2620365b074715495e887e6f9a0dec02_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2620365b074715495e887e6f9a0dec02_JaffaCakes118
Size

4.0MB
MD5

2620365b074715495e887e6f9a0dec02
SHA1

f05e863833ea9ddd15d77de0d9dc2bce66c1bfa6
SHA256

e72df41d4ff6882ce5032ab5d1834f61ce3ce4dfe3098c9f9c3bd3ee854a0676
SHA512

dbd8ab6ac5ced6dac174a68904632ba01cd81ba638b030b53487bb6c2c894518b04ca1a3e53a0c553bb0a46dd84ac3d85dfafc913d927f147020e2629ae12f9d
SSDEEP

49152:z1rx2l+EtfsLgAI4XIrXNjoI+r9mJb2EzgAuMtnDs8X:z1ksEt0Ulr9x+B8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2620365b074715495e887e6f9a0dec02_JaffaCakes118

Files

2620365b074715495e887e6f9a0dec02_JaffaCakes118
.exe windows:4 windows x86 arch:x86

adea51ff391ba2ddad9aeee8b23287bf

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

dsound

ord1

kernel32

CreateToolhelp32Snapshot
GetCurrentProcessId
GetFileSize
GetSystemDirectoryA
FindNextFileA
FindClose
GetComputerNameA
WriteFile
SetFilePointer
GetLocalTime
SuspendThread
ResumeThread
GetCurrentThreadId
CreateDirectoryA
CopyFileA
DeleteCriticalSection
TerminateThread
GetExitCodeThread
WaitForSingleObject
SetThreadPriority
_lwrite
_lclose
_lcreat
CompareFileTime
GlobalFree
GlobalAlloc
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
FreeLibrary
GetProcAddress
LoadLibraryA
IsDBCSLeadByte
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
TerminateProcess
LocalFree
LocalAlloc
GetLastError
SetEndOfFile
SetEnvironmentVariableA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
IsBadReadPtr
QueryPerformanceCounter
GetSystemInfo
Module32First
lstrcatA
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetTimeZoneInformation
LCMapStringW
LCMapStringA
GetCPInfo
GetOEMCP
GetFileType
GetStdHandle
SetHandleCount
HeapSize
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
SetUnhandledExceptionFilter
ExitProcess
GetCommandLineA
GetStartupInfoA
GetSystemTimeAsFileTime
HeapReAlloc
RtlUnwind
HeapFree
HeapAlloc
RaiseException
VirtualQuery
GetSystemDefaultLangID
GetCurrentProcess
GetModuleHandleA
ResetEvent
CreateEventA
SetEvent
GetModuleFileNameA
FindFirstFileA
CreateFileA
ReadFile
CloseHandle
Module32Next
InitializeCriticalSection
GetCurrentThread
GetTickCount
Sleep
EnterCriticalSection
LeaveCriticalSection
ExitThread
lstrlenA
lstrcmpiA
CompareStringW
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetLocaleInfoA
DeleteFileA
OutputDebugStringA
lstrcmpA
VirtualProtect
lstrcpyA
InterlockedExchange
GetACP
GetEnvironmentStringsW
CreateThread
CompareStringA

user32

SendMessageA
SetWindowTextA
DefWindowProcA
PostMessageA
SetForegroundWindow
PostQuitMessage
SetFocus
GetForegroundWindow
ReleaseDC
GetWindowTextA
GetDC
DispatchMessageA
TranslateMessage
PeekMessageA
DrawTextA
SetWindowLongA
ShowCursor
UpdateWindow
ShowWindow
CreateWindowExA
LoadBitmapA
CallWindowProcA
RegisterClassA
LoadCursorA
LoadIconA
GetSystemMetrics
GetClassNameA
EnumWindows
FindWindowA
wsprintfA
CharLowerA
SetTimer
OffsetRect
ClientToScreen
GetClientRect
MessageBoxA
GetWindowRect
GetDesktopWindow

gdi32

GetStockObject
CreateDCA
GetObjectA
GetDIBits
CreateCompatibleBitmap
DeleteObject
CreateCompatibleDC
BitBlt
DeleteDC
TextOutA
CreateFontA
SelectObject
SetBkMode
SetTextColor

advapi32

RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegCloseKey

shell32

ShellExecuteA

ole32

CoCreateInstance
CoUninitialize
CoInitialize

handes

?DecryptFunc@@YGHPAD0@Z

ddraw

DirectDrawCreate

winmm

mixerSetControlDetails
timeEndPeriod
timeKillEvent
timeSetEvent
timeBeginPeriod
mmioClose
mmioAscend
mmioRead
mmioDescend
mmioOpenA
mmioSeek
mmioSetInfo
mmioAdvance
mmioGetInfo
mixerClose
mixerOpen
mixerGetDevCapsA
mixerGetControlDetailsA
mixerGetLineControlsA
mixerGetLineInfoA
timeGetTime

shlwapi

PathFileExistsA

wininet

HttpQueryInfoA
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetQueryDataAvailable

imm32

ImmSetConversionStatus
ImmGetContext
ImmSetOpenStatus

wsock32

WSACleanup
getsockname
accept
setsockopt
inet_addr
gethostbyname
closesocket
WSAGetLastError
recv
inet_ntoa
htons
send
WSAAsyncSelect
connect
ioctlsocket
socket
WSAStartup

Exports

Exports

SetExtChangeZip
UnZipData
UnZipDataToDirectory
UnZipDataToFile
UnZipFile
ZipData
ZipFile
_CloseD3d@0
_InitD3D@4
_smPlayD3D@24
fcEXP

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 204KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 944KB - Virtual size: 62.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

KPTTrans
Size: 1024KB - Virtual size: 1024KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_exp
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

adea51ff391ba2ddad9aeee8b23287bf

Headers

File Characteristics

Imports

dsound

kernel32

user32

gdi32

advapi32

shell32

ole32

handes

ddraw

winmm

shlwapi

wininet

imm32

wsock32

Exports

Exports

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 204KB - Virtual size: 203KB

.data Size: 944KB - Virtual size: 62.0MB

.rsrc Size: 164KB - Virtual size: 163KB

KPTTrans Size: 1024KB - Virtual size: 1024KB

_exp Size: 4KB - Virtual size: 4KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 204KB - Virtual size: 203KB

.data
Size: 944KB - Virtual size: 62.0MB

.rsrc
Size: 164KB - Virtual size: 163KB

KPTTrans
Size: 1024KB - Virtual size: 1024KB

_exp
Size: 4KB - Virtual size: 4KB