
SDL_PumpEvents
SDL_PushEvent
SDL_Quit
SDL_QuitSubSystem
SDL_RegisterApp
SDL_RemoveTimer
SDL_SemPost
SDL_SemTryWait
SDL_SemValue
SDL_SemWait
SDL_SemWaitTimeout
SDL_SetAlpha
SDL_SetClipRect
SDL_SetColorKey
SDL_SetColors
SDL_SetCursor
SDL_SetError
SDL_SetEventFilter
SDL_SetModState
SDL_SetPalette
SDL_SetTimer
SDL_SetVideoMode
SDL_ShowCursor
SDL_SoftStretch
SDL_ThreadID
SDL_UnlockAudio
SDL_UnlockSurface
SDL_UnlockYUVOverlay
SDL_UpdateRect
SDL_UpdateRects
SDL_UpperBlit
SDL_VideoDriverName
SDL_VideoInit
SDL_VideoModeOK
SDL_VideoQuit
SDL_WM_GetCaption
SDL_WM_GrabInput
SDL_WM_IconifyWindow
SDL_WM_SetCaption
SDL_WM_SetIcon
SDL_WM_ToggleFullScreen
SDL_WaitEvent
SDL_WaitThread
SDL_WarpMouse
SDL_WasInit
SDL_mutexP
SDL_mutexV

Sections

.text
Size: 340KB - Virtual size: 338KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 32KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

z?�
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Extracted

Signatures

Files

99c886adb824d17ed93383a6fa86408e

Headers

File Characteristics

Imports

audiocodec

videocodecdecoder

mp4filelib

streamio

ddraw

winmm

ws2_32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

Exports

Exports

Sections

.text Size: 340KB - Virtual size: 338KB

.rdata Size: 44KB - Virtual size: 43KB

.data Size: 32KB - Virtual size: 82KB

z?� Size: 92KB - Virtual size: 92KB

.text
Size: 340KB - Virtual size: 338KB

.rdata
Size: 44KB - Virtual size: 43KB

.data
Size: 32KB - Virtual size: 82KB

z?�
Size: 92KB - Virtual size: 92KB