03ff6db996c087cfa342d64abbc2ddce_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

03ff6db996c087cfa342d64abbc2ddce_JaffaCakes118
Size

138KB
MD5

03ff6db996c087cfa342d64abbc2ddce
SHA1

d631e6945f3406cb1f7c405744d66074a82baae1
SHA256

5d32576eb5828b909231b3a7c7abd5afd68a908fd0ddecb6384d418f49b29fc2
SHA512

2982ab0253b71c78e1996d6abfa9ffaa6c944bc6eafb1c754158f0dfff155addfa1c644b011a58095e6f3cea079fc85cf0999cdad3e23ae1a9c83be64f1253de
SSDEEP

3072:teqAVWZkushrKFg7BuqCGFMSlPHUj5IcfFxoRUNZTxs83VrpP:tJASDYl1up8HUj5IcQUfxLrl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
03ff6db996c087cfa342d64abbc2ddce_JaffaCakes118

Files

03ff6db996c087cfa342d64abbc2ddce_JaffaCakes118
.exe windows:5 windows x86 arch:x86

fc202793ce3da02eb1c990e71ad2dee8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcmpiA
CreateMutexW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
GetNativeSystemInfo
CreateDirectoryW
LoadLibraryW
WTSGetActiveConsoleSessionId
SetFileAttributesW
GetEnvironmentVariableW
FileTimeToDosDateTime
GetTempFileNameW
HeapReAlloc
FindFirstFileW
SetEndOfFile
CreateProcessW
HeapAlloc
SystemTimeToFileTime
SetFilePointerEx
HeapFree
GetProcessHeap
IsBadReadPtr
SetFileTime
VirtualQueryEx
CreateEventW
WideCharToMultiByte
GlobalUnlock
HeapDestroy
HeapCreate
Thread32Next
ReadFile
GetTimeZoneInformation
MultiByteToWideChar
GetTempPathW
GetFileSizeEx
OpenMutexW
VirtualProtectEx
VirtualAllocEx
FindClose
RemoveDirectoryW
FindNextFileW
VirtualProtect
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
ExpandEnvironmentStringsW
SetLastError
GetLastError
GlobalLock
CreateThread
GetSystemTime
GetLocalTime
ReleaseMutex
GetCurrentThreadId
WriteProcessMemory
LocalFree
GetCurrentProcessId
LoadLibraryA
DuplicateHandle
OpenEventW
WaitForMultipleObjects
GetVersionExW
VirtualFree
GetComputerNameW
SetErrorMode
GetCommandLineW
ExitProcess
GetPrivateProfileIntW
FlushFileBuffers
CreateFileW
WriteFile
GetPrivateProfileStringW
ReadProcessMemory
GetModuleHandleW
GetProcAddress
FreeLibrary
GetFileAttributesExW
GetProcessId
EnterCriticalSection
VirtualAlloc
LeaveCriticalSection
InitializeCriticalSection
SetThreadContext
GetThreadContext
CloseHandle
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
VirtualFreeEx
OpenProcess
CreateRemoteThread
GetUserDefaultUILanguage
lstrcmpiW
GetModuleFileNameW
GetFileAttributesW
Sleep
GetTickCount
MoveFileExW
ResetEvent
SetThreadPriority
TerminateProcess
TlsSetValue
GetCurrentThread
SetEvent
WaitForSingleObject
Thread32First
TlsGetValue

user32

ToUnicode
GetWindowRect
GetParent
GetClassLongW
GetWindowLongW
GetAncestor
SetWindowPos
SendMessageTimeoutW
IsWindow
MapWindowPoints
GetWindowThreadProcessId
GetMessageA
RegisterClassExA
SetCapture
DefDlgProcW
DefFrameProcA
OpenInputDesktop
GetKeyboardState
TranslateMessage
RegisterClassExW
SetCursorPos
GetClipboardData
PeekMessageW
PeekMessageA
DefWindowProcA
SetKeyboardState
SwitchDesktop
DefDlgProcA
DefMDIChildProcA
ReleaseCapture
RegisterClassW
CharLowerW
GetMenuItemID
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharLowerA
CharUpperW
SetWindowLongW
GetWindow
DispatchMessageW
CharToOemW
CreateDesktopW
SetProcessWindowStation
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
CloseDesktop
SetThreadDesktop
OpenWindowStationW
RegisterWindowMessageW
GetSubMenu
OpenDesktopW
GetSystemMetrics
MenuItemFromPoint
GetThreadDesktop
GetCapture
GetMenu
CharLowerBuffA
TrackPopupMenuEx
SystemParametersInfoW
IsRectEmpty
DefWindowProcW
GetClassNameW
GetMenuState
GetMenuItemCount
HiliteMenuItem
CallWindowProcA
CallWindowProcW
GetMessagePos
DefFrameProcW
RegisterClassA
ExitWindowsEx
DrawIcon
GetIconInfo
GetCursorPos
EndPaint
GetUpdateRgn
GetMessageW
GetWindowDC
FillRect
PostMessageW
GetWindowInfo
DrawEdge
BeginPaint
GetUserObjectInformationW
EndMenu
GetShellWindow
MapVirtualKeyW
DefMDIChildProcW
SendMessageW
PrintWindow
EqualRect
PostThreadMessageW
ReleaseDC
GetDCEx
IntersectRect
GetDC
GetUpdateRect
GetMenuItemRect

advapi32

GetLengthSid
IsWellKnownSid
ConvertSidToStringSidW
EqualSid
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
RegEnumKeyExW
InitiateSystemShutdownExW

shlwapi

StrCmpNIW
PathRenameExtensionW
PathIsURLW
StrStrIW
StrStrIA
PathQuoteSpacesW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathRemoveBackslashW
PathRemoveFileSpecW

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

GetDeviceCaps
CreateCompatibleBitmap
CreateDIBSection
SetViewportOrgEx
DeleteDC
GdiFlush
DeleteObject
SelectObject
SetRectRgn
CreateCompatibleDC
GetDIBits
RestoreDC
SaveDC

ws2_32

accept
listen
WSASetLastError
freeaddrinfo
socket
bind
recv
recvfrom
sendto
WSAEventSelect
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
getsockname
shutdown
WSAGetLastError
getpeername
WSASend
closesocket
send
setsockopt

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
PFXImportCertStore
CryptUnprotectData

wininet

InternetQueryOptionA
InternetSetOptionA
InternetQueryOptionW
InternetOpenA
HttpOpenRequestA
InternetCrackUrlA
InternetConnectA
HttpSendRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFile
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpQueryInfoA
HttpSendRequestExA
InternetCloseHandle

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fc202793ce3da02eb1c990e71ad2dee8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 129KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 129KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB