0f0bb81f7418a7bd84c3cb5b00dc8759_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0f0bb81f7418a7bd84c3cb5b00dc8759_JaffaCakes118
Size

119KB
MD5

0f0bb81f7418a7bd84c3cb5b00dc8759
SHA1

db8fcf0ca7313aa54926f7cc2c78e5f769566b1d
SHA256

dc50973adf5a6ecc43148b45558fcd63f4bcef1e0240def7fb8ce2b1206f5f74
SHA512

3321f0e634eb3b71984f81c88b415809257a8b0671d4add454cac817edf176c95485eeed57897e6495af8cdb8f1331b4ab620aa35754406f2e3835e766b40cce
SSDEEP

3072:rDFu5XKI79joeWX20Ce6n6QlcY+O93EuVPy+/zFvhru:3Fqr7hoqzXjZVVPy+rTru

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f0bb81f7418a7bd84c3cb5b00dc8759_JaffaCakes118

Files

0f0bb81f7418a7bd84c3cb5b00dc8759_JaffaCakes118
.exe windows:5 windows x86 arch:x86

aeec2e857a9713b59bad208ccd08c401

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
ReleaseMutex
CloseHandle
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
LocalFree
GetSystemTime
WriteProcessMemory
SetFileAttributesW
CreateThread
ExpandEnvironmentStringsW
GetCurrentThreadId
GetThreadContext
SetThreadContext
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetProcessId
GetFileAttributesExW
GetNativeSystemInfo
GetVersionExW
GetPrivateProfileStringW
GetPrivateProfileIntW
SetEvent
HeapCreate
CreateEventW
FindNextFileW
WTSGetActiveConsoleSessionId
GlobalLock
GlobalUnlock
MoveFileExW
GetModuleFileNameW
GetUserDefaultUILanguage
CreateRemoteThread
Process32FirstW
Process32NextW
GetCommandLineW
SetErrorMode
GetComputerNameW
OpenEventW
DuplicateHandle
GetCurrentProcessId
TlsGetValue
TlsSetValue
TerminateProcess
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
GetLocalTime
HeapDestroy
lstrcmpiW
WaitForMultipleObjects
RemoveDirectoryW
LoadLibraryA
FindClose
VirtualAllocEx
VirtualProtectEx
VirtualAlloc
ReadProcessMemory
Sleep
GetProcAddress
SetLastError
GetLastError
OpenMutexW
GetFileSizeEx
GetTempPathW
FlushFileBuffers
MultiByteToWideChar
CreateFileW
GetTimeZoneInformation
ReadFile
Thread32Next
ExitProcess
GetFileAttributesW
LoadLibraryW
VirtualFreeEx
WideCharToMultiByte
Thread32First
OpenProcess
WriteFile
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualFree
GetTickCount
GetModuleHandleW
CreateDirectoryW
HeapFree
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
FreeLibrary
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
lstrcmpiA
SetThreadPriority
GetCurrentThread
ResetEvent
WaitForSingleObject

user32

GetMenuItemRect
GetMenu
MenuItemFromPoint
GetSubMenu
SetKeyboardState
GetMenuItemID
RegisterWindowMessageW
GetKeyboardState
GetClipboardData
ToUnicode
CharLowerW
DrawIcon
GetIconInfo
GetSystemMetrics
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
OpenWindowStationW
GetMessageA
GetWindowRect
GetMessageW
GetClassNameW
GetParent
GetWindowInfo
TrackPopupMenuEx
GetCapture
SetCursorPos
GetAncestor
PeekMessageA
SetWindowPos
GetCursorPos
GetMenuState
GetMenuItemCount
HiliteMenuItem
EndMenu
GetShellWindow
RegisterClassExA
DefDlgProcW
DefFrameProcA
OpenInputDesktop
RegisterClassExW
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
DefDlgProcA
DefMDIChildProcA
RegisterClassW
CallWindowProcA
CallWindowProcW
DefFrameProcW
RegisterClassA
DefWindowProcW
EndPaint
GetUpdateRgn
GetWindowDC
FillRect
DrawEdge
GetClassLongW
SystemParametersInfoW
BeginPaint
ExitWindowsEx
IntersectRect
GetDCEx
CharLowerBuffA
DispatchMessageW
PostThreadMessageW
IsWindow
ReleaseCapture
SendMessageW
MapWindowPoints
GetMessagePos
GetWindowThreadProcessId
IsRectEmpty
MapVirtualKeyW
PostMessageW
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharToOemW
GetDC
TranslateMessage
GetWindowLongW
EqualRect
PrintWindow
SetCapture
GetWindow
SendMessageTimeoutW
SetWindowLongW
CharUpperW
ReleaseDC
PeekMessageW
CharLowerA
GetUpdateRect

advapi32

CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
ConvertSidToStringSidW
EqualSid
GetLengthSid
IsWellKnownSid
InitiateSystemShutdownExW

shlwapi

PathRenameExtensionW
StrCmpNIW
PathQuoteSpacesW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveBackslashW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathIsURLW

shell32

ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

CLSIDFromString
StringFromGUID2

gdi32

SaveDC
CreateCompatibleDC
SetRectRgn
RestoreDC
DeleteDC
SetViewportOrgEx
SelectObject
CreateDIBSection
GetDeviceCaps
GetDIBits
DeleteObject
GdiFlush
CreateCompatibleBitmap

ws2_32

send
closesocket
WSASetLastError
freeaddrinfo
socket
bind
recv
getpeername
recvfrom
sendto
WSAEventSelect
WSAIoctl
connect
WSAStartup
getaddrinfo
select
WSAGetLastError
getsockname
shutdown
listen
accept
setsockopt

crypt32

CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
PFXExportCertStoreEx

wininet

HttpAddRequestHeadersA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
HttpQueryInfoA

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aeec2e857a9713b59bad208ccd08c401

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

netapi32

Sections

.text Size: 111KB - Virtual size: 111KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 111KB - Virtual size: 111KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 5KB - Virtual size: 5KB