17f486bac371afc4e9c44eb41ab52d6a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

17f486bac371afc4e9c44eb41ab52d6a_JaffaCakes118
Size

216KB
MD5

17f486bac371afc4e9c44eb41ab52d6a
SHA1

469ad75ad7011582c79acbdd866ed5354674d1c7
SHA256

d9de0c4857455a22d5b611e1f562b6dc47554941ec0cfc87be5cf4f65fd67c1b
SHA512

cc9b14c05edebbe1477a39690b5b26049711663d3f791ef6adf090e17f1eddae2231ba7bff7ab99b10cbf523b999a3ea1848f2da9b04031eae1770606b13af89
SSDEEP

3072:iRIpI6+iHaO0TQyuS2mJbctGD1MTdBMHFunEnigoTMk+mNCZWJr8FlmXZ3amjOeF:iaLH50EyuQJb3SyFMkkOPmj5Om9dz73

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17f486bac371afc4e9c44eb41ab52d6a_JaffaCakes118

Files

17f486bac371afc4e9c44eb41ab52d6a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ad688010e5f0bcbc8869ae006e89d4f4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFindExtensionA
PathFileExistsA

hpqtap08

_TAPASPreLinkTestLink@8
TAPASLink

mfc80

ord934
ord930
ord932
ord928
ord923
ord5233
ord5235
ord5960
ord1600
ord4282
ord4722
ord3403
ord5214
ord4185
ord6275
ord5073
ord1908
ord5152
ord4232
ord1402
ord3946
ord1617
ord1620
ord5915
ord6725
ord1545
ord2086
ord297
ord3997
ord1486
ord6305
ord2654
ord3109
ord2657
ord2164
ord5777
ord2747
ord5799
ord2020
ord3636
ord630
ord2468
ord911
ord907
ord4035
ord385
ord3200
ord4262
ord4719
ord5203
ord4244
ord1401
ord5912
ord6724
ord1551
ord1670
ord1671
ord2021
ord4890
ord4734
ord4211
ord5182
ord4910
ord4465
ord4625
ord4584
ord4464
ord4494
ord3609
ord3602
ord3428
ord590
ord1144
ord4481
ord3635
ord784
ord2322
ord1091
ord1128
ord2141
ord331
ord1074
ord629
ord3389
ord384
ord476
ord701
ord266
ord6090
ord1065
ord3441
ord3641
ord3312
ord1588
ord1646
ord354
ord4735
ord4212
ord1875
ord5969
ord1793
ord1794
ord3182
ord4353
ord2168
ord3466
ord635
ord4265
ord4277
ord1306
ord2173
ord5205
ord5148
ord3945
ord1557
ord4019
ord2424
ord2425
ord2992
ord5356
ord4904
ord2939
ord4135
ord4309
ord5012
ord5009
ord2615
ord1913
ord2246
ord2430
ord1123
ord395
ord6067
ord4299
ord5165
ord1161
ord6304
ord3758
ord3401
ord2719
ord4952
ord4250
ord1395
ord6065
ord6063
ord943
ord3108
ord4445
ord1024
ord3648
ord1892
ord3210
ord1934
ord3161
ord1279
ord5637
ord3337
ord760
ord1280
ord709
ord602
ord347
ord501
ord3684
ord1185
ord300
ord6205
ord747
ord559
ord3174
ord741
ord715
ord1979
ord3317
ord4240
ord1591
ord2095
ord3292
ord1581
ord1643
ord1290
ord2375
ord4115
ord548
ord6118
ord5403
ord6306
ord3110
ord1873
ord757
ord2838
ord5566
ord5213
ord5230
ord4568
ord3948
ord5226
ord5224
ord2931
ord1920
ord3832
ord5382
ord6219
ord2390
ord1010
ord3806
ord5583
ord2018
ord2063
ord4326
ord6276
ord3801
ord6278
ord4014
ord4038
ord3683
ord4467
ord4469
ord3592
ord566
ord5383
ord3255
ord1181
ord5320
ord265
ord6286
ord2248
ord1069
ord1122
ord5225
ord593
ord6252
ord5119
ord334
ord959
ord547
ord5975
ord1115
ord1126
ord2346
ord1580
ord5331
ord262
ord6297
ord3450
ord3645
ord368
ord4264
ord4482
ord6043
ord5934
ord2768
ord3040
ord4222
ord1922
ord4739
ord4852
ord4257
ord5495
ord2742
ord5412
ord1379
ord5592
ord5156
ord2051
ord2016
ord6238
ord2621
ord2614
ord4566
ord616
ord4705
ord3043
ord5905
ord3169
ord2942
ord3477
ord648
ord410
ord4273
ord2717
ord1207
ord1360
ord3344
ord5206
ord5151
ord5914
ord6764
ord3974
ord4860
ord4863
ord4379
ord4384
ord4381
ord4399
ord4401
ord4386
ord4776
ord4178
ord4171
ord4980
ord4781
ord4204
ord4790
ord4443
ord4444
ord3740
ord4914
ord4519
ord4520
ord4920
ord4559
ord5049
ord4439
ord4368
ord4501
ord4846
ord4970
ord4529
ord4480
ord4971
ord4516
ord4673
ord4948
ord4794
ord4287
ord4963
ord4796
ord4710
ord4805
ord5053
ord4964
ord4649
ord4946
ord4507
ord4961
ord4674
ord4131
ord1302
ord2008
ord4132
ord5166
ord4377
ord4200
ord4376
ord1230
ord3761
ord2815
ord2419
ord2420
ord2421
ord2418
ord2417
ord3057
ord4129
ord4587
ord5833
ord4364
ord3088
ord3650
ord3620
ord686
ord1613
ord1612
ord1950
ord2058
ord3909
ord5947
ord3906
ord3114
ord5944
ord5571
ord3399
ord2718
ord4114
ord4117
ord6066
ord3759
ord2653
ord5802
ord4124
ord6064
ord6089
ord3988
ord2163
ord5831
ord5832
ord2146
ord1312
ord1320
ord5315
ord6719
ord1727
ord6720
ord6754
ord2371
ord2250
ord314
ord2253
ord2252
ord454
ord2410
ord2394
ord2400
ord2398
ord2396
ord2413
ord2408
ord2392
ord2415
ord2403
ord2385
ord2387
ord2405
ord2178
ord2172
ord1522
ord6279
ord3802
ord6277
ord3345
ord4967
ord1362
ord5175
ord1964
ord1656
ord1655
ord1599
ord5200
ord2537
ord2731
ord2835
ord4307
ord2714
ord2862
ord2540
ord2646
ord2533
ord2991
ord3718
ord3719
ord3709
ord2644
ord3949
ord4486
ord4261
ord3164
ord572
ord1903
ord2372
ord4125
ord762
ord6703
ord299
ord1489
ord736
ord605
ord310
ord3056
ord4580
ord6119
ord587
ord876
ord304
ord3934
ord2902
ord5563
ord781
ord578
ord1084
ord1187
ord1191
ord764
ord5102
ord1562

