a3bc4e8a39f9d84cd02969ec4800b9fb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
a3bc4e8a39f9d84cd02969ec4800b9fb_JaffaCakes118
Size 1.6MB
Sample240613-eee4jsxarl
SHA256 59beb85fd3cf7e4672ee28ffeb29050562c988b424b0ac28295fed870939ed94
MD5 a3bc4e8a39f9d84cd02969ec4800b9fb
SHA1 775ffe0247a393e5bcd9ce004da0b89ecf985547
SHA512 1d8a5b594d5502d591f5ee77467316cd3c2fe33e75e69e49ebb1ff3ab3ea985c824f0998976b919717e0495f278b1f524659666606335f75aa44356fb6017d99
SSDEEP 12288:dnqmn0EvOtDXhNQvtM4ulCR8Y8Vfnc0B55sl4cQVhOQcQzjpLR9++o4wpD/+Bc:dnqmnlqDx4ulPfc0uloXcmLz++oV/yc
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a3bc4e8a39f9d84cd02969ec4800b9fb_JaffaCakes118

File Explorer

a3bc4e8a39f9d84cd02969ec4800b9fb_JaffaCakes118

.exe 1.6MB

a3bc4e8a39f9d84cd02969ec4800b9fb_JaffaCakes118

IMPHASH 893418eebc2cfa77ba596178b11b387e
SHA256 59beb85fd3cf7e4672ee28ffeb29050562c988b424b0ac28295fed870939ed94
MD5 a3bc4e8a39f9d84cd02969ec4800b9fb
SHA1 775ffe0247a393e5bcd9ce004da0b89ecf985547
SHA512 1d8a5b594d5502d591f5ee77467316cd3c2fe33e75e69e49ebb1ff3ab3ea985c824f0998976b919717e0495f278b1f524659666606335f75aa44356fb6017d99
SSDEEP 12288:dnqmn0EvOtDXhNQvtM4ulCR8Y8Vfnc0B55sl4cQVhOQcQzjpLR9++o4wpD/+Bc:dnqmnlqDx4ulPfc0uloXcmLz++oV/yc
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

370158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BuildAgent\work\b0d71a1a28f6c898\Release\Win32\Installer.pdb

gdiplus

GdipDrawImageI GdipCreateBitmapFromStream GdipDrawImageRectI GdiplusShutdown GdiplusStartup GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromFile GdipGetImageWidth GdipDisposeImage GdipFillPath GdipFillRectangle GdipDrawLine GdipSetPathGradientCenterPointI GdipSetPathGradientSurroundColorsWithCount GdipGetPathGradientPointCount GdipSetPathGradientCenterColor GdipCreatePathGradientFromPath GdipAddPathEllipse GdipDeleteFont GdipCreateFontFromDC GdipMeasureString GdipDrawString GdipFillRectangleI GdipDrawPath GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipAddPathArcI GdipAddPathLineI GdipClosePathFigure GdipDeletePath GdipCreatePath GdipDeletePen GdipCreatePen1 GdipCreateLineBrushFromRectI GdipCreateSolidFill GdipCloneBrush GdipDeleteBrush GdipAlloc GdipFree GdipSetPenColor GdipSetLineColors GdipSetSolidFillColor GdipGetImageHeight GdipCloneImage

winhttp

WinHttpSetOption WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle WinHttpSetTimeouts WinHttpReceiveResponse WinHttpOpenRequest WinHttpConnect WinHttpOpen WinHttpReadData WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpWriteData WinHttpSendRequest WinHttpAddRequestHeaders WinHttpGetProxyForUrl

