9fc604f926328970c409e96eb69e7af5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

9fc604f926328970c409e96eb69e7af5_JaffaCakes118
Size

306KB
MD5

9fc604f926328970c409e96eb69e7af5
SHA1

94c109f044d398e784bd0d653edb9beeac3ee0e0
SHA256

ba35e79be16480db78c27b2789993195057b456a970372d2bf31e602c7dc4bf7
SHA512

19e2fe98457a262edbff717198ec6312874c29774f137da65939a7bfaaff45bff11ceed530ff391c70902e95a8a3fbfbbbc94c29c896230616257ee27f44f809
SSDEEP

6144:67//SNEuVpudC38qKedVdq/1hWEb127sw4ofB6Xf:67WLpi+VWWEb12Ig56P

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9fc604f926328970c409e96eb69e7af5_JaffaCakes118

Files

9fc604f926328970c409e96eb69e7af5_JaffaCakes118
.exe windows:5 windows x86 arch:x86

7df9b0621b9eae97ffae2df626643c91

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedDecrement
WriteFile
Sleep
LoadLibraryExA
CopyFileA
lstrlenW
MulDiv
GetFileAttributesA
IsDBCSLeadByte
LeaveCriticalSection
RaiseException
EnterCriticalSection
SizeofResource
LoadResource
FindResourceA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedIncrement
GetCurrentThreadId
FlushInstructionCache
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcmpA
SetCurrentDirectoryA
CreateFileW
FlushFileBuffers
WriteConsoleW
SetStdHandle
SetFilePointer
GetConsoleMode
GetConsoleCP
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetLocaleInfoW
GetUserDefaultLCID
HeapReAlloc
HeapSize
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapCreate
GetStdHandle
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetCommandLineA
VirtualQuery
GetSystemInfo
VirtualProtect
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
LocalFree
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
FreeLibrary
OutputDebugStringA
GetModuleFileNameW
LoadLibraryW
LoadLibraryA
GetFileAttributesW
GetModuleHandleW
GetModuleFileNameA
GetWindowsDirectoryA
GetTempFileNameA
GetTempPathA
RemoveDirectoryA
FindNextFileA
DeleteFileA
SetFileAttributesA
FindClose
FindFirstFileA
GetSystemDirectoryA
DeviceIoControl
lstrlenA
lstrcmpiA
TerminateProcess
SetLastError
WaitForSingleObject
CreateRemoteThread
GetExitCodeProcess
DuplicateHandle
Process32Next
GetCurrentProcessId
OpenProcess
Process32First
CreateToolhelp32Snapshot
GetLastError
GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetVersion
GetVersionExA
WideCharToMultiByte
MultiByteToWideChar
CloseHandle
CreateFileA
FreeEnvironmentStringsW

user32

GetWindowLongA
GetParent
GetWindow
GetWindowRect
GetClientRect
GetSystemMetrics
GetDesktopWindow
GetDlgItemTextA
wsprintfA
UnregisterClassA
CreateAcceleratorTableA
DestroyWindow
GetClassInfoExA
RedrawWindow
IsWindow
GetDlgItem
IsChild
SetWindowTextA
GetWindowTextA
GetWindowTextLengthA
MessageBoxA
DialogBoxParamA
SetDlgItemTextA
PeekMessageA
TranslateMessage
DispatchMessageA
SetFocus
FindWindowA
GetClassNameA
EndDialog
SetWindowPos
GetFocus
RegisterWindowMessageA
ScreenToClient
MoveWindow
InvalidateRgn
CallWindowProcA
GetDC
ReleaseDC
DestroyAcceleratorTable
RegisterClassExA
CharNextA
SetRect
FillRect
GetSysColor
DefWindowProcA
SetCursor
KillTimer
GetCursorPos
ReleaseCapture
SetTimer
GetCapture
GetForegroundWindow
SetCapture
EndPaint
BeginPaint
InvalidateRect
SetWindowLongA
RegisterClassA
LoadCursorA
SendMessageA
CreateWindowExA
LoadBitmapA
PtInRect
ClientToScreen
LoadStringW

gdi32

CreateCompatibleDC
SelectObject
GetObjectA
BitBlt
DeleteDC
DeleteObject
CreatePen
CreateCompatibleBitmap
LineTo
GetStockObject
RoundRect
GetDeviceCaps
MoveToEx
CreateSolidBrush

advapi32

RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
DeleteService
ControlService
OpenServiceA
OpenSCManagerA
RegQueryInfoKeyW
QueryServiceStatus
CloseServiceHandle
RegSetValueExA
RegEnumKeyExA
RegDeleteKeyA
RegDeleteValueA

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderPathA
ShellExecuteExA

ole32

CreateStreamOnHGlobal
CLSIDFromString
CoTaskMemFree
CoGetClassObject
CLSIDFromProgID
OleLockRunning
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoFreeUnusedLibraries
CoInitializeEx
CoCreateGuid
OleUninitialize
OleInitialize
CoUninitialize
CoCreateInstance
CoInitialize

oleaut32

SysAllocStringLen
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
VarUI4FromStr
SysStringLen
SysAllocString
VariantInit
VariantClear
SysFreeString

wininet

InternetQueryDataAvailable
InternetOpenUrlA
InternetReadFile
InternetOpenA
InternetCloseHandle

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 216KB - Virtual size: 216KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7df9b0621b9eae97ffae2df626643c91

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wininet

iphlpapi

Sections

.text Size: 216KB - Virtual size: 216KB

.rdata Size: 44KB - Virtual size: 44KB

.data Size: 12KB - Virtual size: 27KB

.rsrc Size: 12KB - Virtual size: 11KB

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 216KB - Virtual size: 216KB

.rdata
Size: 44KB - Virtual size: 44KB

.data
Size: 12KB - Virtual size: 27KB

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 20KB - Virtual size: 19KB