fbe24477ac923cfdfd7c566c8239d796_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fbe24477ac923cfdfd7c566c8239d796_JaffaCakes118
Size

90KB
MD5

fbe24477ac923cfdfd7c566c8239d796
SHA1

1af8eafa5bfaf182dc657778969382ea0eea9383
SHA256

d59ca59947d9b38c6c5c9cd4c6436c50931992fa130f1ea3a16e5d4350359c3f
SHA512

043cbe5a095a11c9d01dded92c42fd33c5b010f7958abaa0ca977455daf71896861aae71ed4a6204af82392236fe847361152468335148c564e3c4982c1bbf03
SSDEEP

1536:yYzjngUDo7qqQ3VmU74ldp9WqQByqjCx6ZsixzBedZjLsgMHdAPqgH3vI:FPFUg+ldWPQGnsixzBIKg93v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fbe24477ac923cfdfd7c566c8239d796_JaffaCakes118

Files

fbe24477ac923cfdfd7c566c8239d796_JaffaCakes118
.exe windows:4 windows x86 arch:x86

648b976be899be3bd09aefabb1300b8e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

HideCaret
CopyRect
CopyIcon
GetClientRect
SetDeskWallpaper
CallNextHookEx
CreateWindowStationW
SubtractRect
UnhookWinEvent
GetAncestor
MessageBoxExW
ShowScrollBar
IsCharAlphaA
DdeFreeDataHandle
SetClassLongW
GetProcessDefaultLayout
InsertMenuItemA
WINNLSGetIMEHotkey
GetThreadDesktop
LoadCursorFromFileW
SystemParametersInfoA
EmptyClipboard
CloseWindow
DdePostAdvise
VkKeyScanExA
FillRect
SetCapture
ToUnicode
SetDebugErrorLevel
DdeFreeStringHandle
FindWindowA
GetClassInfoW
SetWindowsHookExA
GetCursorInfo
DdeQueryConvInfo
GetCursor
CloseWindowStation
GetMenuItemInfoW
CharToOemBuffW
SetRectEmpty
GetWindowLongW
TileWindows
ScreenToClient
ChangeDisplaySettingsA
GetSubMenu
GetTitleBarInfo
PackDDElParam
EnumDesktopsA
IsIconic
DefWindowProcW
GetClassInfoExW
GetShellWindow
GetKeyboardLayout
DdeCreateStringHandleA
ScrollWindowEx
DdeSetUserHandle
CharLowerW
IsCharUpperA
ValidateRect
CharUpperA
SetSystemCursor
CopyAcceleratorTableW
CharPrevW
IsWindowUnicode
RegisterWindowMessageW
EnumDisplaySettingsW

ole32

PropVariantCopy
RevokeDragDrop
StgCreateDocfile
IIDFromString
CoCopyProxy
CoRegisterMallocSpy
OleRegEnumFormatEtc
CoTaskMemAlloc
CoImpersonateClient
OleCreateFromFileEx
StringFromGUID2
DllDebugObjectRPCHook
CoGetObject
GetConvertStg
OleGetIconOfFile
GetRunningObjectTable
ReleaseStgMedium
OleCreateLinkToFileEx
OleUninitialize
ReadOleStg
PropVariantClear
OleConvertIStorageToOLESTREAMEx
CoTreatAsClass
CoReleaseMarshalData
OleCreateLinkEx
OleCreateStaticFromData
WriteClassStm
CoMarshalHresult
CreatePointerMoniker
OleRegGetMiscStatus
UtConvertDvtd32toDvtd16
OleDuplicateData
OleConvertOLESTREAMToIStorageEx
OleCreateLink
OleLoadFromStream
UpdateDCOMSettings
OleFlushClipboard
OleCreateEmbeddingHelper
CoGetClassObject
StringFromCLSID
CoMarshalInterface
CoQueryReleaseObject
CoLockObjectExternal
CreateDataCache
OleDraw
StgOpenAsyncDocfileOnIFillLockBytes
EnableHookObject
OleCreateFromDataEx
CreateOleAdviseHolder
SetConvertStg
CoSwitchCallContext
CoQueryAuthenticationServices
CoInitialize
CoUnmarshalInterface
CoTaskMemFree
CoGetTreatAsClass
WriteFmtUserTypeStg
CreateAntiMoniker
StgOpenStorageOnILockBytes
CoCreateInstanceEx
CoUnmarshalHresult