kernel32

HeapReAlloc HeapFree HeapAlloc GetProcessHeap GetProcAddress GetModuleHandleW GetModuleHandleExW GetLastError FreeResource CopyFileW GetTickCount DeleteFileW GetFileAttributesExW CloseHandle CreateFileW ReadFile FlushFileBuffers GetFileSize GetTempPathW GetTempFileNameW MoveFileW FindFirstFileW FindNextFileW FindClose CreateThread Sleep GetModuleFileNameW CreateDirectoryW GlobalLock WriteFile GlobalUnlock SetEvent WaitForSingleObject TerminateThread InitializeCriticalSectionEx DeleteCriticalSection CreateEventW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection GetVersionExW GetCurrentProcess ExpandEnvironmentStringsW GetFileAttributesW GetVersion LCMapStringW SetFilePointer OpenProcess TerminateProcess LoadLibraryW MultiByteToWideChar WaitForMultipleObjects GlobalFree CreateToolhelp32Snapshot Process32FirstW Process32NextW GetSystemTime GetCurrentThreadId GetExitCodeProcess GetFileSizeEx GlobalAlloc UnmapViewOfFile MapViewOfFile CreateFileMappingW HeapSize GetNativeSystemInfo GetUserDefaultUILanguage GetLocalTime RaiseException DecodePointer GetFirmwareEnvironmentVariableW DuplicateHandle GetFileInformationByHandle FileTimeToSystemTime SystemTimeToFileTime GetFileType FileTimeToDosDateTime LocalFree VirtualProtect VirtualQuery FreeLibrary LoadLibraryExA HeapDestroy FindResourceExW FindResourceW LocalAlloc IsWow64Process GetSystemInfo WriteConsoleW GetLocaleInfoW GetCPInfo SetCriticalSectionSpinCount VerSetConditionMask VerifyVersionInfoW ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead RtlUnwind LoadLibraryExW ExitProcess GetStdHandle GetACP GetTimeZoneInformation GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetSystemDirectoryW SetStdHandle GetConsoleCP GetConsoleMode LoadResource LockResource SizeofResource GetVolumePathNameW GetVolumeNameForVolumeMountPointW DeviceIoControl IsDebuggerPresent OutputDebugStringW GetStringTypeW EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime MoveFileExW CompareStringW SetFilePointerEx SetLastError

user32

CreateDialogParamW GetWindowLongW GetWindowDC SetDlgItemTextW SetTimer BeginPaint GetPropW SetPropW PostMessageW SendDlgItemMessageW DrawFocusRect GetDialogBaseUnits GetSysColor ExitWindowsEx EndPaint EndDialog KillTimer SetWindowTextW SetFocus LoadImageW GetSystemMetrics GetCursorPos GetDesktopWindow DestroyWindow RegisterWindowMessageW EnableWindow GetWindowThreadProcessId GetForegroundWindow AttachThreadInput BringWindowToTop InvalidateRect TrackMouseEvent GetClientRect IsWindowEnabled GetParent ScreenToClient IsWindow DefWindowProcW ReleaseDC GetKeyState DialogBoxParamW GetWindow SetCursor LoadCursorW GetDC MessageBoxW SetWindowLongW CallWindowProcW HideCaret SendMessageW ShowWindow SetWindowPos GetDlgItem GetWindowRect

gdi32

GetStockObject GetObjectW CreatePatternBrush EnumFontFamiliesExW DeleteObject ExtTextOutW GetTextMetricsW SetBkMode SetTextColor DeleteDC BitBlt SelectObject CreateCompatibleBitmap GetDeviceCaps CreateCompatibleDC CreateFontIndirectW SetBrushOrgEx SetBkColor StretchBlt

advapi32

CryptGetKeyParam CryptAcquireContextW CryptCreateHash CryptHashData CryptVerifySignatureW CryptDestroyHash CryptDestroyKey CryptReleaseContext RegCreateKeyExW RegQueryValueExW RegCloseKey RegOpenKeyExW RegSetValueExW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegEnumKeyExW RegLoadKeyW RegDeleteValueW ControlService QueryServiceStatus RegDeleteKeyW OpenSCManagerW OpenServiceW CloseServiceHandle CryptGetHashParam InitializeSecurityDescriptor SetSecurityDescriptorDacl GetUserNameW AllocateAndInitializeSid LookupAccountSidW FreeSid SystemFunction036 CryptEncrypt CryptExportKey CryptGenKey SetFileSecurityW SetEntriesInAclW RegDeleteKeyExW RegDeleteTreeW RegOpenKeyW CryptImportKey

shell32

Shell_NotifyIconW ShellExecuteExW ShellExecuteW SHGetFolderPathW

ole32

CoSetProxyBlanket CoTaskMemFree CoInitialize CoCreateInstance CoInitializeSecurity CoUninitialize CoInitializeEx GetHGlobalFromStream CreateStreamOnHGlobal CoCreateGuid StringFromCLSID

oleaut32

SysAllocStringByteLen SysFreeString SysAllocString VariantInit SysStringByteLen OleCreatePictureIndirect SysAllocStringLen SysStringLen VariantChangeType VariantClear

shlwapi

StrToIntExW PathFileExistsW PathFindFileNameW PathRemoveExtensionW PathFindExtensionW PathAddBackslashW PathRemoveFileSpecW PathAppendW PathStripPathW SHCopyKeyW

psapi

GetModuleFileNameExW EnumProcesses

uxtheme

SetWindowTheme

crypt32

CryptStringToBinaryW CryptDecodeObjectEx

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoExW GetFileVersionInfoSizeExW

Name

.text

Size

524KB

Virtual Size

523KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

164KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

736B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

912KB

Virtual Size

911KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a3bc4e8a39f9d84cd02969ec4800b9fb_JaffaCakes118

gdiplus

winhttp

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

psapi

uxtheme

crypt32

version

generic