0c3f250ae6994e6e6c757e44f138eb57_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0c3f250ae6994e6e6c757e44f138eb57_JaffaCakes118
Size

328KB
MD5

0c3f250ae6994e6e6c757e44f138eb57
SHA1

c70771962b2863101a1dfa4aeb185095b65301f7
SHA256

13c487e173735d7d232a0b34edc03db3e39b0f796d8126cdf7d04a08288cb4e1
SHA512

64a4c3cc5d91d7a7856881353926ce2e3ac1da43e3eb75404580b975edd354cf0b465d073feff01d1676eb0aeec3b1bac67aedb9b1086e0e949a1ce34847638f
SSDEEP

6144:uOumV7uvZe4dq5aI7hcevQb6EGQP05SajslCsjbWvVfIKm:nPV7uvZeTUIZU66CSagxKXm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c3f250ae6994e6e6c757e44f138eb57_JaffaCakes118

Files

0c3f250ae6994e6e6c757e44f138eb57_JaffaCakes118
.exe windows:4 windows x86 arch:x86

07aa61d3714ff4089f147bf57c6b26be

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

winmm

mixerGetControlDetailsA
mixerClose
mixerGetNumDevs
mixerSetControlDetails
mixerGetLineControlsA
mixerGetLineInfoA
mixerOpen
mixerGetDevCapsA

shlwapi

SHDeleteKeyA

mfc42

ord765
ord924
ord1768
ord6241
ord941
ord1146
ord2818
ord668
ord3337
ord3811
ord1980
ord2770
ord356
ord860
ord2915
ord537
ord1175
ord2864
ord535
ord6401
ord3870
ord5710
ord3499
ord2515
ord355
ord922
ord6877
ord939
ord2820
ord4224
ord2393
ord690
ord1988
ord5207
ord389
ord1140
ord6648
ord4129
ord3880
ord3425
ord3054
ord3810
ord5807
ord5204
ord3229
ord919
ord3693
ord5787
ord5788
ord283
ord2575
ord4396
ord3574
ord609
ord2370
ord2642
ord3097
ord6696
ord3996
ord3286
ord6675
ord6907
ord6888
ord2582
ord4402
ord3370
ord3640
ord693
ord6007
ord3998
ord4278
ord3301
ord2411
ord2023
ord4218
ord2578
ord4398
ord3582
ord616
ord6282
ord5683
ord3874
ord1779
ord4055
ord3716
ord801
ord790
ord541
ord2301
ord6143
ord6334
ord6111
ord6883
ord4202
ord5861
ord686
ord384
ord2862
ord2096
ord5651
ord3616
ord1997
ord5465
ord798
ord3127
ord5194
ord350
ord533
ord3698
ord656
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5714
ord4622
ord3738
ord815
ord561
ord2621
ord1134
ord1205
ord6438
ord1147
ord1232
ord5572
ord5355
ord665
ord1979
ord6385
ord5186
ord354
ord5289
ord2725
ord2827
ord2580
ord4400
ord3630
ord682
ord4275
ord6242
ord6676
ord6929
ord2763
ord3303
ord4271
ord3398
ord3733
ord810
ord2453
ord6008
ord3297
ord5981
ord3914
ord6889
ord536
ord4000
ord3721
ord795
ord3089
ord3571
ord2971
ord5759
ord6192
ord5756
ord6186
ord4330
ord6189
ord6021
ord5873
ord5794
ord5678
ord5736
ord5579
ord5571
ord6061
ord5864
ord3596
ord1576
ord4243
ord2639
ord3293
ord955
ord1176
ord3584
ord543
ord803
ord6283
ord1105
ord928
ord940
ord3742
ord2754
ord1871
ord4220
ord2584
ord3654
ord2863
ord2438
ord1644
ord773
ord501
ord1083
ord2762
ord5607
ord5600
ord5621
ord6905
ord1949
ord4034
ord1795
ord4023
ord4284
ord2243
ord861
ord2764
ord926
ord2688
ord818
ord2135
ord567
ord4424
ord3402
ord5290
ord1776
ord6055
ord2379
ord5953
ord4853
ord4376
ord6453
ord5241
ord470
ord323
ord2860
ord1640
ord5785
ord2405
ord2244
ord5789
ord6172
ord640
ord755
ord3619
ord4476
ord5875
ord823
ord2086
ord6197
ord6215
ord1168
ord2116
ord6880
ord4710
ord2859
ord3797
ord3138
ord4299
ord3092
ord6199
ord4234
ord2302
ord2414
ord3626
ord3663
ord825
ord324
ord540
ord1641
ord858
ord800
ord641
ord3597
ord4425
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5280
ord4353
ord6374
ord5163
ord2385
ord4407
ord1775
ord4078
ord6052
ord2514
ord4998
ord5265
ord3573
ord3610
ord6194

msvcrt

_setmbcp
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
__CxxFrameHandler
atoi
_mbscmp
malloc
sprintf
_ftol
_splitpath
strtok
_mbsicoll
qsort
__p___argv
__p___argc
atol
_beginthreadex
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
_CxxThrowException
printf
_mbsicmp
??1type_info@@UAE@XZ
_except_handler3
?terminate@@YAXXZ

