27c92f97f0c2928833c7ccf1621e7629_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

27c92f97f0c2928833c7ccf1621e7629_JaffaCakes118
Size

263KB
MD5

27c92f97f0c2928833c7ccf1621e7629
SHA1

bfa17816e97d30de013014f2c7272d46902dc2ba
SHA256

22f6dba0d4ed5ab1bbb54540a093c1892b68880f5f88b7f4ed26e256e8edd0bd
SHA512

e494e986fd070d7295537c418524ac1691c20b75f601b6a25556664ce84b47c0e9e1970006c6ede5b0e67d18dc7fab04d5929b2eb91aa662d652eceb185ad5fd
SSDEEP

6144:zhPZy+chYf9vFAQewiHStKoOZ3j7BAkQd/b+TGCokrArDP6c:7Bf9FLlpOJxQdjlD7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27c92f97f0c2928833c7ccf1621e7629_JaffaCakes118

Files

27c92f97f0c2928833c7ccf1621e7629_JaffaCakes118
.exe windows:4 windows x86 arch:x86

25183378310110959ceeb836b69040b1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

RpcStringBindingParseW
NdrConformantArrayUnmarshall
I_RpcGetBuffer
NdrConvert
NdrSendReceive
NdrConformantStringMarshall
NdrConformantArrayMarshall
UuidCreate
NdrFreeBuffer
NdrConformantStringUnmarshall
NdrGetBuffer
NdrServerInitializeNew
RpcRaiseException
RpcStringFreeW
RpcBindingFromStringBindingW
RpcBindingServerFromClient
RpcBindingFree
NdrClientInitializeNew
NdrConformantStringBufferSize
NdrAllocate
RpcBindingToStringBindingW
NdrPointerFree
RpcStringBindingComposeW
NdrConformantArrayBufferSize

psapi

GetModuleFileNameExW
EnumProcessModules

gdi32

ExcludeClipRect
SetBkColor
StretchBlt
GetMapMode
SetBkMode
SetTextAlign
CreateFontIndirectW
EnumFontFamiliesExW
PtVisible
GetObjectW
GetTextExtentPoint32A
GetCurrentPositionEx
GetDIBits
EnumFontFamiliesExA
GetTextMetricsA
TextOutA
CreateCompatibleBitmap
RectVisible
CreateSolidBrush
BitBlt
CreateRectRgnIndirect
CreateBitmap
GetWindowExtEx
CreateDIBPatternBrushPt
SetWindowOrgEx
GetTextExtentPointW
DPtoLP
CombineRgn
CreateFontA
GetDeviceCaps
PatBlt
ExtCreatePen
SetStretchBltMode
SetLayout
CreatePatternBrush
ExtTextOutW
IntersectClipRect
SetTextColor
SaveDC
GetCurrentObject
GetStockObject
SetMapMode
SetWindowExtEx
GetPixel
CreateCompatibleDC
GetWindowOrgEx
SetPixel
RestoreDC
CreatePen
LPtoDP
GetViewportExtEx
CreateDIBSection
GetClipBox
StretchDIBits
GetObjectA
CreateRoundRectRgn
SetViewportOrgEx
DeleteObject
Rectangle
SetBrushOrgEx
AddFontMemResourceEx
TextOutW
Escape
CreateHatchBrush
SelectObject
Polygon
GetTextExtentPoint32W
SetViewportExtEx
GetTextAlign
GetTextExtentExPointW
DeleteDC

advapi32

RegEnumValueW
OpenThreadToken
AddAccessAllowedAce
IsTextUnicode
GetLengthSid
RegOpenKeyExA
RegOpenKeyW
RegQueryValueExW
InitializeAcl
OpenServiceW
RegOpenKeyExW
GetTokenInformation
RegCloseKey
InitializeSecurityDescriptor
OpenSCManagerW
SetSecurityDescriptorDacl
RegEnumKeyExW
EqualSid
RegQueryValueExA
CloseServiceHandle
AllocateAndInitializeSid
OpenProcessToken
FreeSid

wininet

InternetGetLastResponseInfoA
HttpSendRequestA
HttpQueryInfoA
InternetSetOptionA
InternetOpenA
InternetQueryOptionA
InternetCloseHandle
InternetReadFile
InternetCombineUrlA
InternetConnectA
HttpOpenRequestA
InternetCanonicalizeUrlW

