f99fb156d2080f1e73c9e6da50b26fad_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f99fb156d2080f1e73c9e6da50b26fad_JaffaCakes118
Size

255KB
MD5

f99fb156d2080f1e73c9e6da50b26fad
SHA1

fcd4952224c5bf6d8ca8e922c005c1fb1ea04a26
SHA256

3ec822a8b8790666c0198871728efcc5a7130fafd450085bf870d8d11b61edd9
SHA512

559424e0e013844a2a9d2676e59d68303b8735a1cf8d5868423231f732c88983d4507823e385ac04f0a71e76af4e1aad6188e29f85efe4c5db1e98a0273846a0
SSDEEP

6144:8fK9TB2oX+3PU4yj4oVDyLiMRgxnnMACDvprIvxo:8fK9ToHU40PEi/RnDmwx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f99fb156d2080f1e73c9e6da50b26fad_JaffaCakes118

Files

f99fb156d2080f1e73c9e6da50b26fad_JaffaCakes118
.exe windows:5 windows x86 arch:x86

8d32783cf1879355ee8a047c61ef550d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FileTimeToLocalFileTime
SetFileAttributesW
SetEndOfFile
SetFilePointerEx
SetFileTime
ReadFile
GetFileSizeEx
GetFileTime
DeleteFileW
GetFileInformationByHandle
GetNativeSystemInfo
GetDriveTypeW
GetSystemDefaultUILanguage
GetLogicalDrives
GetProcessTimes
GetModuleFileNameW
lstrcmpW
GlobalMemoryStatusEx
GetUserDefaultUILanguage
GetDiskFreeSpaceExW
GetVolumeInformationW
ExitProcess
SetErrorMode
GetComputerNameW
GetVersionExW
lstrcatW
OpenEventW
GetCurrentProcessId
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
HeapCreate
GetTempPathW
lstrcpyA
VirtualProtectEx
GetThreadContext
SetThreadContext
GetProcessId
TryEnterCriticalSection
SetThreadPriority
ResetEvent
TlsGetValue
TlsSetValue
TerminateProcess
GlobalLock
GlobalUnlock
CreateMutexW
OpenMutexW
MoveFileExW
FindFirstFileW
FindClose
FindNextFileW
InterlockedIncrement
InterlockedDecrement
TlsAlloc
TlsFree
CreateDirectoryW
VirtualFree
VirtualAlloc
RemoveDirectoryW
WTSGetActiveConsoleSessionId
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
RtlUnwind
OutputDebugStringA
SetFilePointer
GetTempFileNameW
DosDateTimeToFileTime
FileTimeToDosDateTime
Process32NextW
Process32FirstW
CreateRemoteThread
ReleaseMutex
GetCurrentThreadId
lstrlenW
TerminateThread
lstrcpyW
SetLastError
GetHandleInformation
WriteProcessMemory
VirtualAllocEx
VirtualFreeEx
IsBadReadPtr
ResumeThread
DuplicateHandle
GetCommandLineW
lstrcmpiA
lstrcmpA
GetLocalTime
GetTimeZoneInformation
SystemTimeToFileTime
LocalFree
ExpandEnvironmentStringsW
GetSystemTime
Sleep
WaitForMultipleObjects
CreateEventW
GetExitCodeThread
VirtualQueryEx
SetEvent
lstrcpynA
CreateThread
CreateToolhelp32Snapshot
lstrcmpiW
LoadLibraryA
GetLastError
Thread32Next
LoadLibraryW
Thread32First
OpenProcess
GetCurrentThread
CreateProcessW
FreeLibrary
GetEnvironmentVariableW
GetProcAddress
GetPrivateProfileIntW
FlushFileBuffers
GetFileAttributesW
GetPrivateProfileStringW
GetModuleHandleW
lstrlenA
VirtualProtect
WriteFile
WaitForSingleObject
GetVolumeNameForVolumeMountPointW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
MapViewOfFile
GetTickCount
QueryPerformanceCounter
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
CreateFileMappingW
CreateFileW
UnmapViewOfFile
ReadProcessMemory

