0d492596740778701f1adc4fb5d677d9_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

0d492596740778701f1adc4fb5d677d9_JaffaCakes118
Size

91KB
MD5

0d492596740778701f1adc4fb5d677d9
SHA1

6e8905c600e6c271dddcb0d0e4fdd551b998213c
SHA256

fe9c4ac5a640b15ea05c485d5cf8bb9014d04107a79163a946dad64e3b8268ca
SHA512

4ad7e3aead040fd0a319a568e56080e3261cc44d81238ab2bf1e1b6406c2e97d02f7687b2b48255f97addc5483082226d0c70ec11198993ae02189005b4f45f7
SSDEEP

1536:mEiUR9jZkPfYha6wTg+Wvv2xHeqOyk3BPgJyU4YIl3uiNDEjVaO2ukukXn:DiUOnY46v+WvXV2yNlfNDEjoO2jukXn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d492596740778701f1adc4fb5d677d9_JaffaCakes118

Files

0d492596740778701f1adc4fb5d677d9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2c6de59b6bf6b67529765717015426cc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DosDateTimeToFileTime
GetTickCount
BackupRead
GetConsoleCursorInfo
GetPrivateProfileIntW
WritePrivateProfileStringA
LocalReAlloc
LocalFlags
VirtualAlloc
GetCurrencyFormatW
FindFirstFileW
GetProcessTimes
DuplicateHandle
SetEnvironmentVariableW
GetFileAttributesA
GetCurrentDirectoryA
GlobalGetAtomNameW
GetShortPathNameW
DeleteFiber
SetThreadPriorityBoost
ExitProcess
GetProcessShutdownParameters
SetNamedPipeHandleState
FindAtomW
VirtualProtect
SystemTimeToFileTime
CreateFileW
lstrcpy
GetDevicePowerState
GetLargestConsoleWindowSize
SetConsoleTitleW
PurgeComm
GetExitCodeProcess
GetWriteWatch
GetThreadSelectorEntry
GetCurrentThread
UpdateResourceW
GlobalSize
lstrlen
GetFullPathNameA
IsDBCSLeadByteEx
EnumDateFormatsW
FindFirstChangeNotificationW
SizeofResource
Heap32First
OpenSemaphoreA
GetCurrentDirectoryW
WriteTapemark
GlobalGetAtomNameA
HeapFree
OpenSemaphoreW
MapViewOfFile
EnumCalendarInfoW
TlsFree
SetThreadContext
UnhandledExceptionFilter
WriteProfileStringW
IsSystemResumeAutomatic
EnumTimeFormatsW
GlobalUnlock
DisconnectNamedPipe
GetDateFormatW
GetTempPathA
SwitchToThread
SetLocaleInfoW

ole32

CoDisconnectObject
OleQueryLinkFromData
RegisterDragDrop
IsEqualGUID
MkParseDisplayName
CoIsHandlerConnected
IIDFromString
CoReleaseMarshalData
OleQueryCreateFromData
CoRegisterSurrogate
OleDestroyMenuDescriptor
CoRevokeClassObject
CoGetCallContext
CreateItemMoniker
IsAccelerator
CoGetTreatAsClass
CoGetObject
CoFreeAllLibraries
OleCreateLink
CoUninitialize
StgOpenStorageEx
CoGetStandardMarshal
OleSetClipboard
CreateStreamOnHGlobal
WriteOleStg
CLSIDFromProgID
CoCreateFreeThreadedMarshaler
OleNoteObjectVisible
OleConvertOLESTREAMToIStorageEx
CoCreateInstanceEx
StgCreateDocfileOnILockBytes
GetClassFile
CoTaskMemAlloc
GetDocumentBitStg
CoInitialize
OleMetafilePictFromIconAndLabel
OleRun
OleCreateFromFileEx
CoMarshalInterface
CoRegisterMallocSpy
OleIsCurrentClipboard
MonikerCommonPrefixWith
CoSuspendClassObjects
CreateClassMoniker
CoLockObjectExternal
CoInitializeEx
OleSaveToStream
ReadClassStm
CoReleaseServerProcess
ProgIDFromCLSID
CoQueryReleaseObject

shlwapi

SHRegQueryInfoUSKeyA
PathGetArgsA
StrStrW
SHRegQueryUSValueW
wnsprintfW
PathCanonicalizeW
StrFormatByteSizeW
StrToIntW
PathStripToRootW
PathGetDriveNumberA
SHIsLowMemoryMachine
SHSkipJunction
SHRegCreateUSKeyA
SHCreateStreamOnFileA
StrCpyNW
StrTrimW
SHOpenRegStreamA
PathRemoveArgsA
PathCompactPathW
AssocQueryStringByKeyW
PathFileExistsA
PathRemoveBlanksW
SHSetValueW
StrCmpNW
PathStripToRootA
StrRChrIA
PathRemoveFileSpecA
PathIsFileSpecW
SHRegDeleteEmptyUSKeyA
StrCmpNA
UrlHashW
ColorAdjustLuma
PathCompactPathExW
PathIsPrefixW
StrPBrkW
SHEnumKeyExW
PathAddBackslashW
PathSetDlgItemPathW
UrlIsOpaqueW
PathUnmakeSystemFolderA
PathParseIconLocationW
PathUnmakeSystemFolderW
PathIsContentTypeW
PathFindExtensionA
PathFindExtensionW
PathAddExtensionW
StrToIntExA
PathUndecorateA
StrCmpW
StrRChrA
StrFormatKBSizeW
PathSetDlgItemPathA
StrChrIA
PathIsContentTypeA
StrSpnA
PathFindFileNameW
PathSearchAndQualifyA
UrlGetLocationA
UrlCombineW
SHQueryValueExW
StrCpyW
SHEnumKeyExA
PathRelativePathToA

