04c86a2422821bd5be7363661ad907ba_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

04c86a2422821bd5be7363661ad907ba_JaffaCakes118
Size

776KB
MD5

04c86a2422821bd5be7363661ad907ba
SHA1

16a69ee3bc23936a3d821db8351e01f9b39703f6
SHA256

e2090c2079ba45ac7c1f83a777bb821a3d806d867d32cb4724a8d7e7f9aaa441
SHA512

31b733a6c2e45c95280926ab5e822f4c14ff3362cd801e440c92877c6581bde030a5c6c9e725bf2060ec13211eff2251643e32f0f9523e06b6c4cd8c7a38afef
SSDEEP

12288:daX+Teo7IiQ7xemy7e2dIiWQYu6vApvm:kX+TZ7IV7f2dchu6vAh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04c86a2422821bd5be7363661ad907ba_JaffaCakes118

Files

04c86a2422821bd5be7363661ad907ba_JaffaCakes118
.exe windows:5 windows x86 arch:x86

0204cde0e835a334c5b96e034a0f84b8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

setup_wm.pdb

Imports

msvcrt

strncpy
wcsncpy
strrchr
strstr
_purecall
_wtoi
memmove
wcsncmp
_itow
wcslen
??3@YAXPAX@Z
free
malloc
wcscmp
strchr
ceil
strncat
time
calloc
wcsncat
wcstok
_wcsupr
iswalnum
_stricmp
_strlwr
_ftol
wcsrchr
swscanf
??2@YAPAXI@Z
_wcslwr
wcsstr
_wtol
strpbrk
iswalpha
iswdigit
wcspbrk
iswspace
_snwprintf
towupper
wcschr
_wcsicmp
_wcsnicmp
_controlfp
_onexit
__dllonexit
_except_handler3
__set_app_type
_vsnprintf
_endthread
_beginthreadex
_c_exit
_exit
_XcptFilter
_cexit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_vsnwprintf

advapi32

RegSetValueExA
RegSetValueExW
RegQueryInfoKeyW
RegQueryInfoKeyA
RegOpenKeyExW
RegOpenKeyExA
RegDeleteValueW
RegDeleteValueA
RegDeleteKeyW
RegDeleteKeyA
RegEnumValueW
RegEnumValueA
RegCreateKeyExW
RegCreateKeyExA
RegQueryValueExW
RegEnumKeyExA
RegEnumKeyExW
RegCloseKey
LookupPrivilegeValueA
LookupPrivilegeValueW
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
InitiateSystemShutdownExW
CloseServiceHandle
QueryServiceStatus
EnumDependentServicesW
ControlService
OpenServiceW
OpenSCManagerW
StartServiceW
RegQueryValueExA

kernel32

SetCurrentDirectoryA
RemoveDirectoryW
RemoveDirectoryA
QueryDosDeviceW
QueryDosDeviceA
OpenEventW
OpenEventA
lstrlenA
GetSystemDirectoryW
GetSystemDirectoryA
GetProfileStringW
GetProfileStringA
GetDriveTypeW
GetDriveTypeA
GetModuleHandleA
CreateProcessW
CreateProcessA
CreateMutexW
CreateMutexA
SetCurrentDirectoryW
WriteProfileStringA
WriteProfileStringW
WriteFile
GetFileSize
CompareStringW
GetDiskFreeSpaceA
GetShortPathNameW
GetShortPathNameA
GetWindowsDirectoryW
GlobalLock
GlobalAlloc
GlobalUnlock
GlobalFree
GetLocaleInfoW
GetTimeZoneInformation
CreateFileMappingW
CreateFileMappingA
GetVersionExW
WritePrivateProfileStringW
WritePrivateProfileStringA
SetFileAttributesW
SetFileAttributesA
IsBadWritePtr
IsBadReadPtr
MoveFileW
MoveFileA
MoveFileExW
MoveFileExA
LoadLibraryExW
LoadLibraryExA
LoadLibraryW
LoadLibraryA
GetTempPathW
GetTempPathA
GetPrivateProfileStringW
GetPrivateProfileStringA
lstrcpynW
GetModuleHandleW
GetModuleFileNameW
GetFileAttributesW
GetFileAttributesA
GetCurrentDirectoryW
GetCurrentDirectoryA
FindNextFileW
FindNextFileA
FindFirstFileW
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
DeleteFileW
DeleteFileA
CreateFileW
CreateEventW
CreateEventA
CreateDirectoryW
CreateDirectoryA
CompareStringA
CopyFileW
CopyFileA
SetLastError
GetWindowsDirectoryA
lstrlenW
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetEvent
EnterCriticalSection
LeaveCriticalSection
ResetEvent
DeleteCriticalSection
WaitForSingleObject
InitializeCriticalSection
ReleaseMutex
GetModuleFileNameA
FindFirstFileA
FindClose
CreateFileA
ReadFile
GetCommandLineW
GetProcAddress
FreeLibrary
CloseHandle
GetLastError
FileTimeToSystemTime
GetFileTime
GetExitCodeProcess
WaitForMultipleObjects
GetSystemDefaultLangID
SetEndOfFile
SetFilePointer
UnmapViewOfFile
MapViewOfFile
Sleep
InterlockedIncrement
InterlockedDecrement
CreateThread
HeapFree
HeapAlloc
GetProcessHeap
DeviceIoControl
GetUserDefaultLangID
SetErrorMode
GetVersion
GetExitCodeThread
GetLocaleInfoA
GetStartupInfoA

