24e4dfd223f29f1131e37235ec3d4328_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

24e4dfd223f29f1131e37235ec3d4328_JaffaCakes118
Size

200KB
MD5

24e4dfd223f29f1131e37235ec3d4328
SHA1

77dc5e509bff54bb37a75bd0c03725f5db805d11
SHA256

65dace0a9855679199629f1383a7b85c1f75090168115f9f34ccfe5fb0eb59a2
SHA512

f334f722705202e414debd3cab0b6c30dd8dab7dcae2825e64f8bf66cac618f69fb0ca9d155e67310254f76009c449aa3fd2cf7ad68f4e1c4495deab3b1a7649
SSDEEP

6144:OceXyWqqDLnRPF+B1h2Pp7ujJSa8OxzgZfyP3oVDhPIY:OceXyTqnnRPFE2PpdKkZGahwY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
24e4dfd223f29f1131e37235ec3d4328_JaffaCakes118

Files

24e4dfd223f29f1131e37235ec3d4328_JaffaCakes118
.exe windows:5 windows x86 arch:x86

605705b168bf30ee3f8d34485c495f0b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTimeZoneInformation
MultiByteToWideChar
lstrlenW
FlushFileBuffers
GetTempPathW
GetFileSizeEx
OpenMutexW
SetLastError
VirtualProtectEx
VirtualAllocEx
FindClose
RemoveDirectoryW
QueryDosDeviceW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
WriteProcessMemory
GetPrivateProfileStringW
GetPrivateProfileIntW
SetHandleInformation
CreatePipe
GetCurrentThread
SetErrorMode
GetComputerNameW
GetVersionExW
OpenEventW
ReadFile
GetCurrentProcessId
ResetEvent
GlobalLock
GlobalUnlock
MoveFileExW
GetUserDefaultUILanguage
MapViewOfFile
UnmapViewOfFile
SetThreadPriority
CreateFileMappingW
TlsAlloc
TlsFree
GetNativeSystemInfo
TerminateProcess
Process32FirstW
Process32NextW
TlsGetValue
TlsSetValue
CreateRemoteThread
GetThreadContext
SetThreadContext
GetProcessId
HeapFree
GetLogicalDriveStringsW
SetFilePointerEx
GetCurrentProcess
SystemTimeToFileTime
HeapAlloc
CreateProcessW
SetEndOfFile
FindFirstFileW
CreateMutexW
Thread32Next
lstrcpynW
HeapCreate
HeapDestroy
ReadProcessMemory
VirtualFreeEx
WideCharToMultiByte
Thread32First
OpenProcess
WriteFile
VirtualQueryEx
SetFileTime
DuplicateHandle
GetProcessHeap
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateThread
GetSystemTime
GetLastError
SetFileAttributesW
WTSGetActiveConsoleSessionId
lstrcmpiA
CreateFileW
Sleep
LoadLibraryW
SetEvent
CreateDirectoryW
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
InitializeCriticalSection
GetFileAttributesExW
GetProcAddress
GetModuleFileNameW
GetModuleHandleW
ExitProcess
CloseHandle
WaitForMultipleObjects
CreateEventW
GetLocalTime
ExitThread
GetTickCount
LocalFree
GetCurrentThreadId
lstrcmpiW
GetModuleHandleA
LoadLibraryA
VirtualAlloc
GetFileAttributesW
IsBadReadPtr
VirtualFree
GetCommandLineW