user32

GrayStringW
EnumThreadWindows
SetWindowsHookExW
EnumDisplaySettingsA
GetDlgItemInt
SetWindowsHookExA
CopyImage
GetAltTabInfo
IsDialogMessageA
CreateAcceleratorTableA
DlgDirListComboBoxA
PostThreadMessageA
TileWindows
ShowCaret
GetWindowRect
MessageBoxIndirectA
CharLowerBuffW
ClipCursor
SwitchToThisWindow
FrameRect
AttachThreadInput
LoadIconA
SetClassWord
PostThreadMessageW
LoadCursorFromFileA
ClientToScreen
SetWindowRgn
InsertMenuW
DrawTextExW
GetWindowDC
FindWindowExA
DefMDIChildProcW
GetUpdateRect
TileChildWindows
ShowWindowAsync
CountClipboardFormats
EnumWindows
AdjustWindowRect
PostMessageA
InsertMenuItemW
LoadImageA
DrawTextW
PeekMessageA
DestroyIcon
CreateWindowStationW
GetAncestor
GetWindowTextA
IsCharAlphaNumericA
ModifyMenuW
LoadCursorW
GetKBCodePage
IsWindowUnicode
SendMessageCallbackW
GetWindowLongA
GrayStringA
SetWindowContextHelpId
DlgDirSelectComboBoxExA
GetCaretBlinkTime
GetDlgItemTextW
GetDlgItem

advapi32

FindFirstFreeAce
GetUserNameA
GetServiceKeyNameW
GetSecurityInfoExA
BuildImpersonateTrusteeW
RegSetValueA
AdjustTokenPrivileges
ChangeServiceConfigW
ImpersonateNamedPipeClient
GetOverlappedAccessResults
EnumDependentServicesW
RegOpenKeyA
ObjectDeleteAuditAlarmA
LookupPrivilegeNameA
RegNotifyChangeKeyValue
ReadEventLogA
OpenServiceW
ObjectPrivilegeAuditAlarmA
CryptGenRandom
RegOpenKeyExW
GetEffectiveRightsFromAclA
OpenSCManagerA
EnumServicesStatusA
MakeSelfRelativeSD
RegDeleteKeyW
TrusteeAccessToObjectW
GetSecurityInfo
CancelOverlappedAccess
GetUserNameW
ObjectCloseAuditAlarmA
StartServiceA
QueryServiceConfigA
ReportEventW
RegLoadKeyA
DestroyPrivateObjectSecurity
RegSaveKeyW
CryptSetProviderExA
RegRestoreKeyA
RegEnumKeyExW
OpenEventLogW
ReportEventA
BuildSecurityDescriptorW
SetKernelObjectSecurity
GetAccessPermissionsForObjectW
IsValidSecurityDescriptor
GetSecurityDescriptorLength
CryptGetProvParam
RegQueryMultipleValuesW
NotifyChangeEventLog
GetAce
AreAllAccessesGranted
CryptEnumProvidersW
CryptEncrypt
LogonUserA
GetServiceKeyNameA
DeregisterEventSource
GetAclInformation
GetLengthSid
EnumServicesStatusW
BackupEventLogW
ConvertSecurityDescriptorToAccessNamedA
ControlService
CryptGetDefaultProviderA
GetSidIdentifierAuthority
LookupPrivilegeDisplayNameA

Sections

ASPack
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ASPack
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ASPack
Size: 512B - Virtual size: 614B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

::ICU::
Size: 11KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.!ep
Size: 406B - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2c6de59b6bf6b67529765717015426cc

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ole32

shlwapi

user32

advapi32

Sections

ASPack Size: 70KB - Virtual size: 69KB

ASPack Size: 9KB - Virtual size: 8KB

ASPack Size: 512B - Virtual size: 614B

::ICU:: Size: 11KB - Virtual size: 16KB

.!ep Size: 406B - Virtual size: 72KB

ASPack
Size: 70KB - Virtual size: 69KB

ASPack
Size: 9KB - Virtual size: 8KB

ASPack
Size: 512B - Virtual size: 614B

::ICU::
Size: 11KB - Virtual size: 16KB

.!ep
Size: 406B - Virtual size: 72KB