gdi32

CreateFontA
GetTextFaceA
ExtTextOutW
CreateFontIndirectW
CreateFontIndirectA
CreatePen
SelectObject
PatBlt
GetTextMetricsW
GetTextMetricsA
GetObjectW
GetObjectType
DeleteObject
SetBkColor
SetBkMode
SetTextColor
CreateSolidBrush
GetDeviceCaps
GetStockObject
CreateCompatibleDC
SetMapMode
GetObjectA
DeleteDC

user32

SetWindowTextW
SendDlgItemMessageW
LoadIconW
SendMessageW
LoadIconA
LoadCursorW
LoadCursorA
IsDialogMessageW
IsDialogMessageA
GetWindowTextW
GetWindowTextA
GetWindowLongW
GetWindowLongA
GetMessageW
GetMessageA
GetClassNameA
GetClassLongA
FindWindowW
FindWindowA
DrawTextW
DrawTextA
DispatchMessageW
DispatchMessageA
DefWindowProcW
DefWindowProcA
CreateWindowExW
CreateWindowExA
CreateDialogParamW
CreateDialogParamA
RegisterWindowMessageA
UnregisterClassW
UnregisterClassA
RegisterClassW
RegisterClassA
PostThreadMessageW
PostThreadMessageA
PostMessageW
PostMessageA
PeekMessageW
PeekMessageA
LoadImageW
LoadImageA
CallWindowProcW
CallWindowProcA
SendMessageA
SetWindowLongW
SetWindowLongA
FindWindowExA
FindWindowExW
CharNextA
MsgWaitForMultipleObjects
GetDesktopWindow
MoveWindow
SetCursor
DestroyCursor
GetScrollInfo
SetScrollInfo
ScrollWindow
GetActiveWindow
TranslateMessage
UpdateWindow
GetClientRect
IsWindow
BeginPaint
EndPaint
PostQuitMessage
InvalidateRect
GetSystemMetrics
SetWindowTextA
DestroyWindow
ShowWindow
EnableWindow
ScreenToClient
SetWindowPos
GetParent
GetDlgItem
GetWindowRect
GetDC
MapWindowPoints
DrawFocusRect
ReleaseDC
SetFocus
MessageBoxW
MessageBoxA
LoadStringW
LoadStringA

ole32

CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoCreateInstance
CoInitialize
CoUninitialize

comctl32

InitCommonControlsEx

shell32

ShellExecuteA
ShellExecuteW
SHGetPathFromIDListA
ShellExecuteExA
SHChangeNotify
SHGetSpecialFolderLocation
SHGetMalloc

wininet

InternetCrackUrlA
InternetCrackUrlW

setupapi

SetupFindNextLine
SetupGetBinaryField
SetupIterateCabinetA
SetupCloseInfFile

wintrust

WinVerifyTrust

wsock32

ioctlsocket
WSAStartup
WSACleanup
WSAAsyncGetHostByName
WSACancelAsyncRequest
socket
inet_ntoa
htons
connect
WSAGetLastError
select
__WSAFDIsSet
getsockopt
closesocket

mpr

WNetGetConnectionA
WNetCancelConnection2W
WNetAddConnection2W
WNetGetConnectionW

urlmon

ObtainUserAgentString
UrlMkSetSessionOption

shlwapi

PathGetCharTypeA
PathGetCharTypeW
PathRemoveBlanksW

oleaut32

SysAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SysFreeString
VariantInit
VariantClear
SysAllocString
SysStringLen

version

VerQueryValueW
VerQueryValueA
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA
GetFileVersionInfoW
GetFileVersionInfoA

Sections

.text
Size: 284KB - Virtual size: 280KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 484KB - Virtual size: 484KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0204cde0e835a334c5b96e034a0f84b8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

gdi32

user32

ole32

comctl32

shell32

wininet

setupapi

wintrust

wsock32

mpr

urlmon

shlwapi

oleaut32

version

Sections

.text Size: 284KB - Virtual size: 280KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 484KB - Virtual size: 484KB

.text
Size: 284KB - Virtual size: 280KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 484KB - Virtual size: 484KB