0b6614169bc287bf13cb558ef6fe1ed7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0b6614169bc287bf13cb558ef6fe1ed7_JaffaCakes118
Size

175KB
MD5

0b6614169bc287bf13cb558ef6fe1ed7
SHA1

03d2a34d1744bc7d4104556c82f4f6d43c547f61
SHA256

d753d3583cdf33272bdc9817671082b169da750421c6e2ea39da2c9021e78c03
SHA512

22e7d63f96cb78cacf1bc12ca5767256ecf82f6bfae0d0b40fef392c199067707f7596ebfdbb1750c251f46798459a42ca841fa2bd8adbc022bc97755bbe6442
SSDEEP

3072:jbo/D0tSi4V6PecwoCKpY7bYt8m9wF/ZkGq/BdOt8NTH9q+5jkkS9:j4WSpV6Pecdn67bY6/kbjPAr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b6614169bc287bf13cb558ef6fe1ed7_JaffaCakes118

Files

0b6614169bc287bf13cb558ef6fe1ed7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2767314fbe27486bf221af8be7748ced

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipFree
GdipCreateBitmapFromFileICM
GdipGetImagePixelFormat
GdipCreateBitmapFromFile
GdipDisposeImage
GdipAlloc
GdipCloneImage

user32

GetWindowLongA
DefWindowProcA
GetWindowTextLengthA
RegisterWindowMessageA
SetRect
GetSysColor
SetCapture
DestroyAcceleratorTable
SetWindowTextA
wvsprintfA
MsgWaitForMultipleObjects
GetWindow
ShowWindow
EndPaint
SetParent
UnregisterClassA
CharNextA
CreateAcceleratorTableA
GetActiveWindow
KillTimer
GetClientRect
RedrawWindow
GetDC
GetWindowTextA
CreateDialogParamA
DestroyWindow
DrawTextA
SetFocus
FillRect
ReleaseCapture
SetTimer
SetWindowLongA
MoveWindow
GetClassInfoExA
GetParent
InvalidateRect
ReleaseDC
CallWindowProcA
EnumDisplayDevicesA
IsChild
PostMessageA
InvalidateRgn
BeginPaint
GetDlgItem
PeekMessageA
CopyRect
GetDesktopWindow
SendNotifyMessageA
FindWindowA
SendMessageTimeoutA
GetFocus
SendMessageA
DispatchMessageA
RegisterClassExA
IsWindow
GetQueueStatus
LoadCursorA
GetWindowRect
wsprintfA
CreateWindowExA
PostThreadMessageA
EqualRect
GetClassNameA
SetWindowPos

wininet

InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle

setupapi

SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiGetClassDevsA

version

VerQueryValueW
GetFileVersionInfoA
GetFileVersionInfoW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeW
VerQueryValueA

shell32

SHGetSpecialFolderPathA
SHGetSpecialFolderPathW

kernel32

SizeofResource
GetCurrentThreadId
GetDriveTypeW
InterlockedIncrement
GetSystemInfo
GlobalUnlock
QueryPerformanceCounter
LoadLibraryExA
LoadLibraryW
OutputDebugStringA
OutputDebugStringW
lstrcpyA
CreateThread
LocalFree
GetShortPathNameW
ExitProcess
OpenFileMappingA
CreateFileMappingA
CreateEventA
IsDBCSLeadByte
TerminateProcess
WideCharToMultiByte
GetACP
InitializeCriticalSection
SetThreadPriority
ReadFile
GetCurrentProcess
GetProcessAffinityMask
_llseek
VirtualProtect
lstrcmpA
MapViewOfFile
ResetEvent
LoadResource
MulDiv
IsBadWritePtr
GetFileAttributesW
SetEnvironmentVariableW
GetCurrentThread
RaiseException
CreateFileA
WaitForMultipleObjects
InterlockedDecrement
Beep
DeviceIoControl
VirtualAlloc
WaitForSingleObject
GetSystemTime
LoadLibraryA
IsDebuggerPresent
GlobalSize
CreateSemaphoreA
DeleteFileA
HeapFree
GetProcessHeap
GetModuleFileNameW
DeleteCriticalSection
EnumResourceTypesW
CloseHandle
WriteProcessMemory
GlobalAlloc
GlobalReAlloc
HeapAlloc
GetCurrentProcessId
VirtualFree
GetTempPathW
GetTempPathA
InterlockedExchange
GetFileAttributesA
GetSystemTimeAsFileTime
GetThreadLocale
GetProcAddress
GetThreadPriority
IsBadReadPtr
GetModuleHandleA
EnterCriticalSection
VirtualQuery
MultiByteToWideChar
GetModuleFileNameA
GlobalFree
SetEvent
GlobalLock
GetTickCount
LeaveCriticalSection
GetLocaleInfoA
lstrcmpiA
CreateDirectoryA
WriteFile
FreeLibrary
GetLastError
GetVersionExA
lstrlenA
CreateDirectoryW
FlushInstructionCache
Sleep
lstrcpynA
FindResourceA
GetVolumeInformationW
lstrlenW

ole32

CLSIDFromProgID
CoTaskMemRealloc
StringFromGUID2
CoTaskMemFree
CoGetClassObject
CoCreateInstance
StgOpenStorage
CoUninitialize
CreateStreamOnHGlobal
StgCreateDocfile
CoSetProxyBlanket
OleUninitialize
GetRunningObjectTable
CoTaskMemAlloc
StgIsStorageFile
OleInitialize
OleLockRunning
CreateBindCtx
CreateItemMoniker
CoInitialize
BindMoniker
CoInitializeSecurity
CLSIDFromString

gdi32

CreateFontA
GetDeviceCaps
DeleteDC
CreateDIBSection
GetStockObject
RealizePalette
BitBlt
DeleteObject
CreateDIBitmap
GetObjectA
SetStretchBltMode
ExtEscape
SelectObject
CreateCompatibleBitmap
StretchDIBits
CreateSolidBrush
SelectPalette
GetDIBits
CreateCompatibleDC
SetBkMode

winmm

timeGetTime
timeSetEvent

advapi32

CryptDestroyHash
RegEnumKeyExA
CryptHashData
CryptEncrypt
CryptCreateHash
RegQueryValueExA
CryptGetHashParam
CryptReleaseContext
RegQueryInfoKeyA
CryptImportKey
CryptAcquireContextA
CryptDestroyKey
RegDeleteValueA
RegEnumValueA
RegSetValueExA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegDeleteKeyA

shlwapi

PathFileExistsW
PathCombineW

Sections

.text
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2767314fbe27486bf221af8be7748ced

Headers

File Characteristics

Imports

gdiplus

user32

wininet

setupapi

version

shell32

kernel32

ole32

gdi32

winmm

advapi32

shlwapi

Sections

.text Size: 101KB - Virtual size: 101KB

.rdata Size: 7KB - Virtual size: 6KB

.bss Size: 64KB - Virtual size: 64KB

.tls Size: 1024B - Virtual size: 248KB

.text
Size: 101KB - Virtual size: 101KB

.rdata
Size: 7KB - Virtual size: 6KB

.bss
Size: 64KB - Virtual size: 64KB

.tls
Size: 1024B - Virtual size: 248KB