25d67d41da7f0f05b06196067d465519_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

25d67d41da7f0f05b06196067d465519_JaffaCakes118
Size

364KB
MD5

25d67d41da7f0f05b06196067d465519
SHA1

4b0a9587fd169f7bbfd517975a9616f94d29bb9e
SHA256

834c669e09841ba74de29ed137e8ae7a5bfc4a20f033de489cf8b86b90fc7d41
SHA512

a51901e652fe13879c759874dff771f4f8acb399a28fde8df3999050ba4cfaed2ba41da7f089a2986d9b947d703c906452442fd4643c6d6775871d728c950afb
SSDEEP

6144:rQ6sv/yUNIraf1oxAMxp3TYWNiQgS/+wvzEbnov3q0xe6sYn/JGVg4LN/piTk:rxsvKSf1oh1TfiQXFvz93+6sI8+4Tj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
25d67d41da7f0f05b06196067d465519_JaffaCakes118

Files

25d67d41da7f0f05b06196067d465519_JaffaCakes118
.exe regsvr32 windows:4 windows x86 arch:x86

e04febe3beda3357a65446026400c3f1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

ws2_32

recvfrom
send
sendto
recv
ntohs
ioctlsocket
inet_ntoa
inet_addr
htons
htonl
getservbyport
getservbyname
gethostbyname
gethostbyaddr
connect
closesocket
bind
accept
WSAStringToAddressA
WSAStartup
WSASetLastError
WSAGetLastError
WSACleanup
WSAAsyncSelect
socket

kernel32

FreeConsole
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetComputerNameW
GetConsoleWindow
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsA
GetEnvironmentStringsW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetFileType
GetLastError
GetLocalTime
GetLocaleInfoA
GetLocaleInfoW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessVersion
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemTime
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetUserDefaultLCID
GetVersion
GetVersionExA
GetVersionExW
GetWindowsDirectoryA
GlobalAddAtomW
GlobalAlloc
GlobalDeleteAtom
GlobalFindAtomW
GlobalFlags
GlobalFree
GlobalGetAtomNameW
GlobalHandle
GlobalLock
GlobalReAlloc
GlobalUnlock
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsBadCodePtr
IsBadReadPtr
IsBadWritePtr
IsValidCodePage
IsValidLocale
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalAlloc
LocalFree
LocalReAlloc
MultiByteToWideChar
RaiseException
ReadFile
ReleaseMutex
RtlUnwind
SetConsoleCtrlHandler
SetEnvironmentVariableA
SetErrorMode
SetEvent
SetFilePointer
FlushFileBuffers
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
WritePrivateProfileStringW
WriteProfileStringW
lstrcatW
lstrcmpA
lstrcmpW
lstrcmpiA
lstrcmpiW
lstrcpyW
lstrcpynW
lstrlenA
lstrlenW
CloseHandle
CompareStringA
CompareStringW
CreateEventA
CreateEventW
SetHandleCount
CreateFileA
CreateMutexA
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
EnumSystemLocalesA
ExitProcess

user32

EnableWindow
EndDeferWindowPos
EnumThreadWindows
EnumWindows
EqualRect
GetActiveWindow
GetCapture
GetClassInfoW
GetClassNameW
GetClientRect
GetCursorPos
GetDC
GetDesktopWindow
GetDlgCtrlID
GetDlgItem
GetFocus
GetForegroundWindow
GetKeyState
GetLastActivePopup
GetMenu
GetMenuCheckMarkDimensions
GetMenuItemCount
GetMenuItemID
GetMenuState
GetMessagePos
GetMessageTime
GetMessageW
GetNextDlgTabItem
GetParent
GetPropW
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMetrics
GetTopWindow
GetWindow
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextW
GrayStringW
InvalidateRect
IsIconic
IsWindow
IsWindowEnabled
IsWindowVisible
KillTimer
LoadAcceleratorsW
LoadBitmapW
LoadCursorW
LoadIconW
LoadMenuW
LoadStringW
MapWindowPoints
EnableMenuItem
ModifyMenuW
PeekMessageW
PostMessageW
PostQuitMessage
PtInRect
RegisterClassW
RegisterWindowMessageW
ReleaseCapture
ReleaseDC
RemovePropW
ReuseDDElParam
ScreenToClient
SendMessageTimeoutW
SendMessageW
SetActiveWindow
SetCursor
SetFocus
SetForegroundWindow
SetMenu
SetMenuItemBitmaps
SetPropW
SetRectEmpty
SetTimer
SetWindowLongW
SetWindowPos
SetWindowTextW
SetWindowsHookExW
ShowOwnedPopups
ShowWindow
SystemParametersInfoW
TabbedTextOutW
TranslateAcceleratorW
TranslateMessage
UnhookWindowsHookEx
UnpackDDElParam
UnregisterClassW
UpdateWindow
ValidateRect
WaitMessage
WinHelpW
wsprintfW
DestroyWindow
DestroyMenu
DeferWindowPos
DefWindowProcW
CreateWindowExW
CopyRect
ClientToScreen
CallWindowProcW
CallNextHookEx
BringWindowToTop
BeginDeferWindowPos
AdjustWindowRectEx
DrawTextW
MessageBoxW
DispatchMessageW
CheckMenuItem

