095f68e45c8320d3d3db0e0ce7008b92_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

095f68e45c8320d3d3db0e0ce7008b92_JaffaCakes118
Size

138KB
MD5

095f68e45c8320d3d3db0e0ce7008b92
SHA1

b592dd79aaeeecf38e1be0774134cbd4fca7fafe
SHA256

c7ed5e3e3af766b4d8fcd553140ef29d459104591e7d22c27f4338c9d4c715aa
SHA512

a189172b83f4b600a1f17e68fdca8c8430a55e8258c3b5ec52cdc5904d2b72ef45c3ba09884d5c82e9a60ace33e4110318c5e2c30ff3702da9716bb73a59ebce
SSDEEP

3072:UWhaBIY5p7Fx1tDWLflCpCyODlW8UcM1QaYxtjqrjzJ0AWUzQHfV:UGaBZRBtDWCODlVUcM1QvFqLHQHfV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
095f68e45c8320d3d3db0e0ce7008b92_JaffaCakes118

Files

095f68e45c8320d3d3db0e0ce7008b92_JaffaCakes118
.exe windows:5 windows x86 arch:x86

883f4ed1f90542bf3549686e802b769d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindFirstFileW
SetEndOfFile
CreateProcessW
HeapAlloc
SystemTimeToFileTime
SetFilePointerEx
HeapFree
GetCurrentThread
GetProcessHeap
IsBadReadPtr
SetFileTime
VirtualQueryEx
OpenProcess
Thread32First
WideCharToMultiByte
ReadProcessMemory
HeapDestroy
HeapCreate
Thread32Next
ReadFile
GetTimeZoneInformation
MultiByteToWideChar
GetTempPathW
GetFileSizeEx
CreateThread
GetLastError
CreateMutexW
VirtualAllocEx
FindClose
RemoveDirectoryW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
SetThreadPriority
CreateRemoteThread
Process32FirstW
Process32NextW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
ResetEvent
TlsGetValue
TlsSetValue
TerminateProcess
GetLocalTime
ExpandEnvironmentStringsW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
GetUserDefaultUILanguage
MoveFileExW
SetFileAttributesW
WTSGetActiveConsoleSessionId
lstrcmpiA
GetSystemTime
ReleaseMutex
LoadLibraryW
CreateDirectoryW
GetProcessId
VirtualAlloc
SetThreadContext
GetThreadContext
LoadLibraryA
FreeLibrary
GetNativeSystemInfo
GetPrivateProfileIntW
FlushFileBuffers
CreateFileW
GetFileAttributesW
WriteFile
VirtualProtectEx
GetPrivateProfileStringW
GetCurrentThreadId
SetLastError
EnterCriticalSection
GlobalUnlock
LeaveCriticalSection
InitializeCriticalSection
GetTickCount
GlobalLock
WriteProcessMemory
LocalFree
GetCurrentProcessId
CloseHandle
DuplicateHandle
OpenEventW
GetFileAttributesExW
lstrcmpiW
WaitForMultipleObjects
CreateEventW
GetProcAddress
GetModuleFileNameW
GetVersionExW
Sleep
VirtualFreeEx
VirtualFree
GetModuleHandleW
SetEvent
GetComputerNameW
WaitForSingleObject
SetErrorMode
GetCommandLineW
OpenMutexW
ExitProcess

user32

RegisterClassA
GetShellWindow
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
OpenWindowStationW
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
DefFrameProcW
GetDC
CharLowerA
ReleaseDC
CharUpperW
SetWindowLongW
GetWindow
GetMenuItemRect
GetSystemMetrics
CharToOemW
DrawIcon
GetIconInfo
CharLowerW
CharLowerBuffA
FillRect
RegisterClassExW
DrawEdge
IntersectRect
EqualRect
PrintWindow
EndPaint
GetUpdateRgn
GetWindowDC
BeginPaint
GetUpdateRect
GetDCEx
MapVirtualKeyW
RegisterClassExA
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
GetSubMenu
DefDlgProcW
DefFrameProcA
OpenInputDesktop
MenuItemFromPoint
TrackPopupMenuEx
SystemParametersInfoW
CallWindowProcW
GetClassNameW
GetMenu
WindowFromPoint
GetMenuState
DefWindowProcW
DefMDIChildProcW
SwitchDesktop
ExitWindowsEx
ToUnicode
GetMenuItemCount
DefDlgProcA
PostThreadMessageW
DefMDIChildProcA
GetMessageA
GetWindowRect
GetMessageW
SetCapture
PostMessageW
GetParent
GetWindowInfo
GetClassLongW
GetCapture
SetCursorPos
GetWindowLongW
GetAncestor
PeekMessageW
PeekMessageA
SetWindowPos
GetCursorPos
SendMessageTimeoutW
IsWindow
HiliteMenuItem
RegisterClassW
CallWindowProcA
EndMenu
DispatchMessageW
GetClipboardData
GetKeyboardState
TranslateMessage
IsRectEmpty
GetWindowThreadProcessId
GetMessagePos
MapWindowPoints
SendMessageW
ReleaseCapture
DefWindowProcA

advapi32

IsWellKnownSid
GetLengthSid
InitiateSystemShutdownExW
ConvertSidToStringSidW
EqualSid
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegSetValueExW
CryptHashData

shlwapi

PathRemoveFileSpecW
PathRemoveBackslashW
PathQuoteSpacesW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
StrStrIW
StrStrIA
StrCmpNIW
PathIsURLW
PathRenameExtensionW

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

RestoreDC
SaveDC
DeleteDC
GdiFlush
SetViewportOrgEx
CreateCompatibleDC
CreateDIBSection
GetDeviceCaps
GetDIBits
CreateCompatibleBitmap
SetRectRgn
SelectObject
DeleteObject

ws2_32

getaddrinfo
recvfrom
getpeername
accept
WSAEventSelect
send
closesocket
WSASend
WSAGetLastError
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
shutdown
setsockopt
bind
socket
WSASetLastError
listen
select
getsockname
sendto
recv
freeaddrinfo

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData

wininet

HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetQueryOptionA
InternetSetOptionA
InternetReadFile
InternetQueryOptionW
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetCrackUrlA
InternetConnectA
HttpQueryInfoA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

883f4ed1f90542bf3549686e802b769d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 129KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 129KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB