609a36eafa8fa35b7518cca1f7ce9110_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

609a36eafa8fa35b7518cca1f7ce9110_JaffaCakes118
Size

618KB
MD5

609a36eafa8fa35b7518cca1f7ce9110
SHA1

9b150edfab79a2432403e4b82bf2845ff739e39e
SHA256

9f7390b0dad3a06f18f8c82fb9af7590de00ae5322bd31c70e3f8538c5d1611c
SHA512

16636fb0c6d69e4b1660f621d747ee9faf4488fd1035f5e87fe153e9604a2003f940719dc2b7b09143c38cc551e64148cfb3f82f5c3fae62aad6115f2a4ec7ce
SSDEEP

12288:re82Y0Wtx6C6OET19AMVJIGtM5qmvmybBx4Vbiqoy6sDkWfIVQWZ8219IKQ2p:K82XGxs7A2JI2M5xvmybBx4Vbiqoy6s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
609a36eafa8fa35b7518cca1f7ce9110_JaffaCakes118

Files

609a36eafa8fa35b7518cca1f7ce9110_JaffaCakes118
.exe windows:4 windows x86 arch:x86

28e3a58132364197d7cb29ee104004bf

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeap
Process32Next
Process32First
ExitThread
GetTickCount
GetCurrentProcessId
TerminateThread
GetWindowsDirectoryA
GetCurrentProcess
GetSystemDirectoryA
GetLocalTime
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GlobalMemoryStatusEx
GetSystemInfo
ExitProcess
RemoveDirectoryA
DuplicateHandle
OpenEventA
WinExec
GetCurrentThreadId
CopyFileA
SetFileAttributesA
GetVersion
DeviceIoControl
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
TerminateProcess
PeekNamedPipe
WaitForMultipleObjects
GetModuleHandleA
GetComputerNameA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
lstrcmpiA
GetExitCodeThread
CreateToolhelp32Snapshot
LocalAlloc
FindFirstFileA
LocalReAlloc
FindNextFileA
LocalFree
FindClose
GetLogicalDriveStringsA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
CreateProcessA
CreateDirectoryA
GetLastError
DeleteFileA
CreateThread
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
FreeLibrary
lstrcatA
ExpandEnvironmentStringsA
GetPrivateProfileSectionNamesA
lstrlenA
OpenProcess
GetFileAttributesA
CancelIo
InterlockedExchange
lstrcpyA
ResetEvent
WaitForSingleObject
WideCharToMultiByte
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
InitializeCriticalSection
CloseHandle
SetEvent
Sleep
CreateEventA
LocalSize
HeapFree
MoveFileA
WriteFile
SetFilePointer
ReadFile
CreateFileA
RaiseException
GetFileSize
GetModuleFileNameA

user32

GetForegroundWindow
GetAsyncKeyState
GetKeyState
BlockInput
SendMessageA
SystemParametersInfoA
keybd_event
MapVirtualKeyA
SetCapture
GetWindowTextA
SetCursorPos
mouse_event
ExitWindowsEx
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
GetSystemMetrics
SetRect
GetDC
GetDesktopWindow
ReleaseDC
GetCursorPos
GetMessageA
GetInputState
IsWindowVisible
PostMessageA
ShowWindow
EnumWindows
MessageBoxA
wsprintfA
CharNextA
CloseClipboard
PostThreadMessageA
WindowFromPoint
GetThreadDesktop
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
OpenDesktopA

gdi32

GetDIBits
BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC
CreateDIBSection
SelectObject
CreateCompatibleBitmap

advapi32

EnumServicesStatusA
IsValidSid
LookupAccountNameA
LsaClose
LsaRetrievePrivateData
LsaOpenPolicy
RegCloseKey
RegQueryValueA
RegOpenKeyExA
StartServiceA
CloseServiceHandle
OpenServiceA
OpenSCManagerA
AdjustTokenPrivileges
LookupPrivilegeValueA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
RegEnumValueA
RegDeleteValueA
RegDeleteKeyA
UnlockServiceDatabase
ChangeServiceConfigA
LockServiceDatabase
QueryServiceStatus
DeleteService
ControlService
QueryServiceConfigA
RegOpenKeyA
CreateProcessAsUserA
SetTokenInformation
DuplicateTokenEx
StartServiceCtrlDispatcherA
ChangeServiceConfig2A
CreateServiceA
RegCreateKeyA
CloseEventLog
ClearEventLogA
OpenEventLogA
LookupAccountSidA
GetTokenInformation
OpenProcessToken

