0b6b9c09f69b37062b3d994c0553fea9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0b6b9c09f69b37062b3d994c0553fea9_JaffaCakes118
Size

776KB
MD5

0b6b9c09f69b37062b3d994c0553fea9
SHA1

d12466ac08590a2f95ea039152805a66f7d10406
SHA256

91f7679bc435376985529f146f3681f374834af713b3c8b9abe1dd92f905b6f9
SHA512

d68fc08b29e60ca74b4f03e4806a8dd56afd084749ee572e4e97fb3e13161b3464b5acbc200770769e93b75a7984fdd4200247842bf433d12ec02532ba1ab737
SSDEEP

12288:taX+Teo7IiQ7xemy7e2dIiWQYu6vApvo:UX+TZ7IV7f2dchu6vAho

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b6b9c09f69b37062b3d994c0553fea9_JaffaCakes118

Files

0b6b9c09f69b37062b3d994c0553fea9_JaffaCakes118
.exe windows:5 windows x86 arch:x86

0204cde0e835a334c5b96e034a0f84b8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

setup_wm.pdb

Imports

msvcrt

strncpy
wcsncpy
strrchr
strstr
_purecall
_wtoi
memmove
wcsncmp
_itow
wcslen
??3@YAXPAX@Z
free
malloc
wcscmp
strchr
ceil
strncat
time
calloc
wcsncat
wcstok
_wcsupr
iswalnum
_stricmp
_strlwr
_ftol
wcsrchr
swscanf
??2@YAPAXI@Z
_wcslwr
wcsstr
_wtol
strpbrk
iswalpha
iswdigit
wcspbrk
iswspace
_snwprintf
towupper
wcschr
_wcsicmp
_wcsnicmp
_controlfp
_onexit
__dllonexit
_except_handler3
__set_app_type
_vsnprintf
_endthread
_beginthreadex
_c_exit
_exit
_XcptFilter
_cexit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_vsnwprintf

advapi32

RegSetValueExA
RegSetValueExW
RegQueryInfoKeyW
RegQueryInfoKeyA
RegOpenKeyExW
RegOpenKeyExA
RegDeleteValueW
RegDeleteValueA
RegDeleteKeyW
RegDeleteKeyA
RegEnumValueW
RegEnumValueA
RegCreateKeyExW
RegCreateKeyExA
RegQueryValueExW
RegEnumKeyExA
RegEnumKeyExW
RegCloseKey
LookupPrivilegeValueA
LookupPrivilegeValueW
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
InitiateSystemShutdownExW
CloseServiceHandle
QueryServiceStatus
EnumDependentServicesW
ControlService
OpenServiceW
OpenSCManagerW
StartServiceW
RegQueryValueExA

kernel32

SetCurrentDirectoryA
RemoveDirectoryW
RemoveDirectoryA
QueryDosDeviceW
QueryDosDeviceA
OpenEventW
OpenEventA
lstrlenA
GetSystemDirectoryW
GetSystemDirectoryA
GetProfileStringW
GetProfileStringA
GetDriveTypeW
GetDriveTypeA
GetModuleHandleA
CreateProcessW
CreateProcessA
CreateMutexW
CreateMutexA
SetCurrentDirectoryW
WriteProfileStringA
WriteProfileStringW
WriteFile
GetFileSize
CompareStringW
GetDiskFreeSpaceA
GetShortPathNameW
GetShortPathNameA
GetWindowsDirectoryW
GlobalLock
GlobalAlloc
GlobalUnlock
GlobalFree
GetLocaleInfoW
GetTimeZoneInformation
CreateFileMappingW
CreateFileMappingA
GetVersionExW
WritePrivateProfileStringW
WritePrivateProfileStringA
SetFileAttributesW
SetFileAttributesA
IsBadWritePtr
IsBadReadPtr
MoveFileW
MoveFileA
MoveFileExW
MoveFileExA
LoadLibraryExW
LoadLibraryExA
LoadLibraryW
LoadLibraryA
GetTempPathW
GetTempPathA
GetPrivateProfileStringW
GetPrivateProfileStringA
lstrcpynW
GetModuleHandleW
GetModuleFileNameW
GetFileAttributesW
GetFileAttributesA
GetCurrentDirectoryW
GetCurrentDirectoryA
FindNextFileW
FindNextFileA
FindFirstFileW
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
DeleteFileW
DeleteFileA
CreateFileW
CreateEventW
CreateEventA
CreateDirectoryW
CreateDirectoryA
CompareStringA
CopyFileW
CopyFileA
SetLastError
GetWindowsDirectoryA
lstrlenW
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetEvent
EnterCriticalSection
LeaveCriticalSection
ResetEvent
DeleteCriticalSection
WaitForSingleObject
InitializeCriticalSection
ReleaseMutex
GetModuleFileNameA
FindFirstFileA
FindClose
CreateFileA
ReadFile
GetCommandLineW
GetProcAddress
FreeLibrary
CloseHandle
GetLastError
FileTimeToSystemTime
GetFileTime
GetExitCodeProcess
WaitForMultipleObjects
GetSystemDefaultLangID
SetEndOfFile
SetFilePointer
UnmapViewOfFile
MapViewOfFile
Sleep
InterlockedIncrement
InterlockedDecrement
CreateThread
HeapFree
HeapAlloc
GetProcessHeap
DeviceIoControl
GetUserDefaultLangID
SetErrorMode
GetVersion
GetExitCodeThread
GetLocaleInfoA
GetStartupInfoA

