082c7770088cdb9af1a4f53fcf169990_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

082c7770088cdb9af1a4f53fcf169990_JaffaCakes118
Size

78KB
MD5

082c7770088cdb9af1a4f53fcf169990
SHA1

2b47306eff0f3b16bf96f53f091c6fc68e17f17f
SHA256

5bcea8f08114231c80ec819f6462d58235f7ba55f1ce1a867cbea8d2b4ca64d2
SHA512

7e707b140f54c9f2c2a8a92115dd74f625a6e1bb63b17174c741a847a045fcc34179cbbea70a1e9349679e57afc406197207dab7dbb20c8604497d8a5e40dd7c
SSDEEP

1536:oXVCY5t4S0YdekMdUaVM2vf0ie0wYOROb+wPE0nE+NKN/6oVHdya1Q:oFPGS0YskMdUaWofhe5wP5ECKNCobQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/bs.exe

Files

082c7770088cdb9af1a4f53fcf169990_JaffaCakes118
.cab
bs.exe
.exe windows:5 windows x86 arch:x86

d01272304a0c4b02b58815781153a071

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
RemoveDirectoryW
WaitForMultipleObjects
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
ReleaseMutex
CloseHandle
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
GetSystemTime
WriteProcessMemory
SetFileAttributesW
CreateThread
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetThreadPriority
lstrcmpiA
MapViewOfFile
UnmapViewOfFile
SetEvent
CreateFileMappingW
WriteFile
TlsAlloc
FindClose
CreateRemoteThread
Process32FirstW
Process32NextW
TlsGetValue
TlsSetValue
TerminateProcess
ResetEvent
GetFileAttributesExW
ExitProcess
WTSGetActiveConsoleSessionId
GetCommandLineW
SetErrorMode
GetComputerNameW
GetVersionExW
OpenEventW
DuplicateHandle
GetCurrentProcessId
GlobalLock
GlobalUnlock
GetLocalTime
GetNativeSystemInfo
GetThreadContext
SetThreadContext
GetProcessId
VirtualQueryEx
SetFileTime
VirtualAllocEx
VirtualProtectEx
VirtualAlloc
SetLastError
GetLastError
OpenMutexW
GetFileSizeEx
GetTempPathW
FlushFileBuffers
IsBadReadPtr
GetProcessHeap
MultiByteToWideChar
CreateFileW
GetTimeZoneInformation
ReadFile
Thread32Next
HeapCreate
HeapDestroy
ReadProcessMemory
VirtualFreeEx
WideCharToMultiByte
Thread32First
TlsFree
OpenProcess
VirtualFree
GetCurrentThread
GetModuleHandleW
CreateDirectoryW
HeapFree
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
GetCurrentThreadId
ExpandEnvironmentStringsW
LocalFree
GetProcAddress
GetPrivateProfileIntW
LoadLibraryW
GetPrivateProfileStringW
FreeLibrary
GetUserDefaultUILanguage
lstrcmpiW
GetModuleFileNameW
GetFileAttributesW
Sleep
GetTickCount
WaitForSingleObject
CreateEventW
MoveFileExW

user32

OpenInputDesktop
MenuItemFromPoint
GetMenu
RegisterClassExW
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
GetMenuItemCount
DefDlgProcA
PostThreadMessageW
DefMDIChildProcA
HiliteMenuItem
DefFrameProcA
SendMessageW
CallWindowProcA
EndMenu
CallWindowProcW
DefWindowProcW
DefFrameProcW
GetWindowThreadProcessId
PeekMessageA
GetShellWindow
CharLowerBuffA
GetSystemMetrics
CharLowerW
ExitWindowsEx
GetKeyboardState
ToUnicode
GetAncestor
GetClipboardData
EndPaint
GetUpdateRgn
GetWindowDC
FillRect
DrawEdge
BeginPaint
GetUpdateRect
IntersectRect
GetDCEx
EqualRect
PrintWindow
GetMessageA
GetWindowRect
GetMessageW
SetCapture
GetParent
GetWindowInfo
GetClassLongW
GetCapture
SetWindowPos
IsWindow
GetSubMenu
ReleaseCapture
SetCursorPos
RegisterClassW
MapWindowPoints
DefDlgProcW
IsRectEmpty
DrawIcon
OpenWindowStationW
GetUserObjectInformationW
GetIconInfo
GetCursorPos
MapVirtualKeyW
PostMessageW
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharToOemW
GetDC
TranslateMessage
GetWindowLongW
CharLowerA
PeekMessageW
ReleaseDC
CharUpperW
SetWindowLongW
SendMessageTimeoutW
GetWindow
DispatchMessageW
RegisterClassExA
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
RegisterClassA
SetThreadDesktop
CloseDesktop
OpenDesktopW
GetProcessWindowStation
CreateWindowStationW
CloseWindowStation
GetThreadDesktop
SetProcessWindowStation
CreateDesktopW
GetMessagePos

advapi32

RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegSetValueExW
CryptHashData
InitiateSystemShutdownExW
GetLengthSid
EqualSid
IsWellKnownSid
ConvertSidToStringSidW

shlwapi

StrStrIW
PathRenameExtensionW
PathQuoteSpacesW
StrCmpNIW
PathIsURLW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveBackslashW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
StrStrIA
PathRemoveFileSpecW

shell32

ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

RestoreDC
SaveDC
DeleteDC
GdiFlush
SetViewportOrgEx
CreateCompatibleDC
SelectObject
CreateDIBSection
GetDeviceCaps
GetDIBits
DeleteObject
SetRectRgn
CreateCompatibleBitmap

ws2_32

WSASetLastError
freeaddrinfo
socket
bind
recv
setsockopt
shutdown
getsockname
WSAEventSelect
recvfrom
sendto
getpeername
WSASend
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
closesocket
send
listen
accept
WSAGetLastError

crypt32

CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData
PFXExportCertStoreEx

wininet

HttpAddRequestHeadersA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetQueryOptionA
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
HttpQueryInfoA
InternetCloseHandle

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d01272304a0c4b02b58815781153a071

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 129KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 129KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB