a735f3f4570aaa85e2679f4a46bffcb2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a735f3f4570aaa85e2679f4a46bffcb2_JaffaCakes118
Size

1.1MB
MD5

a735f3f4570aaa85e2679f4a46bffcb2
SHA1

32328446a2dbd213bf45512fb26d4af3d615ae21
SHA256

949fbf6c04527c6ccc4b29ced776d1711b601409c88fea708916babbb97b1289
SHA512

f53121f22d1b9689cfbbd3bb1ec391b09f9cbcb8c1ccddd7ddaac85a9c7a222964600f5c8deecb2a24b7e56e9b3185fbf93b803ff00d567190ec4b104e1dd801
SSDEEP

24576:tyBsG7jtywl1kjNlXV1D21ycXWYs4Z0rqZly:GjUD21FXWg7I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a735f3f4570aaa85e2679f4a46bffcb2_JaffaCakes118

Files

a735f3f4570aaa85e2679f4a46bffcb2_JaffaCakes118
.exe windows:6 windows x86 arch:x86

e9f8d8e36be40099a4b8049fd8ea193a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapFree
GetProcessHeap
FreeLibrary
GetComputerNameA
HeapAlloc
lstrcatW
LoadLibraryW
LoadLibraryA
GetProcAddress
GetModuleHandleA
VirtualFreeEx
WriteProcessMemory
WriteConsoleW
HeapSize
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
Module32Next
SetLastError
VirtualAllocEx
GetTickCount64
CreateProcessW
ResumeThread
SuspendThread
CreateRemoteThread
WaitForSingleObject
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
GetCommandLineW
Process32Next
CreateToolhelp32Snapshot
GetPrivateProfileStringA
GetModuleFileNameA
OpenProcess
TerminateProcess
Sleep
CloseHandle
SetFileAttributesA
FindNextFileA
FindFirstFileA
FindClose
GetVolumeInformationA
HeapReAlloc
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
FreeLibraryAndExitThread
ExitThread
CreateThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
WriteFile
GetModuleFileNameW
GetModuleHandleExW
ExitProcess
LoadLibraryExW
RtlUnwind
RaiseException
GetFileSizeEx
CreateFileA
FormatMessageA
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
ExpandEnvironmentStringsA
VerifyVersionInfoA
GetSystemDirectoryA
VerSetConditionMask
SleepEx
InitializeCriticalSectionEx
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetStartupInfoW
CreateDirectoryA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
WaitForSingleObjectEx
ResetEvent
SetEvent
GetCPInfo
GetStringTypeW
GetLocaleInfoW
GetLastError
FormatMessageW
WideCharToMultiByte
QueryPerformanceCounter
GetCurrentDirectoryW
CreateFileW
DeleteFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
RemoveDirectoryW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
GetModuleHandleW
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
CompareStringW
LCMapStringW

user32

ShowWindow
CreateWindowExW
LoadIconA
LoadCursorA
MessageBoxA
GetWindowTextLengthW
GetWindowTextW
RegisterClassExA
GetMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA
PostQuitMessage
CreateWindowExA
GetDlgItem

gdi32

CreateSolidBrush

advapi32

CryptEncrypt
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
RegDeleteKeyA
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
CryptImportKey

shell32

ShellExecuteA

rpcrt4

UuidCreateSequential

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
CertOpenStore
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertAddCertificateContextToStore

normaliz

IdnToAscii

shlwapi

PathGetArgsW
PathFindFileNameA

winmm

PlaySoundA

ws2_32

WSAStartup
WSACleanup
WSAGetLastError
socket
__WSAFDIsSet
select
WSASetLastError
recv
bind
closesocket
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSAIoctl
getaddrinfo
freeaddrinfo
recvfrom
sendto
accept
listen
ioctlsocket
gethostname
htonl
ntohl
send

wldap32

ord143
ord217
ord46
ord211
ord60
ord45
ord50
ord41
ord26
ord27
ord301
ord32
ord33
ord35
ord79
ord30
ord200
ord22

Sections

.text
Size: 640KB - Virtual size: 639KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e9f8d8e36be40099a4b8049fd8ea193a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

rpcrt4

crypt32

normaliz

shlwapi

winmm

ws2_32

wldap32

Sections

.text Size: 640KB - Virtual size: 639KB

.rdata Size: 146KB - Virtual size: 146KB

.data Size: 12KB - Virtual size: 32KB

.rsrc Size: 512B - Virtual size: 488B

.text
Size: 640KB - Virtual size: 639KB

.rdata
Size: 146KB - Virtual size: 146KB

.data
Size: 12KB - Virtual size: 32KB

.rsrc
Size: 512B - Virtual size: 488B