kernel32

GetProcAddress
FreeLibrary
GetSystemInfo
IsProcessorFeaturePresent
GetTempPathA
GetWindowsDirectoryA
GetDiskFreeSpaceExA
GetLogicalDriveStringsA
GetDriveTypeA
GlobalMemoryStatus
GetComputerNameA
FindFirstFileA
FindNextFileA
GetLastError
GetExitCodeThread
GetCurrentProcess
GetVersionExA
CreateDirectoryA
CreateFileA
SetFilePointer
LockFile
TerminateThread
LoadLibraryA
GetCurrentThreadId
CreateProcessA
CloseHandle
GetPrivateProfileStringA
WritePrivateProfileStringA
DeleteFileA
Sleep
MulDiv
FindResourceA
GlobalUnlock
GlobalLock
GlobalAlloc
CreateEventA
GlobalFree
ResetEvent
SetEvent
GetLongPathNameA
MultiByteToWideChar
lstrcmpiA
GetVersion
GetModuleHandleA
GetStartupInfoA
FileTimeToSystemTime
FileTimeToLocalFileTime
lstrlenA
lstrcatA
GetSystemDirectoryA
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
GetPriorityClass
OpenProcess
IsDBCSLeadByte
ReleaseMutex
CreateMutexA
GetModuleFileNameA
CopyFileA
OutputDebugStringA
GetFileAttributesA
lstrcpynA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
UnlockFile
LeaveCriticalSection
ResumeThread
SizeofResource
WriteFile
FindClose
LoadResource
LockResource

user32

DrawTextExA
ReleaseDC
GetWindowTextA
GetClassNameA
EnumWindows
GetWindowLongA
PtInRect
GrayStringA
IsWindow
TabbedTextOutA
SetRect
FillRect
GetSysColor
SetCursor
ReleaseCapture
GetParent
SetCapture
LoadCursorA
TrackPopupMenu
DrawTextA
GetSystemMetrics
GetDC
GetWindowRect
GetClientRect
LoadBitmapA
InvalidateRect
EnableWindow
PostMessageA
GetCursorPos
SetMenuDefaultItem
GetSubMenu
LoadMenuA
InflateRect
UpdateWindow
SetTimer
KillTimer
GetDlgCtrlID
SendMessageA
LoadIconA
RegisterWindowMessageA
DrawIcon
IsIconic
GetDesktopWindow
SetForegroundWindow
ExitWindowsEx
wsprintfA
AttachThreadInput
RedrawWindow
ShowWindow
DestroyIcon
LoadImageA
LoadStringA
GetClassInfoA
MessageBoxA
FindWindowA
GetForegroundWindow
GetWindowThreadProcessId

gdi32

GetTextExtentPoint32A
RoundRect
SelectObject
DeleteDC
DeleteObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
CreateCompatibleBitmap
CreateFontIndirectA
BitBlt
CreatePen
Rectangle
CreateDCA
GetObjectA
CreateCompatibleDC
StretchBlt
GetDeviceCaps
CreateSolidBrush
GetStockObject

advapi32

RegOpenKeyA
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegCreateKeyA
InitiateSystemShutdownA
AdjustTokenPrivileges
RegEnumValueA
RegDeleteValueA
RegEnumKeyExA
GetUserNameA
RegOpenKeyExA
OpenProcessToken
LookupPrivilegeValueA

shell32

ExtractIconExA
SHGetSpecialFolderPathA
SHGetFileInfoA
SHFileOperationA
ShellExecuteA
Shell_NotifyIconA

comctl32

ImageList_Remove
ImageList_GetImageCount
ImageList_AddMasked
_TrackMouseEvent
ImageList_ReplaceIcon

ole32

CoUninitialize
CoCreateInstance
CoInitialize
CreateStreamOnHGlobal

olepro32

ord251

msvcp60

?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??0logic_error@std@@QAE@ABV01@@Z
??_7out_of_range@std@@6B@
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1out_of_range@std@@UAE@XZ
??0out_of_range@std@@QAE@ABV01@@Z

msvcirt

??1ifstream@@UAE@XZ
??0ofstream@@QAE@PBDHH@Z
?openprot@filebuf@@2HB
??_Difstream@@QAEXXZ
?close@ifstream@@QAEXXZ
?read@istream@@QAEAAV1@PADH@Z
_mtunlock
?get@istream@@IAEAAV1@PADHH@Z
_mtlock
??0ifstream@@QAE@PBDHH@Z
??_Dofstream@@QAEXXZ
?close@ofstream@@QAEXXZ
??6ostream@@QAEAAV0@K@Z
?endl@@YAAAVostream@@AAV1@@Z
??6ostream@@QAEAAV0@PBD@Z
??1ios@@UAE@XZ
??1ofstream@@UAE@XZ

Sections

.text
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

07aa61d3714ff4089f147bf57c6b26be

Headers

File Characteristics

Imports

iphlpapi

version

winmm

shlwapi

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

olepro32

msvcp60

msvcirt

Sections

.text Size: 232KB - Virtual size: 231KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 12KB - Virtual size: 9KB

.rsrc Size: 28KB - Virtual size: 25KB

.text
Size: 232KB - Virtual size: 231KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 12KB - Virtual size: 9KB

.rsrc
Size: 28KB - Virtual size: 25KB