user32

GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
GetWindowLongW
CharLowerA
CharUpperW
SetWindowLongW
SendMessageTimeoutW
GetWindow
DispatchMessageW
ExitWindowsEx
CharToOemW
EndPaint
CharLowerBuffA
GetMessageW
RegisterClassExA
GetWindowDC
SetCapture
DefDlgProcW
DefFrameProcA
OpenInputDesktop
BeginPaint
GetUpdateRect
GetWindowRect
GetCapture
TranslateMessage
RegisterClassExW
SetCursorPos
GetClipboardData
PeekMessageW
PostMessageW
MapVirtualKeyW
GetKeyboardLayoutList
IsRectEmpty
GetWindowThreadProcessId
FillRect
DrawEdge
IntersectRect
EqualRect
PrintWindow
DrawIcon
GetIconInfo
GetSystemMetrics
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
GetSubMenu
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
GetMenuItemCount
PostThreadMessageW
HiliteMenuItem
GetShellWindow
EndMenu
CharLowerW
GetKeyboardState
GetUpdateRgn
ToUnicode
GetDCEx
PeekMessageA
ReleaseDC
GetParent
GetWindowInfo
GetClassLongW
GetAncestor
SetWindowPos
IsWindow
DefWindowProcA
GetCursorPos
DefMDIChildProcW
SwitchDesktop
DefDlgProcA
DefMDIChildProcA
ReleaseCapture
RegisterClassW
CallWindowProcA
CallWindowProcW
DefWindowProcW
GetMessagePos
DefFrameProcW
RegisterClassA
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
SendMessageW
GetDC
MapWindowPoints
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
OpenWindowStationW
MessageBoxA
GetMessageA

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
GetSecurityDescriptorSacl
CreateProcessAsUserA
CreateProcessAsUserW
EqualSid
InitiateSystemShutdownExW
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
RegOpenKeyExW
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
RegEnumKeyExW
IsWellKnownSid
GetLengthSid
ConvertSidToStringSidW
RegCreateKeyW
RegEnumKeyW
RegQueryInfoKeyW
RegDeleteValueW
RegEnumValueW

shlwapi

PathAddExtensionW
PathQuoteSpacesW
StrStrIW
StrStrIA
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveBackslashW
PathUnquoteSpacesW
PathRemoveFileSpecW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathIsURLW
PathRenameExtensionW
StrCmpNIW

shell32

CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

CoSetProxyBlanket
CoUninitialize
CLSIDFromString
StringFromGUID2
CoInitializeSecurity
CoInitialize
CoInitializeEx
CoCreateInstance

gdi32

GetDeviceCaps
CreateCompatibleBitmap
DeleteObject
GetDIBits
CreateDIBSection
CreateCompatibleDC
SelectObject
DeleteDC
RestoreDC
SaveDC
SetRectRgn
GdiFlush
SetViewportOrgEx

ws2_32

send
gethostbyname
closesocket
WSASend
getaddrinfo
inet_addr
getpeername
listen
recvfrom
sendto
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
select
WSAEventSelect
getsockname
accept
freeaddrinfo
socket
bind
recv
setsockopt
shutdown
WSAGetLastError
WSASetLastError

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData
PFXImportCertStore

wininet

InternetReadFileExA
InternetReadFile
HttpSendRequestW
HttpOpenRequestA
HttpEndRequestA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
InternetQueryOptionA
InternetSetOptionA
InternetQueryOptionW
InternetOpenA
HttpAddRequestHeadersA
InternetCrackUrlA
InternetSetStatusCallbackA
InternetConnectA
InternetCloseHandle
HttpEndRequestW
HttpSendRequestA
InternetQueryDataAvailable
InternetSetFilePointer
HttpSendRequestExA
HttpQueryInfoA
HttpSendRequestExW
HttpOpenRequestW

oleaut32

SysFreeString
VariantInit
SysAllocString
VariantClear

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetInfo

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

winmm

PlaySoundW
waveOutSetVolume
waveOutGetVolume
PlaySoundA

Sections

.text
Size: 189KB - Virtual size: 189KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

605705b168bf30ee3f8d34485c495f0b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

version

winmm

Sections

.text Size: 189KB - Virtual size: 189KB

.data Size: 2KB - Virtual size: 10KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 189KB - Virtual size: 189KB

.data
Size: 2KB - Virtual size: 10KB

.reloc
Size: 8KB - Virtual size: 7KB