07279e8e58d64903d8285dad1cd541bb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

07279e8e58d64903d8285dad1cd541bb_JaffaCakes118
Size

433KB
MD5

07279e8e58d64903d8285dad1cd541bb
SHA1

8a7e82f518a63af0e036fcc8519074a75bdab062
SHA256

a1e63c5156ed69aa7f3a090dd8e026ee94dc8d973342c6f14b1b2805a1b84eff
SHA512

6308632edb331d4bfc877b06091a1e35c225645fca2f91bb54adab8da5761c088c7a1c86dd0a02a45ca0776b0bb5ab36d443d38d11f71fdfc5568688feba7752
SSDEEP

6144:mUmGdVgYFHx3f14FoskrHj79E1kZRQis3jWFcT9Fn5BXEhO41c2Maf:kkVgMxP6Fo/bakZ+isTWwn5AT1c2pf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
07279e8e58d64903d8285dad1cd541bb_JaffaCakes118

Files

07279e8e58d64903d8285dad1cd541bb_JaffaCakes118
.exe windows:5 windows x86 arch:x86

682176b6c9e63008225d24a169d7e9bc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
GetCurrentProcessId
DeleteFileA
CreateFileA
TerminateThread
ReadFile
HeapAlloc
lstrlenA
HeapReAlloc
GlobalFree
GlobalUnlock
MulDiv
GlobalAlloc
GlobalLock
lstrcpyA
CreateThread
CloseHandle
GetModuleHandleA
CreateEventA
GetTickCount
SetEvent
WaitForSingleObject
LockResource
SizeofResource
Sleep
WideCharToMultiByte
DeleteCriticalSection
CreateMutexA
OpenMutexA
EnterCriticalSection
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
InitializeCriticalSectionAndSpinCount
GetStringTypeW
GetStringTypeA
HeapCreate
LCMapStringW
LCMapStringA
TlsFree
GetLastError
RaiseException
MultiByteToWideChar
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetCommandLineA
GetProcessHeap
HeapFree
InterlockedDecrement
InterlockedIncrement
FindResourceExA
LoadResource
FindResourceA
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
VirtualQuery
GetSystemInfo
VirtualProtect
GetStartupInfoA
ExitProcess
GetModuleHandleW
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedCompareExchange
HeapSize
HeapDestroy
LocalAlloc
GetShortPathNameA
GetTempPathA
GetVersion
GetVersionExA
CreateToolhelp32Snapshot
Process32Next
WriteConsoleA
GetTempFileNameA
AttachConsole
GetStdHandle
Module32First
CreateDirectoryA
GetSystemDirectoryA
TerminateProcess
CreateProcessA
GetComputerNameExA
GetExitCodeProcess
FreeConsole
GetVolumeInformationA
OpenProcess
GetProcessTimes
GetDriveTypeA
WriteFile
GetWindowsDirectoryA
Process32First
lstrcmpA
GetCurrentProcess
lstrlenW
FlushInstructionCache
SetLastError
GetModuleFileNameA
SystemTimeToFileTime
GetSystemTimeAsFileTime
GetLocalTime
GetSystemTime
WaitForMultipleObjectsEx
ResumeThread
FreeLibrary
GetProcAddress
LoadLibraryA
GetExitCodeThread
DeviceIoControl
FormatMessageA
LocalFree
GetComputerNameA
DosDateTimeToFileTime
GetFileSize
GetLocaleInfoA
MoveFileExA
SetErrorMode

advapi32

CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextA
CryptImportKey
CryptCreateHash
CryptVerifySignatureA
RegSetValueExA
RegQueryValueExA
RegEnumKeyExA
RegCreateKeyExA
RegOpenKeyExA
RegCloseKey
OpenProcessToken
ConvertSidToStringSidA
LookupAccountNameA
DuplicateTokenEx

gdi32

BitBlt
PatBlt
SetTextColor
DeleteDC
CreateFontIndirectA
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
GetDeviceCaps
CreateSolidBrush
GetStockObject
GetObjectA

ole32

CoGetClassObject
CoTaskMemAlloc
CoCreateGuid
CoSetProxyBlanket
CoInitializeSecurity
StringFromGUID2
CLSIDFromString
CLSIDFromProgID
OleUninitialize
OleInitialize
CoInitializeEx
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
OleLockRunning
CoCreateInstance

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime
LoadRegTypeLi
SysStringByteLen
OleCreateFontIndirect
VariantChangeType
VariantInit
SysAllocStringByteLen
LoadTypeLi
VariantClear
SysStringLen
SysAllocString
OleLoadPicture
SysAllocStringLen
SysFreeString

shlwapi

UrlEscapeA
PathAddExtensionA
PathAppendA
PathStripToRootA
PathCombineA
PathQuoteSpacesA
PathFileExistsA
PathFindExtensionA
PathRemoveExtensionA
PathRemoveArgsA
PathStripPathA
PathUnquoteSpacesA

user32

LoadCursorA
SystemParametersInfoA
ReleaseCapture
DispatchMessageA
PostMessageA
FrameRect
GetSysColorBrush
RegisterClassA
FindWindowExA
SendMessageA
UpdateWindow
ShowWindow
GetCursorPos
SetWindowPos
RedrawWindow
DefWindowProcA
EnableMenuItem
ReleaseDC
CreateWindowExA
GetFocus
GetParent
GetClassNameA
CreateDialogParamA
GetClientRect
EnumWindows
GetWindowTextA
GetWindowThreadProcessId
PostThreadMessageA
RegisterClassExA
GetClassInfoExA
UnregisterClassA
GetDesktopWindow
IsWindow
SetDlgItemTextA
EndPaint
DestroyWindow
SetCursor
GetMessageA
GetSystemMenu
SetTimer
ScreenToClient
GetWindowRect
FillRect
SetCapture
KillTimer
DrawTextA
SetForegroundWindow
BeginPaint
PtInRect
GetDC
TranslateMessage
InflateRect
SetRect
MoveWindow
GetWindow
CallWindowProcA
LoadImageA
SetWindowTextA
GetSystemMetrics
GetSysColor
GetDlgItem
CreateAcceleratorTableA
InvalidateRect
RegisterWindowMessageA
GetWindowTextLengthA
SetFocus
CharNextA
InvalidateRgn
IsChild
DestroyAcceleratorTable
ClientToScreen
FindWindowA
GetForegroundWindow
AttachThreadInput
SetWindowLongA
MessageBoxA
BringWindowToTop
GetWindowLongA

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

ws2_32

getaddrinfo
WSAGetLastError
WSAConnect
WSAStartup
WSASetEvent
WSASend
WSARecv
WSACleanup
WSASocketA
WSAResetEvent
closesocket
WSASetLastError
WSACreateEvent
freeaddrinfo
WSACloseEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetOverlappedResult

Sections

.text
Size: 278KB - Virtual size: 278KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 73KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

682176b6c9e63008225d24a169d7e9bc

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

gdi32

ole32

oleaut32

shlwapi

user32

version

ws2_32

Sections

.text Size: 278KB - Virtual size: 278KB

.rdata Size: 65KB - Virtual size: 65KB

.data Size: 10KB - Virtual size: 20KB

.rsrc Size: 73KB - Virtual size: 77KB

.text
Size: 278KB - Virtual size: 278KB

.rdata
Size: 65KB - Virtual size: 65KB

.data
Size: 10KB - Virtual size: 20KB

.rsrc
Size: 73KB - Virtual size: 77KB