0e7a7d30e8e49c082da9b86d7207a6d8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0e7a7d30e8e49c082da9b86d7207a6d8_JaffaCakes118
Size

374KB
MD5

0e7a7d30e8e49c082da9b86d7207a6d8
SHA1

095327374c6feb0eb7d40189d3b5db559a52c0af
SHA256

495157580e7a5d6aaaad95ae7fcef33760ba89d756932b9a84ed553341282772
SHA512

7e398b27b38308cad080f2c3b3fd8aefd3ade572b8b9aec865df17259b1065171cabf4bb4486f35af83eb5e6cbd590454f424211f0242e064db2a301f8df776d
SSDEEP

6144:eIjYvWii5bT4fKgg7TEMKT2nYbeJW75CWpE9Imlfi2IS6540TvcGH4vWDVaEjnao:WOtTEHkksWW1Ij5TvHfD8E1btX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e7a7d30e8e49c082da9b86d7207a6d8_JaffaCakes118

Files

0e7a7d30e8e49c082da9b86d7207a6d8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d59fed3ea97474ef4bedee25efd7c750

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

secur32

TranslateNameW

shell32

SHBrowseForFolderW
SHGetFileInfoW
SHGetDesktopFolder
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetSpecialFolderPathW
SHParseDisplayName
SHBindToParent
SHGetPathFromIDListW
SHCreateShellItem

ole32

CoUninitialize
ReleaseStgMedium
CoInitialize
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CreateBindCtx
CoInitializeEx
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance

mpr

WNetEnumResourceW
WNetAddConnection3W
WNetGetConnectionW
WNetOpenEnumW
WNetCloseEnum
WNetCancelConnection2W

user32

SendDlgItemMessageW
SendMessageW
GetWindowTextW
LoadStringW
GetWindowRect
RedrawWindow
IsDlgButtonChecked
SetForegroundWindow
IsWindowEnabled
GetSystemMetrics
CheckDlgButton
GetWindowLongA
LoadIconW
OffsetRect
SetDlgItemTextW
IsWindow
LoadCursorW
ReleaseDC
SetWindowPos
DialogBoxParamW
SetWindowTextW
SystemParametersInfoW
MessageBoxW
WinHelpW
SetWindowLongW
SetCursor
GetSysColor
GetDialogBaseUnits
EnableWindow
RegisterClipboardFormatW
ShowWindow
GetDlgItem
CharLowerBuffW
GetDlgItemTextW
CharNextW
GetClientRect
LoadImageW
PostMessageW
GetDC
GetWindowLongW
KillTimer
IsWindowVisible
GetWindowTextLengthW
FindWindowW
SetFocus
MapWindowPoints
SetTimer
DrawTextExW
GetDesktopWindow
GetDlgCtrlID
MoveWindow
DrawFocusRect
DestroyIcon
EndDialog
CheckRadioButton
RegisterWindowMessageW
GetParent

gdi32

SetBkColor
CreateFontIndirectW
ExtTextOutW
SetTextColor
DeleteObject
SelectObject
GetDeviceCaps
GetObjectW
GetTextMetricsW

advapi32

RegOpenKeyExW
LsaStorePrivateData
RegEnumKeyW
CopySid
IsValidSid
AllocateAndInitializeSid
RegDeleteValueW
QueryServiceStatus
RegCloseKey
LsaClose
CreateProcessWithLogonW
OpenSCManagerW
CheckTokenMembership
RegQueryValueExA
RegQueryValueExW
LookupAccountSidW
RegOpenKeyExA
RegCreateKeyExW
FreeSid
OpenServiceW
GetLengthSid
RegSetValueExW
LookupAccountNameW
EqualSid
LsaOpenPolicy
GetTokenInformation
OpenProcessToken
OpenThreadToken
CloseServiceHandle

netapi32

NetJoinDomain
NetLocalGroupDelMembers
NetLocalGroupEnum
NetUserAdd
NetLocalGroupAddMembers
NetUnjoinDomain
NetUserDel
NetUserGetInfo
NetUserGetLocalGroups
DsRoleFreeMemory
NetValidateName
NetLocalGroupGetMembers
NetRenameMachineInDomain
DsGetDcNameW
NetApiBufferFree
NetUserSetInfo
DsRoleGetPrimaryDomainInformation

ntdsapi

DsFreeNameResultW
DsCrackNamesW

kernel32

SetComputerNameExW
GetDriveTypeW
SetUnhandledExceptionFilter
GetCurrentProcessId
FreeLibrary
GetCurrentThread
GetUserGeoID
ExitProcess
GetSystemDefaultLCID
LoadLibraryA
InterlockedDecrement
OpenEventW
GetUserDefaultLCID
GetProcAddress
GetLocaleInfoW
FormatMessageW
GetGeoInfoW
DelayLoadFailureHook
ExpandEnvironmentStringsW
ResetEvent
lstrlenW
UnhandledExceptionFilter
WaitForSingleObject
GetTickCount
CloseHandle
lstrcpyW
GlobalLock
GetUserDefaultLangID
GetLastError
TerminateProcess
GetACP
InterlockedIncrement
GlobalUnlock
GetModuleHandleW
CreateEventW
lstrcmpiA
lstrcmpiW
GetVersionExA
GetComputerNameW
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
GetCurrentProcess
InterlockedCompareExchange
LocalFree
DosDateTimeToFileTime
GetModuleFileNameW
lstrcpynW
SetEvent
GetSystemTimeAsFileTime
MulDiv
GetWindowsDirectoryW
CreateThread
LoadLibraryW
LocalAlloc
QueryPerformanceCounter
CreateProcessW

ntdll

RtlRunEncodeUnicodeString
RtlInitUnicodeString
NtAllocateVirtualMemory
RtlLargeIntegerShiftRight

msvcrt

_except_handler3
wcschr

shlwapi

StrCmpW
SHSetValueW
PathGetDriveNumberW
StrCmpNIW
PathIsUNCW
SHGetValueW
wnsprintfW
SHStrDupW
PathIsUNCServerW
PathRenameExtensionW
StrCatBuffW
PathParseIconLocationW
UrlCombineW
AssocQueryStringW
StrCmpIW
PathRemoveFileSpecW
StrChrW
PathFindFileNameW
UrlGetPartW
SHRegGetBoolUSValueW
PathCombineW
StrToIntExW
StrDupW
PathAppendW
PathMatchSpecW
StrRetToBufW
StrCpyNW
PathRemoveBackslashW
StrToIntW
PathFindExtensionW

urlmon

URLDownloadToCacheFileW

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 230KB - Virtual size: 620KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d59fed3ea97474ef4bedee25efd7c750

Headers

File Characteristics

Imports

secur32

shell32

ole32

mpr

user32

gdi32

advapi32

netapi32

ntdsapi

kernel32

ntdll

msvcrt

shlwapi

urlmon

Sections

.text Size: 11KB - Virtual size: 10KB

.data Size: 230KB - Virtual size: 620KB

.rdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 128KB - Virtual size: 127KB

.text
Size: 11KB - Virtual size: 10KB

.data
Size: 230KB - Virtual size: 620KB

.rdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 128KB - Virtual size: 127KB