216e3acc05ea1c0a5a9a3064b01dad85_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

216e3acc05ea1c0a5a9a3064b01dad85_JaffaCakes118
Size

344KB
MD5

216e3acc05ea1c0a5a9a3064b01dad85
SHA1

a40ddfc706242925e46d447b94dcaf76ab4c203c
SHA256

d71a403d675e59ee3cfbbcec7b6d608cc4712178be5303ae0d474f80e686a5be
SHA512

7996f0dcfced957271de2b47205c93f48569600a1f05c6fb2394ccd9e8d1449c1454bcfccbdd9616e0290b06f3f573d987e09934fa65aa1f39dc3b016fc3e3ca
SSDEEP

6144:nbuTE+TVG3+4azZwpAEPfZuJZrhgqd0iCKVEFgvHV0bUpU:nbuTE+4/wuZuJZtv0iCZE0wpU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
216e3acc05ea1c0a5a9a3064b01dad85_JaffaCakes118

Files

216e3acc05ea1c0a5a9a3064b01dad85_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b5c12902bf41a0455456a10e88594714

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AdjustTokenPrivileges
ChangeServiceConfigA
CloseServiceHandle
ControlService
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptReleaseContext
LookupPrivilegeValueA
OpenProcessToken
OpenSCManagerA
OpenServiceA
QueryServiceStatus
RegCloseKey
RegCreateKeyA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
RegFlushKey
RegOpenKeyA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegSetValueExA
StartServiceA

kernel32

GlobalAlloc
GlobalFree
GlobalHandle
GlobalLock
GlobalUnlock
HeapAlloc
HeapDestroy
HeapFree
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
IsDBCSLeadByte
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadResource
LocalAlloc
LocalFree
LocalReAlloc
LockResource
MulDiv
MultiByteToWideChar
OpenEventA
OpenProcess
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
ReleaseMutex
GetVersionExA
ResumeThread
RtlUnwind
SetEndOfFile
SetErrorMode
SetEvent
SetFilePointer
SetLastError
SetPriorityClass
SetUnhandledExceptionFilter
SizeofResource
Sleep
SystemTimeToFileTime
TerminateProcess
TerminateThread
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
WaitForSingleObject
WideCharToMultiByte
WriteFile
WritePrivateProfileStringA
lstrcatA
lstrcmpA
lstrcpyA
lstrcpynA
lstrlenA
lstrlenW
GetUserDefaultLCID
GetTimeFormatA
GetTickCount
GetTempPathA
GetTempFileNameA
GetSystemTimeAsFileTime
GetSystemInfo
GetSystemDirectoryA
GetSystemDefaultLCID
GetStringTypeExA
GetStartupInfoA
GetShortPathNameA
GetProcessHeap
GetProcAddress
GetPrivateProfileStringA
GetPrivateProfileIntA
GetPriorityClass
GetModuleHandleA
GetModuleFileNameA
GetLocalTime
GetLastError
GetFileAttributesA
GetDateFormatA
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetComputerNameA
FreeResource
FreeLibrary
FormatMessageA
FlushInstructionCache
FindResourceA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToSystemTime
EnterCriticalSection
ResetEvent
DuplicateHandle
CompareFileTime
CompareStringA
CreateDirectoryA
DeleteFileA
CreateEventA
CreateFileA
CreateMutexA
CreateProcessA
CreateThread
DeleteCriticalSection
CloseHandle

gdi32

SetWindowOrgEx
SetViewportOrgEx
SetTextColor
SetMapMode
SetBkMode
SetBkColor
SelectPalette
SelectObject
SaveDC
RestoreDC
RealizePalette
PatBlt
MoveToEx
LineTo
LPtoDP
GetTextMetricsA
GetTextExtentPointA
GetTextExtentPoint32A
GetSystemPaletteUse
GetSystemPaletteEntries
GetStockObject
GetObjectA
GetMapMode
GetDeviceCaps
ExtTextOutA
DeleteObject
DeleteDC
CreateSolidBrush
CreateRectRgnIndirect
CreatePen
CreatePalette
CreateFontIndirectA
CreateDIBSection
CreateDCA
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
StretchBlt

user32

EndPaint
EqualRect
ExitWindowsEx
FillRect
FindWindowA
FindWindowExA
FrameRect
GetClassInfoA
GetClassInfoExA
GetClassNameA
GetClientRect
GetCursorPos
GetDC
GetDesktopWindow
GetDlgCtrlID
GetDlgItem
GetDlgItemTextA
GetDoubleClickTime
GetFocus
GetForegroundWindow
GetIconInfo
GetKeyState
GetLastActivePopup
GetMenu
GetMenuItemCount
GetMenuItemID
GetMenuItemInfoA
GetMessageA
GetMessagePos
GetParent
GetScrollPos
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMenu
GetSystemMetrics
GetTopWindow
GetWindow
GetWindowLongA
GetWindowPlacement
GetWindowRect
GetWindowTextA
GetWindowTextLengthA
InSendMessage
InsertMenuA
InsertMenuItemA
IntersectRect
InvalidateRect
InvalidateRgn
IsChild
IsDialogMessageA
IsDlgButtonChecked
IsWindow
IsWindowEnabled
IsWindowVisible
KillTimer
EndDialog
LoadBitmapA
LoadCursorA
LoadIconA
LoadImageA
LoadMenuA
LoadStringA
LoadStringW
MapWindowPoints
MessageBeep
MessageBoxA
ModifyMenuA
MoveWindow
MsgWaitForMultipleObjects
OffsetRect
OpenClipboard
PeekMessageA
PostMessageA
PostThreadMessageA
PtInRect
RedrawWindow
RegisterClassA
RegisterClassExA
RegisterWindowMessageA
ReleaseCapture
ReleaseDC
RemoveMenu
SendDlgItemMessageA
SendMessageA
SendMessageTimeoutA
SetCapture
SetClipboardData
SetCursor
SetCursorPos
SetDlgItemTextA
SetFocus
SetForegroundWindow
SetMenuItemInfoA
SetParent
SetRect
SetTimer
SetWindowLongA
SetWindowPlacement
SetWindowPos
SetWindowRgn
SetWindowTextA
ShowWindow
SystemParametersInfoA
TrackPopupMenu
TrackPopupMenuEx
TranslateAcceleratorA
TranslateMessage
UnionRect
UpdateWindow
WinHelpA
wsprintfA
EndDeferWindowPos
EnableWindow
EnableMenuItem
EmptyClipboard
DrawTextA
DrawIconEx
DrawEdge
DispatchMessageA
DestroyWindow
DialogBoxParamA
CheckDlgButton
DestroyIcon
DestroyAcceleratorTable
DeleteMenu
DeferWindowPos
DefWindowProcA
CreateWindowExA
CreateDialogParamA
CreateAcceleratorTableA
CopyAcceleratorTableA
CloseClipboard
CheckRadioButton
LoadAcceleratorsA
CheckMenuItem
CharUpperBuffA
CharUpperA
CharToOemA
CharNextA
CharLowerA
CallWindowProcA
BeginDeferWindowPos
AppendMenuA
AdjustWindowRectEx
DestroyMenu
BeginPaint

