354aac3586cde858c51970fb8557be53_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

354aac3586cde858c51970fb8557be53_JaffaCakes118
Size

3.8MB
MD5

354aac3586cde858c51970fb8557be53
SHA1

b7b9073fb0685976bc3d7fb26d0a1974f0194831
SHA256

ddfa4f03cd8b9e6d5d9af9ed7977c274bf5e039d9bf6680ee7e78495847050c3
SHA512

7b54006273f6b1bb1011efb15ee6c54223a6437a8c68cee8bcfc9d7ef134bfc0b3addfeb6e9fcbaadeb93137fd8b83ba70ad422573675ba91a35bb3a2cc7dbd1
SSDEEP

49152:FTD2xt+NTTa6FW1vBgHvvqxCR2nyThjI5TKwWznPjL:RrYBuqxjnmI0DznPjL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
354aac3586cde858c51970fb8557be53_JaffaCakes118

Files

354aac3586cde858c51970fb8557be53_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c97bcfc00fbf91fa1f20ebe4a8ab091a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\tasks\code\tasks\factory\sourcenow\binary\objfre_wlh_x86\i386\WRSA.pdb

Imports

gdiplus

GdiplusStartup
GdipLoadImageFromStream
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageRect
GdiplusShutdown

ole32

CreateStreamOnHGlobal

ws2_32

getaddrinfo
WSAAddressToStringA
freeaddrinfo
htons
gethostbyname
inet_addr
socket
connect
send
closesocket

advapi32

SetSecurityInfo
SetFileSecurityW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegNotifyChangeKeyValue
SetEntriesInAclW
GetUserNameW
CreateProcessAsUserW
OpenSCManagerA
OpenServiceW
CloseServiceHandle
OpenProcessToken
DuplicateTokenEx
SetThreadToken
CreateWellKnownSid
CheckTokenMembership
GetTokenInformation
RegCreateKeyExW
RegSetValueExW
RegCloseKey
ConvertStringSidToSidW
SetTokenInformation
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
FreeSid

kernel32

GetCurrentThreadId
GetSystemTime
LocalFileTimeToFileTime
CreateThread
MultiByteToWideChar
WideCharToMultiByte
GetLastError
GetCurrentProcess
FreeLibrary
LoadLibraryW
GlobalFree
ReleaseMutex
WaitForSingleObject
CreateMutexW
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
VerLanguageNameW
InterlockedExchange
GetTickCount
VerifyVersionInfoW
VerSetConditionMask
InterlockedIncrement
SetEvent
InterlockedDecrement
InterlockedExchangeAdd
ReadProcessMemory
VirtualQueryEx
OpenProcess
RemoveDirectoryW
Sleep
GetShortPathNameW
DuplicateHandle
VirtualProtectEx
ExitProcess
DeleteFileW
GetProcessTimes
GetSystemTimeAsFileTime
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
WriteFile
SetFilePointer
CreateEventW
DeleteFileA
CreateFileA
LocalAlloc
ReadFile
GetFileSize
GetVersionExW
GetCurrentProcessId
GetModuleHandleW
GetFileAttributesW
TerminateProcess
SetUnhandledExceptionFilter
GetUserDefaultUILanguage
GetLocalTime
GetDriveTypeW
GetTimeFormatW
GetDateFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
CheckRemoteDebuggerPresent
GetExitCodeProcess
WaitForSingleObjectEx
CreateDirectoryW
WritePrivateProfileStringA
GetPrivateProfileStringA
LoadLibraryA
QueryDosDeviceW
SystemTimeToFileTime
GetDiskFreeSpaceExW
GetVolumeInformationW
GetSystemDirectoryA
GetCurrentThread
OutputDebugStringA
GetSystemInfo
ResumeThread
CreateRemoteThread
GetProcessIoCounters
SetThreadPriority
MoveFileW
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
GetPrivateProfileStringW
GetComputerNameW
GetFileSizeEx
GetLocaleInfoW
ProcessIdToSessionId
AssignProcessToJobObject
InterlockedCompareExchange
SetErrorMode
SetFileAttributesW
CopyFileW
OpenThread
Thread32Next
Thread32First
CreateToolhelp32Snapshot
CreateFileMappingW
GetSystemPowerStatus
CreateDirectoryA
GetFileAttributesA
ExpandEnvironmentStringsW
WinExec
GetCommandLineW
TryEnterCriticalSection
SetCurrentDirectoryW
GetCurrentDirectoryW
TerminateThread
WaitForMultipleObjects
GetCommandLineA
AddVectoredExceptionHandler
GetFileType
GetStdHandle
SetEndOfFile
FlushFileBuffers
FindClose
GetProcessAffinityMask
TzSpecificLocalTimeToSystemTime
CompareStringW
IsDBCSLeadByte
GetCPInfo
CreateSemaphoreW
ReleaseSemaphore
SetFileTime
FoldStringW
SetThreadExecutionState
GetSystemDirectoryW
ResetEvent
SystemTimeToTzSpecificLocalTime
lstrlenA
lstrlenW
FindNextFileW
FindFirstFileW
GetFullPathNameW
CreateHardLinkW
GetLongPathNameW
AreFileApisANSI
LocalFree
DeviceIoControl
HeapReAlloc
HeapAlloc
GetProcessHeap
HeapFree
SetHandleInformation
CloseHandle
GetModuleHandleA
GetProcAddress
GetStartupInfoA
RtlUnwind
QueryPerformanceCounter
UnhandledExceptionFilter
CreateFileW
GetVersion