advapi32

LookupPrivilegeValueW
RegQueryInfoKeyW
AddAuditAccessAce
AllocateAndInitializeSid
AccessCheckAndAuditAlarmW
ConvertSecurityDescriptorToAccessNamedW
EnumDependentServicesW
CryptContextAddRef
LookupSecurityDescriptorPartsA
ImpersonateNamedPipeClient
RegEnumKeyExA
RegDeleteValueA
BuildExplicitAccessWithNameA
CryptEnumProviderTypesW
CryptHashData
MapGenericMask
RegEnumValueA
GetSecurityDescriptorControl
CryptSetHashParam
CryptCreateHash
MakeAbsoluteSD
EnumServicesStatusA
CryptEnumProvidersA
RegDeleteKeyA
LookupAccountSidA
RegReplaceKeyW
SetEntriesInAccessListW
GetEffectiveRightsFromAclW
GetExplicitEntriesFromAclW
GetServiceDisplayNameA
ChangeServiceConfigW
RegLoadKeyA
SetEntriesInAccessListA
UnlockServiceDatabase
OpenSCManagerW
BuildSecurityDescriptorA
DuplicateToken
BackupEventLogA
CryptVerifySignatureW
AddAccessDeniedAce
CryptExportKey
EnumServicesStatusW
GetNamedSecurityInfoExW
CryptEnumProvidersW
RegSetValueW
GetAce
TrusteeAccessToObjectA
CryptImportKey
FreeSid
GetServiceDisplayNameW
BuildTrusteeWithSidW
SetServiceBits
BuildImpersonateExplicitAccessWithNameW
CryptAcquireContextW
LookupPrivilegeNameW
CreateProcessAsUserA

kernel32

GetLogicalDriveStringsW
GetHandleInformation
ConvertDefaultLocale
GetWindowsDirectoryA
GlobalFlags
VirtualProtect
LocalFileTimeToFileTime
LoadLibraryA
CloseHandle
MapViewOfFile
ReadConsoleInputW
GetProcessAffinityMask
UnhandledExceptionFilter
GetPriorityClass
SetSystemTime
EnumResourceTypesA
CreateFileA
SetThreadContext
GetTempFileNameW
UpdateResourceW
UpdateResourceA
SetConsoleActiveScreenBuffer
EnumDateFormatsW
CancelWaitableTimer
GetVolumeInformationA
QueueUserAPC
GetPrivateProfileSectionA
LocalFree
IsBadHugeWritePtr
IsBadHugeReadPtr
SetProcessPriorityBoost
lstrcmpW
GetVersion
EnumResourceLanguagesA
SetCommTimeouts
GetProfileStringA
SignalObjectAndWait
GetDiskFreeSpaceW
FindNextFileW
BeginUpdateResourceA
GetDriveTypeA
SetThreadAffinityMask
SetCommBreak
OpenMutexA
GetThreadPriorityBoost
GetPrivateProfileIntW
GetExitCodeThread
FormatMessageA
WriteTapemark
GetVersionExW
EndUpdateResourceA
EnumResourceTypesW
GetDevicePowerState
SearchPathW
OpenSemaphoreW
EnumCalendarInfoExA
GlobalFindAtomW
GetFullPathNameA
FindFirstFileW
ReadFile
QueryDosDeviceW
VirtualLock
SetFileAttributesW
ExitProcess
VirtualAlloc
MapViewOfFileEx
GetFileTime

shlwapi

SHRegQueryInfoUSKeyA
PathBuildRootA
SHRegWriteUSValueA
PathCommonPrefixW
PathStripToRootW
PathRemoveFileSpecW
PathAddExtensionA
wvnsprintfW
PathFileExistsW
UrlHashW
PathIsURLW
PathParseIconLocationW
PathGetDriveNumberA
StrFormatByteSizeW
StrStrW
StrCpyW
PathRelativePathToW
StrRChrIW
UrlUnescapeA
PathCompactPathW
UrlGetLocationA
wnsprintfW
StrCmpNA
PathIsURLA
SHStrDupW
PathRenameExtensionA
PathIsSameRootA
PathFindSuffixArrayA
ColorHLSToRGB
StrCatBuffW
PathQuoteSpacesW
SHCopyKeyW
SHCreateStreamOnFileW
PathSearchAndQualifyA
PathFindOnPathW
PathAppendW
StrRStrIA
PathSetDlgItemPathW
PathRemoveExtensionW
StrPBrkA
SHEnumValueW
StrCSpnIA
UrlCanonicalizeA
PathUnquoteSpacesA
SHSetThreadRef
SHRegDuplicateHKey
SHRegDeleteUSValueA
UrlIsNoHistoryW
PathUnmakeSystemFolderW
SHRegEnumUSKeyW
StrDupA
SHEnumKeyExA
StrFormatByteSize64A
UrlEscapeA
StrFormatByteSizeA
PathFileExistsA
PathIsDirectoryEmptyW
SHRegDeleteUSValueW
StrChrA
PathRemoveBlanksW
PathFindExtensionW
PathCompactPathA
StrStrA

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

648b976be899be3bd09aefabb1300b8e

Headers

DLL Characteristics

File Characteristics

Imports

user32

ole32

advapi32

kernel32

shlwapi

Sections

.text Size: 80KB - Virtual size: 79KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 12KB

.text
Size: 80KB - Virtual size: 79KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 12KB