user32

GetDlgCtrlID
GetAsyncKeyState
LoadImageW
EnumClipboardFormats
DispatchMessageW
SendNotifyMessageW
BeginPaint
ScreenToClient
GetCapture
GetWindowLongA
CopyRect
CloseClipboard
GetClientRect
SetScrollPos
TrackPopupMenu
CheckMenuItem
ReleaseDC
ShowWindow
OffsetRect
AdjustWindowRectEx
PtInRect
GetDC
SetWindowLongW
keybd_event
GetParent
DrawTextA
EndDeferWindowPos
LoadMenuW
IsIconic
GetClipboardData
SetMenuDefaultItem
GetWindowThreadProcessId
CreateWindowExA
SendMessageA
MapWindowPoints
CallNextHookEx
SetWindowRgn
InvertRect
ScrollDC
GetCaretBlinkTime
GetFocus
GetSystemMetrics
LoadIconW
SetCapture
KillTimer
GetWindowTextW
DeleteMenu
RegisterClipboardFormatW
LoadStringW
ReleaseCapture
MessageBeep
PostMessageW
RegisterWindowMessageA
SetScrollRange
GetScrollInfo
SendMessageW
TranslateMessage
SystemParametersInfoW
GetScrollPos
MessageBoxW
IsChild
RegisterClassExA
IsWindow
IsWindowEnabled
CreateDesktopW
GetSysColorBrush
GetWindowDC
PeekMessageA
GetMessageA
RegisterClassExW
SetParent
RedrawWindow
DrawFocusRect
SetClipboardData
GetWindowPlacement
WindowFromPoint
SetWindowsHookExA
OpenClipboard
DrawEdge
SetWindowPos
EndPaint
EnableWindow
GetCursorPos
GetClassLongA
CopyIcon
DrawIcon
GetIconInfo
SetFocus
GetMenuItemCount
LoadCursorW
GetWindowLongW
GetWindow
SwitchDesktop
RegisterClassA
DestroyWindow
SetTimer
GetKeyState
BeginDeferWindowPos
IsWindowVisible
DeferWindowPos
GetMenuItemID
ScrollWindowEx
LoadCursorFromFileA
GetSysColor
GetClassNameW
DrawFrameControl
InvalidateRect
ClientToScreen
OpenDesktopW
InflateRect
ValidateRect
CharUpperBuffW
GrayStringW
RegisterClassW
InsertMenuW
UpdateWindow
CreateCursor
NotifyWinEvent
CreateIconFromResourceEx
GetDesktopWindow
DefWindowProcA
SetScrollInfo
SetWindowLongA
DispatchMessageA
LoadCursorA
CountClipboardFormats
TabbedTextOutW
SetThreadDesktop
CharLowerBuffW
IsClipboardFormatAvailable
EnableMenuItem
SendMessageTimeoutA
CallWindowProcW
EmptyClipboard
GetWindowTextLengthW
SetCursor
wsprintfW
SetForegroundWindow
DefWindowProcW
MapVirtualKeyW
GetActiveWindow
DrawTextExW
ModifyMenuW
GetMonitorInfoW
UnhookWindowsHookEx
PostMessageA
RegisterWindowMessageW
GetWindowRect
SystemParametersInfoA
IsWindowUnicode
DestroyIcon
FillRect
GetMessageW
GetSubMenu
CloseDesktop
MoveWindow
LoadBitmapW
GetDoubleClickTime
MonitorFromWindow
DrawIconEx
FindWindowW
DrawTextW
CreateWindowExW

oleaut32

SysAllocStringLen
SysFreeString
SysAllocString
VariantTimeToSystemTime
SystemTimeToVariantTime

urlmon

FindMimeFromData

msimg32

GradientFill

comdlg32

GetOpenFileNameW

comctl32

ImageList_Draw
ImageList_DrawEx
ImageList_GetIconSize
ord17
ImageList_GetImageInfo

shlwapi

PathCompactPathW
ColorHLSToRGB
PathFileExistsW
PathIsDirectoryW
ColorRGBToHLS

ws2_32

gethostbyname
inet_ntoa
WSACleanup
WSAStartup
WSAGetLastError
ntohs
gethostbyaddr
WSASetLastError
getservbyport
htons
htonl
inet_addr
getservbyname

