876d4e472819852adb793c64f6f98465_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

876d4e472819852adb793c64f6f98465_JaffaCakes118
Size

513KB
MD5

876d4e472819852adb793c64f6f98465
SHA1

0ed669c766f82e6a883860214db6466b0a0d5a90
SHA256

50f1d4e05670ea629d4fc8d04525cfc2fdaaa2a8d185cd61d8f902bad9914307
SHA512

2f871229f2f07196f1b2a97f68b1dc0f9b9dad9a547a2893cae324e245eb5452758b1f551ad2340c9d63f811bea62a954775c42d4598bb2ff2f9bd58416ea8ac
SSDEEP

12288:+qv1zH5ZYiPRGj7b6SDUBNXTmRZIJsMZNk86GOtOf:+qviikv60Ax4CE8tYOf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
876d4e472819852adb793c64f6f98465_JaffaCakes118

Files

876d4e472819852adb793c64f6f98465_JaffaCakes118
.exe windows:5 windows x86 arch:x86

91785c021b1f6d091a83e4ea919b01d2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\\Release\OtherTable.pdb

Imports

kernel32

WriteConsoleW
FlushFileBuffers
SetStdHandle
LCMapStringW
LoadLibraryW
GetConsoleMode
GetConsoleCP
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
CloseHandle
SetFilePointer
ReadFile
GetFileType
SetHandleCount
GetStringTypeW
HeapReAlloc
HeapSize
Sleep
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EnterCriticalSection
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameW
GetStdHandle
WriteFile
ExitProcess
HeapCreate
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetCommandLineA
DecodePointer
EncodePointer
VirtualQuery
GetModuleHandleW
VirtualProtect
LocalFree
InterlockedPopEntrySList
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
OpenFileMappingA
GetSystemInfo
LoadLibraryA
VirtualAlloc
GetTempPathW
CreateFileW
GetVersionExW
CreateEventA
WaitForSingleObject
GetCommState
MapViewOfFile
DebugBreak
GetVersionExA
OutputDebugStringA
GetCurrentDirectoryA
LockResource
FindResourceW
GetCurrentThreadId
GetProcAddress
lstrcmpiA
FindResourceA
SetLastError
GetLastError
RaiseException
FlushInstructionCache
lstrlenW
MultiByteToWideChar
IsDBCSLeadByte
LeaveCriticalSection
SizeofResource
InitializeCriticalSectionAndSpinCount
InterlockedCompareExchange
WideCharToMultiByte
EnumResourceTypesA
GetCurrentProcess
DeleteCriticalSection
EnumResourceNamesA
LoadLibraryExA
GetModuleHandleA
GetModuleFileNameA
InterlockedDecrement
InterlockedIncrement
LoadResource
FreeLibrary
lstrlenA
IsValidCodePage

user32

GetActiveWindow
DestroyWindow
DialogBoxParamA
GetWindow
SetWindowLongA
GetDlgCtrlID
CallWindowProcA
EnableWindow
UnregisterClassA
SetDlgItemTextA
DefWindowProcA
CharNextA
GetNextDlgTabItem
ClientToScreen
SetWindowRgn
GetWindowDC
KillTimer
GetFocus
LoadIconA
IsWindowEnabled
DrawIcon
BeginPaint
GetDC
GetMenu
OffsetRect
GetCursorInfo
MapWindowPoints
InvalidateRect
AppendMenuW
CreateWindowExA
SetScrollPos
ReleaseDC
GetCursorPos
ShowWindow
IsDlgButtonChecked
PostMessageA
ScrollWindowEx
UpdateWindow
AdjustWindowRect
DrawFrameControl
RegisterClassA
LoadCursorFromFileA
GetDlgItemInt
GetWindowRect
SendDlgItemMessageA
GetParent
MessageBeep
GetClientRect
SetFocus
GetWindowTextLengthA
SendMessageA
GetMonitorInfoA
SetDlgItemInt
GetWindowTextA
MessageBoxA
GetWindowLongA
MonitorFromWindow
GetDlgItem
EndDialog
SetWindowPos
SystemParametersInfoA
GetSystemMetrics
SetWindowTextA
LoadImageA
CheckMenuRadioItem

gdi32

SetBkMode
CreateFontIndirectA
EnumFontsA
CreateSolidBrush
GetStockObject
CreateEllipticRgn
MoveToEx
GetTextExtentPoint32A
LineTo
SetTextColor
CreateMetaFileA
ExcludeClipRect
DeleteObject
SelectObject
SelectClipRgn
CreateRectRgnIndirect
CombineRgn
FillRgn
CreateRectRgn
CreatePen
GetObjectA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
ChooseFontA

advapi32

RegQueryInfoKeyW
RegDeleteKeyA
RegEnumKeyExA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteValueA
RegCloseKey
RegSetValueExA

shell32

SHBrowseForFolderA
SHGetMalloc
SHGetPathFromIDListA
SHGetDesktopFolder

ole32

CoCreateInstance
OleRun
CoUninitialize
CoTaskMemRealloc
CoInitialize
CoTaskMemFree
CoTaskMemAlloc

oleaut32

SysStringLen
VariantClear
VariantCopy
SysAllocStringByteLen
VariantInit
VariantChangeType
SysStringByteLen
RevokeActiveObject
GetErrorInfo
SysAllocString
SysFreeString
VarUI4FromStr

shlwapi

ord14

comctl32

ImageList_LoadImageA
InitCommonControlsEx

opengl32

glMatrixMode
glViewport
glLoadIdentity
glOrtho

iphlpapi

GetAdaptersAddresses
GetAdaptersInfo
GetBestInterface

pdh

PdhCollectQueryData

glu32

gluLookAt

dbghelp

SymInitialize
SymGetTypeInfo

uxtheme

DrawThemeBackground

authz

AuthzInstallSecurityEventSource
AuthzInitializeResourceManager

Sections

.text
Size: 190KB - Virtual size: 189KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 286KB - Virtual size: 285KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

91785c021b1f6d091a83e4ea919b01d2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

opengl32

iphlpapi

pdh

glu32

dbghelp

uxtheme

authz

Sections

.text Size: 190KB - Virtual size: 189KB

.rdata Size: 29KB - Virtual size: 29KB

.data Size: 6KB - Virtual size: 14KB

.rsrc Size: 286KB - Virtual size: 285KB

.text
Size: 190KB - Virtual size: 189KB

.rdata
Size: 29KB - Virtual size: 29KB

.data
Size: 6KB - Virtual size: 14KB

.rsrc
Size: 286KB - Virtual size: 285KB