28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118
Size

252KB
MD5

28aef35f8c0d8e47c8941d8e793c9658
SHA1

a873dd06d6b780730f11b324386fc17b275ef6a2
SHA256

c4d5038d27d3ebf19646addd4841f00624bddab48da2f334adbf438b79e2149b
SHA512

158715cf3c4b4a670ff61422824dab198dc7ad1a990f2486927592e42983ad468ab41a11864678e727b76c0433ea23bce5ce060836b68d98f527d20acca8d9ac
SSDEEP

3072:5z732vID7NYWvmySFOjWNsii1LPXyCrNG+JkL7jSO2YdD7QQ+6Z/Bodrh0iv00VR:5GvIN94qdisAt3gNbwJoduy/mqgGcSu2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118

Files

28aef35f8c0d8e47c8941d8e793c9658_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9b15ac7f55966c3c12902779af2a427e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Work61\Student\Release\student.pdb

Imports

wsock32

WSAGetLastError
setsockopt
listen
WSAStartup
send
recv
accept
ioctlsocket
recvfrom
sendto
inet_ntoa
bind
inet_addr
gethostbyname
gethostname
closesocket
socket
WSACleanup

winmm

PlaySoundA

setupapi

SetupDiGetClassDevsA
SetupDiCallClassInstaller
SetupDiSetClassInstallParamsA
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList
SetupDiOpenClassRegKey
SetupDiEnumDeviceInfo

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

rpcrt4

UuidCreate

mpr

WNetGetUserA

kernel32

GetTickCount
OutputDebugStringA
GetModuleHandleA
CreateFileA
DeviceIoControl
VirtualFree
VirtualAlloc
GetComputerNameA
lstrlenA
TerminateProcess
GetCurrentProcess
CreateEventA
CreateThread
WaitForSingleObject
QueryPerformanceFrequency
DeleteFileA
GetModuleFileNameA
GetShortPathNameA
GetCurrentDirectoryA
SetCurrentDirectoryA
SearchPathA
WaitForMultipleObjects
GetProcessHeap
SetThreadPriority
GetCurrentThread
GetCurrentProcessId
FindResourceA
LoadResource
LockResource
SizeofResource
HeapAlloc
HeapFree
WriteFile
CreateProcessA
SetErrorMode
lstrcatA
FindNextFileA
FindClose
GetFileSize
ReadFile
LocalLock
LocalUnlock
GetVersion
lstrcpyA
LocalAlloc
LocalFree
CreateRemoteThread
VirtualFreeEx
VirtualAllocEx
GetExitCodeThread
OpenEventA
WriteProcessMemory
LCMapStringA
TlsAlloc
SetLastError
TlsFree
GetCPInfo
GetOEMCP
GetACP
GetCommandLineA
GetStartupInfoA
GetSystemTimeAsFileTime
TlsGetValue
TlsSetValue
ExitThread
FlushFileBuffers
VirtualProtect
GetSystemInfo
VirtualQuery
GetTimeFormatA
GetDateFormatA
FileTimeToSystemTime
FileTimeToLocalFileTime
CompareFileTime
SystemTimeToFileTime
GetSystemTime
GetLastError
Process32Next
Process32First
CreateToolhelp32Snapshot
FreeLibrary
GetProcAddress
LoadLibraryA
QueryPerformanceCounter
CloseHandle
OpenProcess
GetVersionExA
GetCurrentThreadId
ResetEvent
SetEvent
Sleep
GetSystemDirectoryA
GetWindowsDirectoryA
CreateDirectoryA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
IsBadWritePtr
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
UnhandledExceptionFilter
DeleteCriticalSection
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
HeapDestroy
HeapCreate
HeapReAlloc
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
RtlUnwind
InitializeCriticalSection
SetFilePointer
SetStdHandle
GetTimeZoneInformation
HeapSize
SetEndOfFile
GetLocaleInfoW
CompareStringA
CompareStringW
FindFirstFileA
SetEnvironmentVariableA