winmm

waveInOpen
waveInGetNumDevs
waveInGetDevCapsA
waveInClose
waveInAddBuffer
waveInPrepareHeader
mmioRead
mmioOpenA
mmioDescend
mmioClose
mmioAscend
mixerSetControlDetails
mixerOpen
mixerGetNumDevs
mixerGetLineInfoA
mixerGetLineControlsA
mixerGetID
mixerGetDevCapsA
mixerGetControlDetailsA
mixerClose
PlaySoundA
waveInReset
waveInStart
waveInUnprepareHeader
waveOutClose
waveOutGetDevCapsA
waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveOutReset
waveOutUnprepareHeader
waveOutWrite
mmioSeek

wsock32

gethostbyname
gethostname
getsockname
ioctlsocket
inet_addr
WSACleanup
WSAStartup

comctl32

ord6
CreateToolbarEx
ImageList_AddMasked
ImageList_Create
ImageList_Destroy
ImageList_DrawEx
ImageList_ReplaceIcon
InitCommonControlsEx
PropertySheetA
ord8

ole32

CoInitializeEx
CoRegisterClassObject
CoRegisterMessageFilter
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoUninitialize
CreateOleAdviseHolder
CreateStreamOnHGlobal
IsAccelerator
OleInitialize
OleLockRunning
OleRegEnumVerbs
OleRegGetMiscStatus
OleRegGetUserType
OleSaveToStream
OleUninitialize
CoCreateInstance
WriteClassStm
CLSIDFromProgID
CLSIDFromString
StringFromCLSID

oleaut32

LoadRegTypeLi
OleCreateFontIndirect
OleCreatePropertyFrame
RegisterTypeLi
SysAllocString
SysAllocStringLen
SysFreeString
SysStringByteLen
SysStringLen
VarUI4FromStr
VariantChangeType
VariantClear
LoadTypeLi

shlwapi

StrChrA
StrCmpNIA

shell32

SHGetPathFromIDListA
Shell_NotifyIconA
SHGetFileInfoA
SHGetMalloc
SHGetSpecialFolderLocation
ShellExecuteA

crypt32

CertCreateCertificateContext
CertOpenSystemStoreA
CertOpenStore
CertNameToStrA
CertGetSubjectCertificateFromStore
CertGetIssuerCertificateFromStore
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore

netapi32

Netbios

Exports

Exports

SqmAddToAverage
SqmAddToStream
SqmAddToStreamDWord
SqmAddToStreamString
SqmAddToStreamV
SqmCleanup
SqmClearFlags
SqmCreateNewId
SqmEndSession
SqmFlushSession
SqmGetEnabled
SqmGetFlags
SqmGetMachineId
SqmGetSession
SqmGetSessionStartTime
SqmGetUserId
SqmIncrement
SqmIsWindowsOptedIn
SqmReadSharedMachineId
SqmReadSharedUserId
SqmSet
SqmSetAppId
SqmSetAppVersion
SqmSetBits
SqmSetBool
SqmSetCurrentTimeAsUploadTime
SqmSetEnabled
SqmSetFlags
SqmSetIfMax
SqmSetIfMin
SqmSetMachineId
SqmSetString
SqmSetUserId
SqmStartSession
SqmStartUpload
SqmSysprepGeneralize
SqmSysprepSpecialize
SqmTimerAccumulate
SqmTimerAddToAverage
SqmTimerRecord
SqmTimerStart
SqmUnattendedSetup
SqmWaitForUploadComplete
SqmWriteSharedMachineId
SqmWriteSharedUserId

Sections

.text
Size: 232KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b5c12902bf41a0455456a10e88594714

Headers

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

winmm

wsock32

comctl32

ole32

oleaut32

shlwapi

shell32

crypt32

netapi32

Exports

Exports

Sections

.text Size: 232KB - Virtual size: 232KB

.rdata Size: 48KB - Virtual size: 48KB

.data Size: 20KB - Virtual size: 1.7MB

.idata Size: 16KB - Virtual size: 16KB

.rsrc Size: 24KB - Virtual size: 24KB

.text
Size: 232KB - Virtual size: 232KB

.rdata
Size: 48KB - Virtual size: 48KB

.data
Size: 20KB - Virtual size: 1.7MB

.idata
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 24KB - Virtual size: 24KB