282976ac939415b8190b93d7f027feac_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

282976ac939415b8190b93d7f027feac_JaffaCakes118
Size

528KB
MD5

282976ac939415b8190b93d7f027feac
SHA1

2140b29215b11b7eb8e59136840e3566c7c96b62
SHA256

976644a274df5812219191dec80a099599212919b22f8452d0fc00050cef1426
SHA512

5aa05cc51c00e7c6209bf4b17464483dcd99000969611aab90ddc73e465d7f5fc8140c8e92dcaf88165bb123a4df785f9d66404fae761270832148f25d7707d3
SSDEEP

12288:6z5cJE3/aRo7DfkyZNfuerEgejj3hJsyb4V:61aR2fkyZNfuXpXRJsy4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
282976ac939415b8190b93d7f027feac_JaffaCakes118

Files

282976ac939415b8190b93d7f027feac_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f0962847e385deaca76394d795fefbae

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
CreateDirectoryW
WriteFile
CreateFileW
SetFilePointer
ReadFile
SystemTimeToFileTime
LocalFileTimeToFileTime
GetFileAttributesW
GetCurrentDirectoryW
SetFileTime
GetFileSize
SetEndOfFile
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
GetConsoleMode
LoadResource
GetStartupInfoA
GetFileType
SetHandleCount
IsValidCodePage
MoveFileExW
HeapCreate
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
GetStdHandle
GetStringTypeW
GetStringTypeA
ExitProcess
GetModuleHandleA
GetCPInfo
LCMapStringW
LCMapStringA
GetStartupInfoW
CreateThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
GetThreadLocale
GetLocaleInfoA
GetACP
VirtualAlloc
VirtualFree
ResumeThread
TerminateThread
WaitForSingleObject
GetExitCodeThread
WideCharToMultiByte
FindResourceExW
LockResource
GetModuleFileNameW
SizeofResource
MultiByteToWideChar
FreeLibrary
SetLastError
CloseHandle
CompareStringW
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
GetLastError
IsProcessorFeaturePresent
LoadLibraryA
GetProcAddress
GetVersionExA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
Sleep
InterlockedExchange
InterlockedCompareExchange
GetModuleHandleW
LoadLibraryExW
GetOEMCP
lstrlenW
GetCurrentThreadId
GetCurrentProcess
FindResourceW
FlushInstructionCache
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetConsoleCP

user32

SetWindowPos
GetWindowRect
GetCapture
ReleaseCapture
CharNextW
DefWindowProcW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
ShowWindow
GetClientRect
ClientToScreen
SetCapture
PtInRect
SetRectEmpty
DestroyWindow
SendMessageW
SetWindowLongW
GetClassInfoW
LoadStringW
wsprintfW
GetSystemMetrics
LoadImageW
LoadBitmapW
PostQuitMessage
GetWindow
SystemParametersInfoW
MapWindowPoints
IsDialogMessageW
GetDlgItem
EnableWindow
PostMessageW
UnregisterClassA
RegisterClassW
MessageBoxW
GetClassNameW
LoadCursorW
CreateDialogParamW
OffsetRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetCursorPos
SetCursor
CallWindowProcW
IsWindow
GetDlgCtrlID
GetParent
SetFocus
InvalidateRect
UpdateWindow
ScreenToClient
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
CreateWindowExW
GetWindowLongW
DrawTextW

gdi32

GetStockObject
SelectObject
GetObjectW
CreateCompatibleDC
DeleteObject
CreateFontIndirectW
DeleteDC

advapi32

RegOpenKeyExW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegDeleteKeyW

shell32

ShellExecuteW

ole32

CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

PathFindFileNameW
PathFileExistsW
PathRemoveExtensionW

comctl32

_TrackMouseEvent
InitCommonControlsEx

msimg32

TransparentBlt

wininet

InternetSetOptionW
HttpSendRequestW
HttpQueryInfoW
HttpOpenRequestW
InternetCloseHandle
InternetCrackUrlW
InternetGetLastResponseInfoW
InternetReadFile
InternetOpenW
InternetConnectW

commonlib

ord1
?ToArray@CMyBuffer@Buffer@Common@@QBEPBDXZ
?GetDataLength@CMyBuffer@Buffer@Common@@QBEHXZ
??0CMyBuffer@Buffer@Common@@QAE@XZ
ord2
??1CMyBuffer@Buffer@Common@@QAE@XZ

garenaskin2

_SetSkinPath@4
_UninstallSkin@0
_InstallSkin@0

Sections

.text
Size: 372KB - Virtual size: 369KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f0962847e385deaca76394d795fefbae

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

wininet

commonlib

garenaskin2

Sections

.text Size: 372KB - Virtual size: 369KB

.rdata Size: 68KB - Virtual size: 67KB

.data Size: 12KB - Virtual size: 19KB

.rsrc Size: 72KB - Virtual size: 68KB

.text
Size: 372KB - Virtual size: 369KB

.rdata
Size: 68KB - Virtual size: 67KB

.data
Size: 12KB - Virtual size: 19KB

.rsrc
Size: 72KB - Virtual size: 68KB