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

shell32

SHGetPathFromIDListW
SHGetDesktopFolder
SHGetMalloc
SHBrowseForFolderW
ShellExecuteW
Shell_NotifyIconW
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetFileInfoW

oleacc

CreateStdAccessibleObject
LresultFromObject
AccessibleObjectFromWindow

ole32

CoCreateGuid
StringFromCLSID
CoTaskMemFree
CoCreateInstance
CLSIDFromString

kernel32

OpenEventW
Process32FirstW
EnterCriticalSection
TlsGetValue
SystemTimeToFileTime
WaitNamedPipeW
FindClose
GetWindowsDirectoryW
GetSystemDirectoryA
CopyFileW
ExitThread
FlushViewOfFile
GetPrivateProfileStringW
SetFilePointer
LCMapStringW
CreateProcessW
MulDiv
TerminateThread
ConnectNamedPipe
CreateEventA
GetDiskFreeSpaceExW
LockResource
lstrcmpW
GetSystemTimeAsFileTime
SizeofResource
WriteFile
MapViewOfFile
GetExitCodeThread
DeviceIoControl
UnmapViewOfFile
GetFileSize
DisconnectNamedPipe
GetProcessHeap
WaitForSingleObject
GetCurrentThreadId
CreateToolhelp32Snapshot
GetUserDefaultLangID
SetLastError
GetTempFileNameA
InitializeCriticalSectionAndSpinCount
LoadResource
IsDebuggerPresent
GetQueuedCompletionStatus
DeleteCriticalSection
WaitForMultipleObjects
LocalUnlock
LoadLibraryExW
GetTempPathA
RaiseException
GetModuleHandleW
GetNumberFormatW
LocalAlloc
SetUnhandledExceptionFilter
GetTempFileNameW
SetEndOfFile
CreateThread
FileTimeToSystemTime
CloseHandle
GetACP
LocalFree
GetSystemDirectoryW
WideCharToMultiByte
GetCurrencyFormatW
ReleaseMutex
FindNextFileW
GlobalLock
FreeLibrary
FlushFileBuffers
CreateFileW
GetTempPathW
CreateFileMappingA
GetTimeFormatW
TlsAlloc
CreateNamedPipeW
GetLocalTime
Process32NextW
FindResourceA
ExpandEnvironmentStringsA
SetThreadLocale
CreateIoCompletionPort
UnhandledExceptionFilter
CreateEventW
OpenProcess
TlsSetValue
OutputDebugStringW
lstrcmpiW
GetThreadLocale
HeapFree
ExpandEnvironmentStringsW
GlobalAlloc
GetShortPathNameW
SetProcessWorkingSetSize
ReadFile
GetDateFormatW
GetUserDefaultLCID
FindFirstFileW
LeaveCriticalSection
CreateMutexW
CreateDirectoryW
HeapAlloc
DeleteFileW
FindResourceW
GlobalUnlock
VirtualAlloc

winmm

timeKillEvent
timeGetDevCaps
PlaySoundA
timeGetTime
timeSetEvent

odbccp32

SQLGetPrivateProfileString
SelectTransDlg
SQLInstallTranslatorW
SQLConfigDriver
SQLInstallerErrorW
SQLCreateDataSourceEx

tapisrv

ServiceMain

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bKzmy
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Rdde
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Q
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.VMEWn
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.s
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vcL
Size: 512B - Virtual size: 802B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 212KB - Virtual size: 422KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.VXZuXt
Size: 512B - Virtual size: 162B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.JSPAtb
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

25183378310110959ceeb836b69040b1

Headers

DLL Characteristics

File Characteristics

Imports

rpcrt4

psapi

gdi32

advapi32

wininet

user32

oleaut32

urlmon

msimg32

comdlg32

comctl32

shlwapi

ws2_32

version

shell32

oleacc

ole32

kernel32

winmm

odbccp32

tapisrv

Sections

.text Size: 17KB - Virtual size: 17KB

.bKzmy Size: 1KB - Virtual size: 1KB

.Rdde Size: 1024B - Virtual size: 1KB

.Q Size: 2KB - Virtual size: 3KB

.rdata Size: 12KB - Virtual size: 12KB

.VMEWn Size: 2KB - Virtual size: 3KB

.s Size: 1024B - Virtual size: 1KB

.vcL Size: 512B - Virtual size: 802B

.data Size: 212KB - Virtual size: 422KB

.VXZuXt Size: 512B - Virtual size: 162B

.JSPAtb Size: 2KB - Virtual size: 3KB

.rsrc Size: 9KB - Virtual size: 9KB

.text
Size: 17KB - Virtual size: 17KB

.bKzmy
Size: 1KB - Virtual size: 1KB

.Rdde
Size: 1024B - Virtual size: 1KB

.Q
Size: 2KB - Virtual size: 3KB

.rdata
Size: 12KB - Virtual size: 12KB

.VMEWn
Size: 2KB - Virtual size: 3KB

.s
Size: 1024B - Virtual size: 1KB

.vcL
Size: 512B - Virtual size: 802B

.data
Size: 212KB - Virtual size: 422KB

.VXZuXt
Size: 512B - Virtual size: 162B

.JSPAtb
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 9KB - Virtual size: 9KB