gdi32

ScaleViewportExtEx
SaveDC
RestoreDC
TextOutW
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
SetTextColor
SetMapMode
SetBkColor
SelectObject
RectVisible
PtVisible
OffsetViewportOrgEx
GetStockObject
GetObjectW
GetDeviceCaps
GetClipBox
ExtTextOutW
Escape
DeleteObject
DeleteDC
CreateBitmap
ScaleWindowExtEx

winspool.drv

DocumentPropertiesW
ord204
OpenPrinterW
GetPrinterW
GetPrinterDataW
AddPrinterConnectionW
ClosePrinter
DeletePrinterConnectionW
EnumPrintersW
ord203

advapi32

RegDeleteKeyA
CloseServiceHandle
DeregisterEventSource
EqualSid
FreeSid
SetThreadToken
SetSecurityDescriptorDacl
RevertToSelf
ReportEventA
RegisterEventSourceA
RegSetValueExW
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegQueryValueA
RegOpenKeyW
RegOpenKeyExW
RegOpenKeyExA
RegOpenKeyA
RegNotifyChangeKeyValue
RegEnumKeyExA
AllocateAndInitializeSid
RegCreateKeyExW
RegCreateKeyExA
RegCloseKey
QueryServiceStatus
OpenThreadToken
OpenServiceW
OpenSCManagerW
OpenProcessToken
LookupAccountSidW
LookupAccountNameW
IsValidSid
InitializeSecurityDescriptor
GetUserNameW
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority

shell32

DragFinish
DragQueryFileW

comctl32

ord17

Exports

Exports

DllRegisterServer
DllUnregisterServer
IPSecAllocPolMem
IPSecAllocPolStr
IPSecAssignPolicy
IPSecChooseDriverBootMode
IPSecClosePolicyStore
IPSecCopyAuthMethod
IPSecCopyFilterData
IPSecCopyFilterSpec
IPSecCopyISAKMPData
IPSecCopyNFAData
IPSecCopyNegPolData
IPSecCopyPolicyData
IPSecCreateFilterData
IPSecCreateISAKMPData
IPSecCreateNFAData
IPSecCreateNegPolData
IPSecCreatePolicyData
IPSecDeleteFilterData
IPSecDeleteISAKMPData
IPSecDeleteNFAData
IPSecDeleteNegPolData
IPSecDeletePolicyData
IPSecEnumFilterData
IPSecEnumISAKMPData
IPSecEnumNFAData
IPSecEnumNegPolData
IPSecEnumPolicyData
IPSecExportPolicies
IPSecFreeFilterData
IPSecFreeFilterSpec
IPSecFreeFilterSpecs
IPSecFreeISAKMPData
IPSecFreeMulFilterData
IPSecFreeMulISAKMPData
IPSecFreeMulNFAData
IPSecFreeMulNegPolData
IPSecFreeMulPolicyData
IPSecFreeNFAData
IPSecFreeNegPolData
IPSecFreePolMem
IPSecFreePolStr
IPSecFreePolicyData
IPSecGetAssignedDomainPolicyName
IPSecGetAssignedPolicyData
IPSecGetFilterData
IPSecGetISAKMPData
IPSecGetNegPolData
IPSecImportPolicies
IPSecIsDomainPolicyAssigned
IPSecIsLocalPolicyAssigned
IPSecOpenPolicyStore
IPSecReallocatePolMem
IPSecReallocatePolStr
IPSecRestoreDefaultPolicies
IPSecSetFilterData
IPSecSetISAKMPData
IPSecSetNFAData
IPSecSetNegPolData
IPSecSetPolicyData
IPSecUnassignPolicy

Sections

.text
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 80KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e04febe3beda3357a65446026400c3f1

Headers

File Characteristics

Imports

version

ws2_32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

Exports

Exports

Sections

.text Size: 192KB - Virtual size: 192KB

.rdata Size: 48KB - Virtual size: 48KB

.data Size: 80KB - Virtual size: 1.7MB

.idata Size: 12KB - Virtual size: 12KB

.rsrc Size: 32KB - Virtual size: 32KB

.text
Size: 192KB - Virtual size: 192KB

.rdata
Size: 48KB - Virtual size: 48KB

.data
Size: 80KB - Virtual size: 1.7MB

.idata
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 32KB - Virtual size: 32KB