e854e9a690072076d8687fb62efdc1a9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e854e9a690072076d8687fb62efdc1a9_JaffaCakes118
Size

1.9MB
MD5

e854e9a690072076d8687fb62efdc1a9
SHA1

0cf5badcfefee3e1fa4f84c431b3ad045df4c18a
SHA256

b4dd50c80a6aced42a8c3ed7ba2360d72206a6d4836a531ced31cf5c657b9a5b
SHA512

be4aeab283c5188a6b64f5d9253126ec918850da9d7b1628dee8cecf3f0ba6cd4374af600162dd57b9179f061a35f5196f9d0278d715e8a9000e2f64cede246f
SSDEEP

49152:OYR1EYNe0NvxLD6VjH8zZm3Of2drlxHgAor:MPOe8lm+f2d3s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e854e9a690072076d8687fb62efdc1a9_JaffaCakes118

Files

e854e9a690072076d8687fb62efdc1a9_JaffaCakes118
.exe windows:10 windows x64 arch:x64

a44b3470de1244b667e15e9877472c63

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

mip.pdb

Imports

advapi32

RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA

kernel32

GetTickCount
MulDiv
GlobalFree
GlobalUnlock
GlobalLock
FormatMessageW
GlobalAlloc
CreateSemaphoreExW
CreateMutexExW
GetCurrentProcessId
InitOnceComplete
InitializeCriticalSection
LeaveCriticalSection
InitOnceBeginInitialize
GetCommandLineW
HeapSetInformation
CreateEventW
OpenEventW
LockResource
GetModuleFileNameW
FindResourceExW
LoadResource
SizeofResource
MultiByteToWideChar
RaiseException
lstrcmpiW
LoadLibraryExW
FreeLibrary
OpenSemaphoreW
WaitForSingleObject
DeleteCriticalSection
EnterCriticalSection
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
CloseHandle
SetEvent
SetLastError
OutputDebugStringW
IsDebuggerPresent
GetLastError
GetModuleHandleW
GetProcAddress
DebugBreak
GetModuleFileNameA
GetModuleHandleExW
HeapAlloc
GetProcessHeap
GetACP
GetSystemDefaultLCID
GetVersionExA
GetProfileIntA
GetUserDefaultLCID
GetSystemDefaultLangID
DisableThreadLibraryCalls
ResetEvent
WaitForMultipleObjects
TryEnterCriticalSection
ResumeThread
SetThreadPriority
CreateThread
GetLocaleInfoW
GetUserDefaultUILanguage
FreeResource
FindResourceW
LoadLibraryW
LocalFree
LocalAlloc
GetProcessMitigationPolicy
OutputDebugStringA
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetStartupInfoW
Sleep
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
DecodePointer
EncodePointer
LoadLibraryExA
VirtualAlloc
GetCurrentProcess
VirtualFree
WideCharToMultiByte
GetStringTypeExW
HeapDestroy
HeapReAlloc
HeapSize
HeapFree
GetCurrentThreadId

gdi32

BitBlt
CreateDIBSection
GetRegionData
CreateSolidBrush
ExtSelectClipRgn
SetDIBColorTable
GetObjectW
SetStretchBltMode
OffsetRgn
ExtCreateRegion
GetDIBColorTable
StretchBlt
CreateFontIndirectW
GetTextMetricsW
GetTextExtentPointW
GetTextColor
SetBkMode
CreateCompatibleBitmap
CreateBitmap
GetBitmapBits
GetStockObject
Ellipse
CreateCompatibleDC
SetROP2
CreateFontW
Polyline
SetLayout
SetWindowExtEx
StretchDIBits
GetTextFaceW
GetCharABCWidthsW
GetCharWidthA
GetCharWidth32A
GetCharWidthW
GetOutlineTextMetricsA
ExtTextOutA
Escape
SetTextAlign
SetBkColor
GetObjectType
CreatePalette
SelectPalette
RealizePalette
EnumFontFamiliesExW
SetDCBrushColor
RestoreDC
DeleteDC
GetDeviceCaps
SetViewportOrgEx
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
CreateDCW
CombineRgn
CreateRectRgnIndirect
DeleteObject
SelectClipRgn
PatBlt
PtInRegion
CreateRectRgn
CreatePen
SelectObject
MoveToEx
LineTo
SetTextColor
CreateRoundRectRgn
CreateICW
ExtTextOutW
ScriptTextOut
ScriptGetLogicalWidths
ScriptItemize
ScriptPlace
ScriptShape
ScriptFreeCache
ScriptGetCMap
ScriptGetProperties
GetGlyphIndicesW
GetCurrentObject
GetBkColor
GetGlyphOutlineW
GetOutlineTextMetricsW
GetFontData
TranslateCharsetInfo
GetPixel
GetTextCharsetInfo
GetTextMetricsA
GetObjectA
CreateFontIndirectA