msvcr80

_amsg_exit
?terminate@@YAXXZ
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_encode_pointer
_unlock
_strdup
__argc
__argv
_splitpath
_resetstkoflw
__getmainargs
malloc
fabs
memcpy_s
memcmp
memcpy
strncpy_s
memset
sprintf_s
free
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_setmbcp
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_mbschr
_vsnprintf
__CxxFrameHandler3
strlen

kernel32

GetTempPathA
GetTempFileNameA
InterlockedIncrement
lstrcatA
OpenFile
_llseek
lstrlenA
_lwrite
_lclose
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
GetTickCount
GetVersionExA
GetProcAddress
GetModuleHandleA
FreeLibrary
LoadLibraryA
InterlockedExchange
WideCharToMultiByte
GetLastError
lstrlenW
lstrcmpiA
GetThreadLocale
SetLastError
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
SetEvent
ResumeThread
DuplicateHandle
GetCurrentProcess
CreateEventA
GetPrivateProfileStringA
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleFileNameA
Sleep
InterlockedCompareExchange
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
CloseHandle
MultiByteToWideChar
LocalAlloc
GetLocaleInfoA
GetACP
LocalFree
InterlockedDecrement
FormatMessageA

user32

GetMenu
EqualRect
GetClientRect
GetKeyState
MsgWaitForMultipleObjects
IsWindowUnicode
GetWindowRect
GetMessageW
GetMessageA
GetParent
EnableWindow
SendMessageA
MapWindowPoints
IsWindow
PostMessageA
TranslateMessage
DispatchMessageW
DispatchMessageA
LoadImageA
LoadCursorA
UpdateWindow
AdjustWindowRectEx
GetWindowThreadProcessId
AttachThreadInput
LoadIconA
GetForegroundWindow
SetForegroundWindow
IsZoomed
IntersectRect
SystemParametersInfoA
IsIconic
GetSystemMetrics
KillTimer
SetTimer
IsWindowVisible
SetRectEmpty
SetRect
CopyRect
PeekMessageA
IsRectEmpty

gdi32

CreateCompatibleDC
GetObjectA
BitBlt

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExA

shell32

ShellExecuteA

ole32

CoGetClassObject
CoTaskMemFree
CoCreateInstance
OleRun
CoTaskMemAlloc

oleaut32

VariantClear
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VarBstrCat
SysFreeString
SysStringLen
VariantInit
VariantChangeType
GetErrorInfo

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
?_Lock@_Mutex@std@@QAEXXZ
?_Unlock@_Mutex@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?length@?$char_traits@D@std@@SAIPBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

Sections

.text
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 68KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ad688010e5f0bcbc8869ae006e89d4f4

Headers

File Characteristics

Imports

shlwapi

hpqtap08

mfc80

msvcr80

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcp80

Sections

.text Size: 108KB - Virtual size: 108KB

.rdata Size: 68KB - Virtual size: 64KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 32KB - Virtual size: 52KB

.text
Size: 108KB - Virtual size: 108KB

.rdata
Size: 68KB - Virtual size: 64KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 32KB - Virtual size: 52KB