faca19a6522caf6c1967ba441ba97839_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

faca19a6522caf6c1967ba441ba97839_JaffaCakes118
Size

232KB
MD5

faca19a6522caf6c1967ba441ba97839
SHA1

e53e8b9123f2c52cb9859b89d4d5b936e7cfb876
SHA256

0711ea27b4d107f0b2232a580e905110f56708aa551103d907c344ae3567bb49
SHA512

f7c252f912c47ca2df6bd4757cf24d571451a5b271c9be954351087b5bc9eb762b5bc9550de04e01d1d13574541e2e16c640773336526752a30149a692849bee
SSDEEP

3072:mxwUIWU09zfumpm2ZlVRyywyTqItG63/B4rTCsViN86DFEUcOjiQ6/OetrkZY7Q0:owUfU05XEol5j+GsVwTQWgkZY7QHU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
faca19a6522caf6c1967ba441ba97839_JaffaCakes118

Files

faca19a6522caf6c1967ba441ba97839_JaffaCakes118
.exe windows:5 windows x86 arch:x86

7ad1af28bb71bd2039bd7e05bdcff093

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesA
GetCommandLineW
GetFullPathNameW
FormatMessageW
LoadLibraryW
ExitProcess
UnmapViewOfFile
GetACP
GetOEMCP
WaitForSingleObject
SetLastError
GetDriveTypeW
DisableThreadLibraryCalls
GetCurrentProcessId
DeleteFileW
GetExitCodeProcess
GetCommandLineA
GetCurrentThreadId
VirtualAlloc
GetLastError

advapi32

CryptDestroyKey
RegQueryValueExW
InitializeSecurityDescriptor
ReportEventW
UnregisterTraceGuids
CheckTokenMembership
GetSidLengthRequired
GetTokenInformation
AllocateAndInitializeSid
CryptDestroyHash
ImpersonateLoggedOnUser
GetAce
RegCreateKeyW
RegisterTraceGuidsW
RegSetValueW
SetSecurityDescriptorGroup
DeleteService
SetSecurityDescriptorOwner
RegNotifyChangeKeyValue
RegQueryValueExA
CryptAcquireContextA
OpenSCManagerA
OpenSCManagerW
SetThreadToken
IsValidSid
RegCreateKeyA
GetSidSubAuthority
RegSetValueExW
GetSecurityDescriptorOwner
RegCreateKeyExA
SetSecurityDescriptorDacl
LookupAccountNameW
GetLengthSid
QueryServiceStatus
ConvertSidToStringSidW
SetNamedSecurityInfoW
RegisterEventSourceW

user32

SystemParametersInfoA
GetMenuItemCount
CharLowerW
GetSysColorBrush
ScreenToClient
MessageBoxW
GetMessageW
IsChild
PtInRect
GetMessagePos
ClientToScreen
FindWindowA
RegisterClassExW
KillTimer
RegisterWindowMessageA
DrawFocusRect
EnableWindow
GetClientRect
RegisterWindowMessageW
LoadImageW
CreateWindowExA
FindWindowW
PeekMessageA
SendMessageW
LoadCursorA
DialogBoxParamA
GetDlgItemTextA
GetKeyState
DialogBoxParamW
SetForegroundWindow
LoadIconA
GetClassNameW
SetTimer
IsRectEmpty
IsWindow
UnregisterClassW
SendDlgItemMessageA
MessageBoxA
DrawTextA
OffsetRect

version

VerFindFileW
GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA
GetFileVersionInfoA

shlwapi

PathFileExistsW
SHSetValueW
StrCpyNW
StrCatW
SHDeleteValueW
PathRemoveBlanksW
StrTrimW
PathFindExtensionW
PathIsRelativeW
StrStrIW
StrToIntExW
UrlIsW
StrRChrW
StrCmpNIW
StrChrW
StrCmpW
PathAppendW
PathCombineW
PathIsUNCW
StrRetToBufW
PathRemoveExtensionW
SHDeleteKeyW
wnsprintfW
SHDeleteKeyA
wnsprintfA
UrlUnescapeW
PathAppendA
SHStrDupW

shell32

SHGetFolderPathW
SHBrowseForFolderW
ShellExecuteA
SHGetSpecialFolderLocation
ShellExecuteExW
DragQueryFileA
ShellExecuteW
CommandLineToArgvW
SHGetDesktopFolder
SHBindToParent
DragQueryFileW
SHGetPathFromIDListW
SHGetFileInfoW

rpcrt4

RpcServerRegisterAuthInfoW
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
RpcStringBindingComposeW
RpcServerUseProtseqEpW
RpcEpResolveBinding
CStdStubBuffer_QueryInterface
UuidCreate
NdrDllRegisterProxy
RpcStringBindingParseW
IUnknown_QueryInterface_Proxy
NdrDllCanUnloadNow
RpcBindingFromStringBindingW
RpcStringFreeW
CStdStubBuffer_Invoke
UuidFromStringW
NdrClientCall2
RpcServerRegisterIfEx
UuidToStringA
CStdStubBuffer_IsIIDSupported
RpcServerUnregisterIf
RpcImpersonateClient
NdrStubForwardingFunction
NdrDllGetClassObject
IUnknown_Release_Proxy
NdrCStdStubBuffer2_Release
RpcStringFreeA
RpcBindingSetAuthInfoExW
CStdStubBuffer_Disconnect
RpcBindingSetAuthInfoW
NdrCStdStubBuffer_Release
CStdStubBuffer_CountRefs
RpcBindingToStringBindingW

ntdll

NtQueryDirectoryObject
NtCreateSection
RtlxAnsiStringToUnicodeSize
RtlUpcaseUnicodeStringToOemString
RtlTimeToSecondsSince1970
RtlUnicodeToMultiByteSize
RtlSizeHeap
RtlClearBits
NtQuerySystemInformation
RtlCopyLuid
RtlInitAnsiString
RtlAdjustPrivilege
RtlStringFromGUID
RtlEnterCriticalSection
RtlRaiseStatus
RtlInitializeResource
RtlDestroyEnvironment
NtQueryDirectoryFile
RtlAppendUnicodeToString
NtDelayExecution
NtReadFile
NtClose
NtTerminateProcess
RtlGetNtProductType
strchr
RtlRegisterWait
RtlInitializeCriticalSectionAndSpinCount

gdi32

GetBitmapBits
DeleteDC
CreateHalftonePalette
CreatePen
GetTextMetricsW
TextOutW
ExcludeClipRect
SelectObject
LPtoDP
CreateRectRgn
GetClipRgn
CreateFontIndirectA
GetBkColor
DPtoLP
GetClipBox

Sections

.tls
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.code
Size: 205KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.textbss
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7ad1af28bb71bd2039bd7e05bdcff093

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

user32

version

shlwapi

shell32

rpcrt4

ntdll

gdi32

Sections

.tls Size: 3KB - Virtual size: 2KB

.code Size: 205KB - Virtual size: 204KB

.idata Size: 4KB - Virtual size: 3KB

.idata Size: 2KB - Virtual size: 2KB

.idata Size: 4KB - Virtual size: 213KB

.textbss Size: 3KB - Virtual size: 2KB

.rsrc Size: 10KB - Virtual size: 9KB

.tls
Size: 3KB - Virtual size: 2KB

.code
Size: 205KB - Virtual size: 204KB

.idata
Size: 4KB - Virtual size: 3KB

.idata
Size: 2KB - Virtual size: 2KB

.idata
Size: 4KB - Virtual size: 213KB

.textbss
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 10KB - Virtual size: 9KB