user32

GetThreadDesktop
SetProcessDPIAware
MsgWaitForMultipleObjectsEx
PeekMessageW
DispatchMessageW
GetUserObjectInformationW
CharNextW
PostThreadMessageW
CharUpperW
GetKeyboardLayout
GetKeyboardLayoutList
UnregisterClassW
SendMessageA
IsWindowUnicode
LoadCursorA
LoadBitmapA
LoadBitmapW
GetDoubleClickTime
SetCaretBlinkTime
InvertRect
DestroyCaret
MenuItemFromPoint
SetWindowLongW
WindowFromDC
GetSystemMetrics
DeleteMenu
MonitorFromRect
SetMenuItemInfoW
DestroyIcon
GetMessageTime
SetFocus
DestroyCursor
RegisterClassW
GetClassInfoW
CreateCursor
GetDesktopWindow
GetWindowDC
DrawTextW
SystemParametersInfoW
GetParent
DrawFrameControl
InflateRect
GetMessagePos
NotifyWinEvent
SendMessageW
GetPropW
TrackMouseEvent
SetPropW
RemovePropW
ScreenToClient
FrameRect
GetSysColorBrush
FillRect
SetWindowRgn
ValidateRect
GetUpdateRect
GetWindowLongW
EndDeferWindowPos
GetWindowRect
DeferWindowPos
BeginDeferWindowPos
ReleaseCapture
GetSysColor
EqualRect
DrawIconEx
IntersectRect
CreateWindowExW
GetClassInfoExW
RegisterClassExW
IsWindow
DestroyWindow
GetKeyState
PtInRect
UnionRect
IsChild
GetFocus
BeginPaint
GetClientRect
GetDC
ReleaseDC
EndPaint
GetClipboardFormatNameW
CallNextHookEx
GetWindowThreadProcessId
WindowFromPoint
AdjustWindowRectEx
OffsetRect
DestroyMenu
PostQuitMessage
SetMenuDefaultItem
AppendMenuW
GetCursorPos
CreatePopupMenu
KillTimer
SetTimer
LoadIconW
SendInput
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
RegisterClipboardFormatW
ClientToScreen
InvalidateRect
RegisterWindowMessageW
SetRectEmpty
UnhookWindowsHookEx
UnhookWinEvent
TrackPopupMenuEx
SetWinEventHook
SetWindowsHookExW
EndMenu
LoadCursorW
SetCursor
IsRectEmpty
CopyRect
CallWindowProcW
DefWindowProcW
GetWindowLongPtrW
SetWindowLongPtrW
UnregisterClassA
ShowWindow
EnumDisplayMonitors
GetMonitorInfoW
GetForegroundWindow
SetForegroundWindow
GetWindow
SetWindowPos
PostMessageW
SetCapture

msvcrt

ceilf
floorf
memcmp
memcpy
_ltow
_ltow_s
_wcsnicmp
_wcslwr_s
ceil
iswdigit
_wtol
_wcsicmp
_wtoi
wcscmp
memmove
memset
sqrtf
realloc
_errno
wcstol
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_commode
_fmode
_wcmdln
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_callnewh
vswprintf_s
_vscwprintf
wcsncmp
calloc
swprintf_s
_resetstkoflw
_purecall
wcscat_s
wcscpy_s
memmove_s
wcsncpy_s
??0exception@@QEAA@XZ
_vsnprintf_s
memcpy_s
_vsnwprintf
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
free
malloc
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException

ntdll

EtwEventWriteTransfer
RtlCaptureContext
EtwEventSetInformation
EtwEventUnregister
RtlLookupFunctionEntry
RtlVirtualUnwind
EtwEventRegister

ole32

RegisterDragDrop
CoCreateInstance
StringFromGUID2
CoInitialize
OleRegGetMiscStatus
OleUninitialize
CoTaskMemRealloc
CoTaskMemFree
OleInitialize
CoTaskMemAlloc
RevokeDragDrop
CreateOleAdviseHolder
OleRegGetUserType
OleLockRunning
CreateStreamOnHGlobal
CoGetClassObject
CoUninitialize
CoCreateFreeThreadedMarshaler
OleRegEnumVerbs

oleaut32

VariantClear
VariantInit
DispCallFunc
VarBstrCat
SysAllocStringLen
RegisterTypeLi
LoadTypeLi
SafeArrayDestroy
SafeArrayCreateVector
SysStringLen
LoadRegTypeLi
VarUI4FromStr
SysAllocString
SafeArrayUnaccessData
SafeArrayAccessData
VarBstrCmp
OleCreatePropertyFrame
SysAllocStringByteLen
SysStringByteLen
UnRegisterTypeLi
SysFreeString

oleacc

LresultFromObject
AccessibleObjectFromWindow

gdiplus

GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromScan0
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImageWidth
GdipCreateFromHDC
GdipDeleteGraphics
GdipFillRectangleI
GdipSetSolidFillColor
GdipCreatePen1
GdipSetClipRectI
GdipCreateLineBrushI
GdipCreatePen2
GdipSetPenColor
GdipDrawLineI
GdipDeletePen
GdipGetImageHeight
GdipGetImagePixelFormat
GdipCreateBitmapFromStream
GdipSetPenDashStyle
GdipSetPenDashArray
GdipDrawRectangleI
GdipGetDC
GdipReleaseDC
GdipFillEllipseI
GdipDrawEllipseI
GdiplusStartup
GdiplusShutdown
GdipDrawImageI
GdipCloneBrush
GdipCreateSolidFill
GdipDeleteBrush
GdipFree
GdipAlloc
GdipCreateFromHWND

shell32

Shell_NotifyIconW
ShellAboutW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

comctl32

ord8

uxtheme

GetThemePartSize
GetThemeMargins
DrawThemeText
DrawThemeIcon
DrawThemeEdge
GetThemeBackgroundRegion
IsThemeActive
OpenThemeData
DrawThemeTextEx
CloseThemeData
DrawThemeBackground
GetThemeColor

msimg32

AlphaBlend
GradientFill
TransparentBlt

dwmapi

DwmEnableBlurBehindWindow

Exports

Exports

?REExtendedRegisterClass@@YAHXZ

Sections

.text
Size: 917KB - Virtual size: 916KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 383KB - Virtual size: 383KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 400KB - Virtual size: 740KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a44b3470de1244b667e15e9877472c63

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

ole32

oleaut32

oleacc

gdiplus

shell32

version

comctl32

uxtheme

msimg32

dwmapi

Exports

Exports

Sections

.text Size: 917KB - Virtual size: 916KB

.rdata Size: 134KB - Virtual size: 134KB

.data Size: 31KB - Virtual size: 36KB

.pdata Size: 27KB - Virtual size: 27KB

.rsrc Size: 383KB - Virtual size: 383KB

.reloc Size: 400KB - Virtual size: 740KB

.text
Size: 917KB - Virtual size: 916KB

.rdata
Size: 134KB - Virtual size: 134KB

.data
Size: 31KB - Virtual size: 36KB

.pdata
Size: 27KB - Virtual size: 27KB

.rsrc
Size: 383KB - Virtual size: 383KB

.reloc
Size: 400KB - Virtual size: 740KB