gdi32

SetPixel
RoundRect
Rectangle
BitBlt
SetWorldTransform
SetGraphicsMode
PatBlt
CreateSolidBrush
CreateCompatibleBitmap
CreateDIBSection
CreatePen
GetStockObject
LineTo
MoveToEx
ExcludeClipRect
SelectClipRgn
IntersectClipRect
StretchBlt
SetBrushOrgEx
SetStretchBltMode
SetDCBrushColor
SetDCPenColor
SetBkMode
SetTextColor
CombineRgn
CreateRoundRectRgn
CreateFontA
GetPixel
DeleteDC
DeleteObject
GetObjectW
CreateCompatibleDC
SelectObject
SetBkColor
ExtTextOutW
GetDeviceCaps
CreateRectRgn

user32

FindWindowW
GetWindowTextA
EnumWindows
MessageBeep
UnhookWinEvent
SetWinEventHook
GetFocus
OemToCharBuffA
CharLowerW
CharUpperW
CharToOemBuffW
OemToCharA
CharToOemA
SwitchToThisWindow
WaitForInputIdle
SendMessageW
GetDlgItem
CallNextHookEx
GetClassNameW
GetGUIThreadInfo
GetWindowThreadProcessId
GetForegroundWindow
GetAsyncKeyState
MapVirtualKeyExW
GetKeyboardLayout
SendInput
PostMessageW
SetLayeredWindowAttributes
SetWindowLongW
GetWindowLongW
MoveWindow
ReleaseDC
GetWindowRect
GetDC
FindWindowA
SetRect
ClientToScreen
DestroyWindow
SetWindowPos
SetWindowTextW
InvalidateRect
SetFocus
SetForegroundWindow
AttachThreadInput
ShowWindow
IsIconic
GetSystemMetrics
GetWindowTextW
SetCursor
LoadCursorW
EnableWindow
DefWindowProcW
SystemParametersInfoW
LoadImageW
DrawTextW
GetDesktopWindow
SetWindowRgn
GetClientRect
MapWindowPoints
GetMessagePos
GetCursorPos
CreateWindowExW
CallWindowProcW
PostQuitMessage
UpdateWindow
EndPaint
FillRect
BeginPaint
DrawTextA
FindWindowExW
FindWindowExA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
PtInRect
MessageBoxW
PostThreadMessageW
LockWorkStation
keybd_event
GetAncestor
DestroyIcon
LoadImageA
CheckMenuItem
EnumDisplayDevicesW
IsWindowVisible
wsprintfW
GetGuiResources
GetWindowDC
SetWindowTextA
GetMessageExtraInfo
UnhookWindowsHookEx
SetWindowsHookExW
OffsetRect
DrawFrameControl
InflateRect
GetClassNameA
EnableMenuItem
CreateDesktopW
KillTimer
SetTimer
DrawIcon
IsWindow
ScreenToClient
EqualRect
GetMonitorInfoW
MonitorFromRect
GetShellWindow
DispatchMessageW
TranslateMessage
GetMessageW
SetMessageExtraInfo

msvcrt

rand
srand
strftime
localtime
isspace
islower
isxdigit
isdigit
towlower
strncat
_strupr
_strlwr
strstr
_strnicmp
_stricmp
strrchr
strchr
strncpy
_vsnprintf
_wcslwr
_wcsicmp
_wcsnicmp
wcsncpy
wcsncat
_vsnwprintf
iswctype
memcpy
memmove
wcschr
ceil
_CIlog
_strdup
_snprintf
strncmp
qsort
sscanf
isprint
isalnum
sprintf
isalpha
malloc
free
_open
_read
_write
_close
_lseek
_wtoi
_except_handler3
_itoa
_CIsin
_CIcos
time
atol
realloc
calloc
_CIpow
system
towupper
wcsstr
wcsncmp
fopen
fread
fwrite
tolower
fseek
fclose
ferror
atoi
_itow
mbstowcs
isupper
_ltoa
bsearch
_snwprintf
_wtoi64
wcstoul
strpbrk
??0exception@@QAE@XZ
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??3@YAXPAX@Z
??0exception@@QAE@ABV0@@Z
_fileno
exit
_CxxThrowException
??2@YAPAXI@Z
wcspbrk
clock
wcsrchr
_vscwprintf
longjmp
_setjmp3
__CxxFrameHandler
_errno
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
_acmdln
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
_controlfp
mbtowc
__mb_cur_max
isleadbyte
localeconv
_iob
__badioinfo
__pioinfo
_lseeki64
_isatty
toupper
memset
ftell

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c97bcfc00fbf91fa1f20ebe4a8ab091a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdiplus

ole32

ws2_32

advapi32

kernel32

gdi32

user32

msvcrt

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.data Size: 22KB - Virtual size: 43KB

.rsrc Size: 1.9MB - Virtual size: 1.9MB

.reloc Size: 78KB - Virtual size: 77KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 22KB - Virtual size: 43KB

.rsrc
Size: 1.9MB - Virtual size: 1.9MB

.reloc
Size: 78KB - Virtual size: 77KB