gdi32

CreateFontA
GetTextFaceA
ExtTextOutW
CreateFontIndirectW
CreateFontIndirectA
CreatePen
SelectObject
PatBlt
GetTextMetricsW
GetTextMetricsA
GetObjectW
GetObjectType
DeleteObject
SetBkColor
SetBkMode
SetTextColor
CreateSolidBrush
GetDeviceCaps
GetStockObject
CreateCompatibleDC
SetMapMode
GetObjectA
DeleteDC

user32

SetWindowTextW
SendDlgItemMessageW
LoadIconW
SendMessageW
LoadIconA
LoadCursorW
LoadCursorA
IsDialogMessageW
IsDialogMessageA
GetWindowTextW
GetWindowTextA
GetWindowLongW
GetWindowLongA
GetMessageW
GetMessageA
GetClassNameA
GetClassLongA
FindWindowW
FindWindowA
DrawTextW
DrawTextA
DispatchMessageW
DispatchMessageA
DefWindowProcW
DefWindowProcA
CreateWindowExW
CreateWindowExA
CreateDialogParamW
CreateDialogParamA
RegisterWindowMessageA
UnregisterClassW
UnregisterClassA
RegisterClassW
RegisterClassA
PostThreadMessageW
PostThreadMessageA
PostMessageW
PostMessageA
PeekMessageW
PeekMessageA
LoadImageW
LoadImageA
CallWindowProcW
CallWindowProcA
SendMessageA
SetWindowLongW
SetWindowLongA
FindWindowExA
FindWindowExW
CharNextA
MsgWaitForMultipleObjects
GetDesktopWindow
MoveWindow
SetCursor
DestroyCursor
GetScrollInfo
SetScrollInfo
ScrollWindow
GetActiveWindow
TranslateMessage
UpdateWindow
GetClientRect
IsWindow
BeginPaint
EndPaint
PostQuitMessage
InvalidateRect
GetSystemMetrics
SetWindowTextA
DestroyWindow
ShowWindow
EnableWindow
ScreenToClient
SetWindowPos
GetParent
GetDlgItem
GetWindowRect
GetDC
MapWindowPoints
DrawFocusRect
ReleaseDC
SetFocus
MessageBoxW
MessageBoxA
LoadStringW
LoadStringA

ole32

CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoCreateInstance
CoInitialize
CoUninitialize

comctl32

InitCommonControlsEx

shell32

ShellExecuteA
ShellExecuteW
SHGetPathFromIDListA
ShellExecuteExA
SHChangeNotify
SHGetSpecialFolderLocation
SHGetMalloc

wininet

InternetCrackUrlA
InternetCrackUrlW

setupapi

SetupFindNextLine
SetupGetBinaryField
SetupIterateCabinetA
SetupCloseInfFile

wintrust

WinVerifyTrust

wsock32

ioctlsocket
WSAStartup
WSACleanup
WSAAsyncGetHostByName
WSACancelAsyncRequest
socket
inet_ntoa
htons
connect
WSAGetLastError
select
__WSAFDIsSet
getsockopt
closesocket

mpr

WNetGetConnectionA
WNetCancelConnection2W
WNetAddConnection2W
WNetGetConnectionW

urlmon

ObtainUserAgentString
UrlMkSetSessionOption

shlwapi

PathGetCharTypeA
PathGetCharTypeW
PathRemoveBlanksW

oleaut32

SysAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SysFreeString
VariantInit
VariantClear
SysAllocString
SysStringLen

version

VerQueryValueW
VerQueryValueA
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA
GetFileVersionInfoW
GetFileVersionInfoA

Sections

.text
Size: 284KB - Virtual size: 280KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 484KB - Virtual size: 484KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0204cde0e835a334c5b96e034a0f84b8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

gdi32

user32

ole32

comctl32

shell32

wininet

setupapi

wintrust

wsock32

mpr

urlmon

shlwapi

oleaut32

version

Sections

.text Size: 284KB - Virtual size: 280KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 484KB - Virtual size: 484KB

.text
Size: 284KB - Virtual size: 280KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 484KB - Virtual size: 484KB