user32

GetUpdateRect
IntersectRect
GetDCEx
PostThreadMessageW
EqualRect
PrintWindow
DefWindowProcW
GetUpdateRgn
EndPaint
ToUnicode
GetClipboardData
GetKeyboardState
TranslateMessage
DispatchMessageW
MsgWaitForMultipleObjects
OpenWindowStationW
GetUserObjectInformationW
SetThreadDesktop
CloseDesktop
OpenDesktopW
GetProcessWindowStation
BeginPaint
CloseWindowStation
GetThreadDesktop
SetProcessWindowStation
CreateDesktopW
GetShellWindow
RegisterClassA
DefFrameProcW
CallWindowProcW
EndMenu
CallWindowProcA
RegisterClassW
HiliteMenuItem
DefMDIChildProcA
MapVirtualKeyW
RegisterClassExA
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
GetSubMenu
DefDlgProcW
DrawEdge
FillRect
GetWindowDC
CreateWindowStationW
DefFrameProcA
OpenInputDesktop
MenuItemFromPoint
GetMenu
CharToOemW
GetCursorPos
GetIconInfo
DrawIcon
IsRectEmpty
GetWindowThreadProcessId
GetMessagePos
MapWindowPoints
SendMessageW
ReleaseCapture
CharLowerA
GetTopWindow
LoadImageW
WindowFromPoint
GetDC
ReleaseDC
SetWindowLongW
GetWindow
CharLowerW
ExitWindowsEx
CharUpperW
GetLastInputInfo
GetSystemMetrics
GetMessageA
GetWindowRect
GetMessageW
SetCapture
PostMessageW
IsWindow
SendMessageTimeoutW
SetWindowPos
RegisterClassExW
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
GetMenuItemCount
DefDlgProcA
PeekMessageA
PeekMessageW
GetAncestor
GetWindowLongW
SetCursorPos
GetCapture
GetClassLongW
GetWindowInfo
GetParent

advapi32

RegCreateKeyExW
CryptVerifySignatureW
CryptGetKeyParam
CryptImportKey
CryptDestroyKey
CryptDestroyHash
RegCloseKey
OpenProcessToken
GetSidSubAuthority
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
CreateProcessAsUserW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptGetHashParam
CryptAcquireContextW
CryptReleaseContext
CryptCreateHash
CryptHashData
GetLengthSid
IsWellKnownSid
ConvertSidToStringSidW
InitiateSystemShutdownExW
EqualSid

shlwapi

PathUnquoteSpacesW
PathSkipRootW
PathMatchSpecW
UrlUnescapeA
PathAddExtensionW
PathIsDirectoryW
wvnsprintfA
wvnsprintfW
PathIsURLW
PathFindExtensionW
PathQuoteSpacesW
PathGetDriveNumberW
PathFindFileNameW
StrCmpNIA
StrChrA
StrCmpNW
StrCmpNIW
StrCmpNA
StrChrW
StrCmpIW
StrRChrA
SHDeleteKeyW
SHDeleteValueW
ord14
PathRemoveBackslashW
PathAddBackslashW
PathRemoveFileSpecW

shell32

ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW

secur32

GetUserNameExW
EncryptMessage
DecryptMessage

ole32

CoInitializeEx
CoInitializeSecurity
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoSetProxyBlanket
CreateStreamOnHGlobal
StringFromGUID2
CLSIDFromString

gdi32

GdiFlush
CreateCompatibleDC
SetRectRgn
CreateDIBSection
GetDIBits
SaveDC
RestoreDC
BitBlt
DeleteDC
GetDeviceCaps
CreateDCW
SelectObject
DeleteObject
SetViewportOrgEx
CreateCompatibleBitmap

ws2_32

sendto
setsockopt
shutdown
getsockname
WSAEventSelect
WSAEnumNetworkEvents
recvfrom
WSAStartup
getaddrinfo
select
freeaddrinfo
WSARecv
WSASend
WSACleanup
recv
bind
socket
WSACreateEvent
WSASetLastError
closesocket
send
getsockopt
listen
WSAAddressToStringA
WSAStringToAddressW
accept
WSAGetLastError
WSACloseEvent
getpeername
WSAIoctl
connect

crypt32

CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData
PFXExportCertStoreEx

wininet

InternetCrackUrlA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
InternetSetStatusCallbackA
HttpSendRequestExW
HttpSendRequestExA
InternetSetCookieA
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
InternetReadFile
HttpQueryInfoA
InternetConnectA
InternetQueryOptionW
InternetSetOptionA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetInfo

iphlpapi

GetAdaptersAddresses

msvcrt

_errno
memcpy
memset
_purecall
abs
_ultoa
memcmp
strcmp
_wtoi
_ultow
memchr
_vsnwprintf
_vsnprintf
memmove
_except_handler3

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

Sections

.text
Size: 241KB - Virtual size: 240KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8d32783cf1879355ee8a047c61ef550d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

iphlpapi

msvcrt

version

Sections

.text Size: 241KB - Virtual size: 240KB

.data Size: 2KB - Virtual size: 9KB

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 241KB - Virtual size: 240KB

.data
Size: 2KB - Virtual size: 9KB

.reloc
Size: 11KB - Virtual size: 10KB