shell32

ShellExecuteA
SHGetSpecialFolderPathA
SHGetFileInfoA

ole32

CoTaskMemFree
CoUninitialize
CoCreateInstance
CoInitialize

oleaut32

SysFreeString

wininet

InternetCloseHandle

mfc42

ord6648
ord2764
ord4129
ord926
ord924
ord922
ord535
ord858
ord6663
ord860
ord4278
ord2818
ord939
ord6877
ord800
ord540
ord823
ord825
ord537

msvcrt

vsprintf
calloc
wcstombs
_beginthreadex
wcscpy
mbstowcs
fopen
fwrite
fclose
__getmainargs
_mbsstr
wcsstr
_mbslwr
_wcsupr
_iob
fprintf
_CIacos
time
srand
rand
_errno
strchr
strcat
strncpy
strncmp
atoi
strrchr
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
exit
_CIpow
__dllonexit
_onexit
_exit
_XcptFilter
printf
_acmdln
_stricmp
_strnicmp
_access
_local_unwind2
__CxxFrameHandler
memcpy
memmove
_ftol
memcmp
_purecall
sprintf
strcpy
strlen
strstr
memset
_except_handler3
strcmp
free
malloc

netapi32

NetUserAdd
NetLocalGroupAddMembers
NetUserGetInfo
NetApiBufferFree
NetUserGetLocalGroups
NetUserSetInfo
NetUserDel
NetUserEnum

msvcp60

?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

ws2_32

listen
sendto
recvfrom
__WSAFDIsSet
WSASocketA
htonl
accept
WSAGetLastError
connect
setsockopt
WSAIoctl
WSACleanup
getpeername
bind
getsockname
inet_addr
inet_ntoa
send
select
recv
ntohs
closesocket
socket
gethostbyname
gethostname
htons
WSAStartup

userenv

GetProfilesDirectoryA
GetUserProfileDirectoryA

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationA
WTSEnumerateSessionsA

psapi

EnumProcessModules
GetModuleFileNameExA

winmm

waveInStart
waveInOpen
waveInClose
waveInUnprepareHeader
waveInPrepareHeader
waveInAddBuffer
waveInGetNumDevs
waveOutUnprepareHeader
waveOutOpen
waveOutClose
waveOutWrite
waveOutPrepareHeader
waveInReset

Sections

.3y3Jk3p
Size: 370KB - Virtual size: 369KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.xqLYm6v
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.TmqlIYP
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Qb6P0wK
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.oR3bg80
Size: 69KB - Virtual size: 519KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Du9GSmz
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

fdfgdfgd
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

28e3a58132364197d7cb29ee104004bf

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wininet

mfc42

msvcrt

netapi32

msvcp60

ws2_32

userenv

wtsapi32

psapi

winmm

Sections

.3y3Jk3p Size: 370KB - Virtual size: 369KB

.xqLYm6v Size: 12KB - Virtual size: 11KB

.TmqlIYP Size: 109KB - Virtual size: 108KB

.Qb6P0wK Size: 48KB - Virtual size: 48KB

.oR3bg80 Size: 69KB - Virtual size: 519KB

.Du9GSmz Size: 7KB - Virtual size: 7KB

fdfgdfgd Size: 1KB - Virtual size: 1KB

.3y3Jk3p
Size: 370KB - Virtual size: 369KB

.xqLYm6v
Size: 12KB - Virtual size: 11KB

.TmqlIYP
Size: 109KB - Virtual size: 108KB

.Qb6P0wK
Size: 48KB - Virtual size: 48KB

.oR3bg80
Size: 69KB - Virtual size: 519KB

.Du9GSmz
Size: 7KB - Virtual size: 7KB

fdfgdfgd
Size: 1KB - Virtual size: 1KB