618ff333ea1d4e405ede7f88477d288e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

618ff333ea1d4e405ede7f88477d288e_JaffaCakes118
Size

7.0MB
MD5

618ff333ea1d4e405ede7f88477d288e
SHA1

7210e0a61364fdda0331d97c3f72b14e92f4aa2e
SHA256

6f9cc7e61783bf602d94c0221c3fc632e455d8b4dfe1bca09120aa0f15f47a60
SHA512

6c7909405ad5aca5c6c17a7825e92bbccadd54d8da0c51d8ca760aa9ac152e2af30545a6462f11b2b02ad7b3bf1f740efd21befd4df3c47c253e82ab55b156fb
SSDEEP

196608:MSagDDjTk6lErt2q8wgV0QjPCO2ZbKP9WIDceAXdtS4Kks6O9yAMrn65oGBKj0mq:MgDbdMoKj1w2mH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
618ff333ea1d4e405ede7f88477d288e_JaffaCakes118

Files

618ff333ea1d4e405ede7f88477d288e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bfdb98245397b90f7d444710cac7bf20

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

w:\Farmscapes\bin\Barn Yarn.pdb

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

dbghelp

MiniDumpWriteDump

psapi

GetProcessMemoryInfo

shell32

ShellExecuteA
SHGetSpecialFolderPathA

advapi32

SetEntriesInAclA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetSecurityInfo
AllocateAndInitializeSid
SetSecurityInfo
FreeSid
RegCreateKeyExA
RegCloseKey

user32

LoadCursorA
GetMessageA
SetCursor
GetKeyState
GetWindowThreadProcessId
SetForegroundWindow
GetForegroundWindow
SetWindowPos
MapWindowPoints
IsWindow
GetClientRect
GetWindowRect
GetWindow
GetParent
GetWindowLongA
ReleaseDC
GetDC
GetDesktopWindow
ShowCursor
DestroyWindow
UpdateWindow
SetFocus
SetWindowLongA
PtInRect
ScreenToClient
GetCursorPos
DefWindowProcA
ReleaseCapture
SetCapture
UnregisterClassA
CreateWindowExA
PeekMessageA
TranslateMessage
DispatchMessageA
MessageBoxA
SystemParametersInfoA
ShowWindow
AdjustWindowRectEx
AttachThreadInput
RegisterClassExA
LoadIconA
FindWindowA

ole32

CoInitialize
CoUninitialize

kernel32

MoveFileA
GetCurrentThreadId
WaitForSingleObject
SetEvent
CloseHandle
CreateEventA
GetSystemTimeAsFileTime
GetCurrentProcess
GetLocalTime
GetShortPathNameW
WritePrivateProfileStringA
GetCurrentDirectoryW
GetSystemDirectoryA
WinExec
CreateFileA
GetCurrentProcessId
CreateDirectoryA
HeapFree
GetProcessHeap
HeapAlloc
GetVersionExA
GetFileAttributesA
SetCurrentDirectoryA
CopyFileA
DeleteFileA
LocalFree
CreateSemaphoreA
ReleaseSemaphore
WaitForMultipleObjects
OutputDebugStringA
ExitProcess
Sleep
GlobalMemoryStatus
GetUserDefaultUILanguage
FindClose
GetLastError
FindNextFileA
FindFirstFileA
QueryPerformanceCounter
QueryPerformanceFrequency
SetThreadAffinityMask
GetCurrentThread
GetProcessAffinityMask
CreateMutexA
ReleaseMutex
GetModuleHandleA
WideCharToMultiByte
MultiByteToWideChar
FormatMessageA
DuplicateHandle
UnmapViewOfFile
CreateFileMappingA
MapViewOfFileEx
GetSystemInfo
GetFileSizeEx
GetSystemTime
GetProcAddress
LoadLibraryA
lstrcmpiA
GetFullPathNameA
SetEnvironmentVariableA
SetEndOfFile
GetLocaleInfoW
SetStdHandle
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
LoadLibraryW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetTimeZoneInformation
HeapSize
GetModuleFileNameA
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
lstrlenA
FlushFileBuffers
SetFilePointer
SetHandleCount
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
SetLastError
CreateThread
ExitThread
GetStringTypeW
GetStringTypeA
CompareStringW
CompareStringA
GetCPInfo
LCMapStringW
LCMapStringA
ReadFile
GetDateFormatA
GetTimeFormatA
HeapReAlloc
GetModuleFileNameW
GetStdHandle
GetFileType
WriteConsoleW
GetStartupInfoA
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RaiseException
RtlUnwind
CreateProcessA
CreatePipe
FreeLibrary
GetExitCodeProcess
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedCompareExchange
GetLocaleInfoA
TlsAlloc
TlsFree
TlsGetValue
ResetEvent
TlsSetValue
ResumeThread
GetTickCount
SystemTimeToFileTime
SetWaitableTimer
CreateWaitableTimerA
IsProcessorFeaturePresent
WriteFile
GetFileSize
MapViewOfFile
CreateFileW

openal32

alDeleteSources
alSourceQueueBuffers
alcCloseDevice
alcDestroyContext
alcMakeContextCurrent
alcGetContextsDevice
alcGetCurrentContext
alcCreateContext
alcOpenDevice
alcGetString
alSourcePlay
alGetSourcei
alGetError
alDeleteBuffers
alGetBufferi
alGenSources
alBufferData
alGenBuffers
alIsBuffer
alSourcef
alSourcefv
alSourcei
alSourceUnqueueBuffers
alSourceStop
alSourcePause

d3d9

Direct3DCreate9

gdi32

GetStockObject
GetDeviceCaps
DeleteObject

Sections

.text
Size: 5.6MB - Virtual size: 5.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 729KB - Virtual size: 729KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 235KB - Virtual size: 32.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 33B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 399KB - Virtual size: 399KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bfdb98245397b90f7d444710cac7bf20

Headers

File Characteristics

PDB Paths

Imports

version

dbghelp

psapi

shell32

advapi32

user32

ole32

kernel32

openal32

d3d9

gdi32

Sections

.text Size: 5.6MB - Virtual size: 5.6MB

.rdata Size: 729KB - Virtual size: 729KB

.data Size: 235KB - Virtual size: 32.4MB

.tls Size: 512B - Virtual size: 33B

.data1 Size: 2KB - Virtual size: 2KB

.rsrc Size: 399KB - Virtual size: 399KB

.text
Size: 5.6MB - Virtual size: 5.6MB

.rdata
Size: 729KB - Virtual size: 729KB

.data
Size: 235KB - Virtual size: 32.4MB

.tls
Size: 512B - Virtual size: 33B

.data1
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 399KB - Virtual size: 399KB