user32

ClientToScreen
GetSystemMenu
TrackPopupMenu
LoadBitmapA
RegisterClassA
UnregisterClassA
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
GetSysColor
DrawIconEx
GetClassLongA
DrawFrameControl
IsWindowUnicode
IsZoomed
EnableMenuItem
GetClientRect
IsIconic
EnumChildWindows
IsWindow
GetWindowTextLengthA
ExitWindowsEx
GetWindowTextA
EnumWindows
OpenDesktopA
GetParent
ScrollWindow
MapVirtualKeyA
keybd_event
UpdateWindow
SetForegroundWindow
SetWindowPos
MoveWindow
IsWindowVisible
GetWindowPlacement
mouse_event
EndDialog
GetDoubleClickTime
GetDlgItem
SetFocus
SetDlgItemTextA
SendDlgItemMessageA
PostQuitMessage
KillTimer
EndPaint
DrawIcon
SetCapture
InvalidateRect
GetScrollRange
DialogBoxParamA
ShowCursor
SetTimer
DefWindowProcA
ShowWindow
SendMessageA
CreateWindowExA
RegisterClassExA
LoadIconA
TranslateMessage
TranslateAcceleratorA
GetMessageA
MessageBoxA
MessageBeep
CharNextA
LoadAcceleratorsA
SystemParametersInfoA
LoadStringA
RegisterWindowMessageA
WindowFromPoint
GetWindowLongA
GetWindowRect
GetClassNameA
GetForegroundWindow
GetCursorPos
ReleaseDC
GetDC
EnumDisplaySettingsA
ReleaseCapture
GetDlgItemTextA
PtInRect
wsprintfA
wvsprintfA
DestroyCursor
LoadCursorA
GetSystemMetrics
GetIconInfo
GetWindowThreadProcessId
FindWindowA
PostMessageA
SetThreadDesktop
GetThreadDesktop
CloseDesktop
GetUserObjectInformationA
OpenInputDesktop
DispatchMessageA
PeekMessageA
PostThreadMessageA
SetWindowWord
SetClassLongA
SetCursor
SetScrollPos
SetWindowLongA
SetScrollRange
GetWindowWord
GetActiveWindow
InflateRect
GetWindowDC
BeginPaint
OffsetRect
DestroyWindow

gdi32

Polygon
CreateSolidBrush
CreatePen
GetTextExtentPoint32A
CreateFontIndirectA
SetTextColor
SetBkMode
CreatePatternBrush
ExtTextOutA
SetBkColor
GetBkColor
SetBrushOrgEx
UnrealizeObject
GetObjectA
GetStockObject
PatBlt
SetDIBitsToDevice
StretchDIBits
GetPixel
StretchBlt
GetRegionData
BitBlt
DeleteDC
SelectObject
CreateDIBSection
GetDIBits
CreateCompatibleBitmap
CreateCompatibleDC
GetDeviceCaps
DeleteObject
ExtEscape

advapi32

OpenProcessToken
CreateProcessAsUserA
RegFlushKey
RegRestoreKeyA
RegNotifyChangeKeyValue
RegSaveKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyExA
GetUserNameA
StartServiceA
ControlService
RegSetValueExA
RegCreateKeyA
CloseServiceHandle
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegEnumValueA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RevertToSelf
ImpersonateLoggedOnUser

shell32

ShellExecuteA
Shell_NotifyIconA

ole32

CoCreateInstance
CoUninitialize
CoInitialize

Sections

.text
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9b15ac7f55966c3c12902779af2a427e

Headers

File Characteristics

PDB Paths

Imports

wsock32

winmm

setupapi

version

rpcrt4

mpr

kernel32

user32

gdi32

advapi32

shell32

ole32

Sections

.text Size: 172KB - Virtual size: 171KB

.rdata Size: 36KB - Virtual size: 33KB

.data Size: 8KB - Virtual size: 93KB

.rsrc Size: 32KB - Virtual size: 28KB

.text
Size: 172KB - Virtual size: 171KB

.rdata
Size: 36KB - Virtual size: 33KB

.data
Size: 8KB - Virtual size: 93KB

.rsrc
Size: 32KB - Virtual size: 28KB