JaffaCakes118_60433a5ba519475e6faa1a4f7210bc20

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_60433a5ba519475e6faa1a4f7210bc20
Size 169KB
Sample250101-x9ltpaspal
SHA256 ce435ba894f3737d0abe06180b9114e20d122240fded0685bd63db4a020a7a83
MD5 60433a5ba519475e6faa1a4f7210bc20
SHA1 0bafd67adf0969d28ef14d836b7c9e8219c93780
SHA512 7d1603ab400ba232c1968cd662af3a705e1313f8d912d52a2a30e40f1fb79bce34a18e98ef38837a936e847b5d8b4e738923d0af4572e7cf77011fd1326a861f
SSDEEP 1536:9I2t937an08bcn6kwOgKhlgvwf+l+OBDY4f2XdR7TPk3BfEBZWEzMNGCq2iW7z:tbadAn67Ogvl+qlKdR7TPk8XWEzQGCH
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_60433a5ba519475e6faa1a4f7210bc20

File Explorer

JaffaCakes118_60433a5ba519475e6faa1a4f7210bc20

.exe 169KB

JaffaCakes118_60433a5ba519475e6faa1a4f7210bc20

IMPHASH 6726d979531fd2292216f13bed0d9685
SHA256 ce435ba894f3737d0abe06180b9114e20d122240fded0685bd63db4a020a7a83
MD5 60433a5ba519475e6faa1a4f7210bc20
SHA1 0bafd67adf0969d28ef14d836b7c9e8219c93780
SHA512 7d1603ab400ba232c1968cd662af3a705e1313f8d912d52a2a30e40f1fb79bce34a18e98ef38837a936e847b5d8b4e738923d0af4572e7cf77011fd1326a861f
SSDEEP 1536:9I2t937an08bcn6kwOgKhlgvwf+l+OBDY4f2XdR7TPk3BfEBZWEzMNGCq2iW7z:tbadAn67Ogvl+qlKdR7TPk8XWEzQGCH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

167936

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\work\xunlei_uiengine\pdb\ProductRelease\XLUEOPS\XLUEOPS.pdb

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

kernel32

RaiseException GetExitCodeProcess GetLastError OpenProcess DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThreadId GetCommandLineW CreateMutexW TerminateProcess GetCurrentProcess FlushInstructionCache SetLastError InterlockedIncrement InterlockedDecrement CloseHandle GetProcessHeap HeapSetInformation HeapCreate HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize Sleep InterlockedExchange VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA InterlockedCompareExchange GetModuleHandleW FreeLibrary GetModuleFileNameW LoadLibraryW GetProcAddress GetStartupInfoW GetTempPathW GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent QueryPerformanceCounter

user32

KillTimer DefWindowProcW UnregisterClassA SetWindowLongW GetWindowLongW CallWindowProcW UnregisterClassW CharNextW RegisterClassExA RegisterClassExW GetClassInfoExA LoadCursorA GetClassInfoExW LoadCursorW PostThreadMessageW DestroyWindow SetTimer PostQuitMessage PeekMessageW GetMessageW TranslateMessage DispatchMessageW wsprintfW CreateWindowExW

shell32

CommandLineToArgvW

ole32

CoUninitialize CoInitialize CoCreateInstance

oleaut32

UnRegisterTypeLi SysFreeString RegisterTypeLi SysStringLen

atl90

ord43 ord56 ord49 ord64 ord44 ord23 ord61 ord68

shlwapi

PathFileExistsW PathCombineW PathFindFileNameW PathAppendW

comctl32

InitCommonControlsEx

msvcp90

?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB ?empty@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE_NXZ ??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z ?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z ?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z ?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z ??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z ??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z ??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ

msvcr90

_lock __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _configthreadlocale _initterm_e _onexit _wcmdln exit _encode_pointer __dllonexit _unlock ?_query_new_mode@@YAHXZ _XcptFilter _exit _decode_pointer ?terminate@@YAXXZ _except_handler4_common _crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QAEXXZ _CxxThrowException _invoke_watson _amsg_exit __wgetmainargs _controlfp_s _initterm __CxxFrameHandler3 memset _beginthreadex wcscpy wcslen free wcsncpy_s strlen memcmp _recalloc sprintf_s swprintf_s _wtoi _wcsicmp memmove_s ?_query_new_handler@@YAP6AHI@ZXZ strcpy _cexit

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_60433a5ba519475e6faa1a4f7210bc20

version

kernel32

user32

shell32

ole32

oleaut32

atl90

shlwapi

comctl32

msvcp90

msvcr90

generic