2a2164be8da29672bac3418ef1c19944_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2a2164be8da29672bac3418ef1c19944_JaffaCakes118
Size

93KB
MD5

2a2164be8da29672bac3418ef1c19944
SHA1

5a35550d77adb4c770f09ae23f4fbe673b54e9cd
SHA256

02c1c79252220d91a93d6a83c82483537c8a8701622381c628c1ab4b6b907a7c
SHA512

a55565d57b016b093fcdd5ffb6a13094912999774777089f98a94815166bdff513e4ce7452cc16de5cab23be7aa29a5d711024ec522c43d8e1896b071f449dd7
SSDEEP

1536:Wm6SAMhI+o1ALmpW+CZZQhpsg86zRWPHkBdMjS6bdzarFQsY:W8hdwALmpsZZQhm6EUGS6bharFc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2a2164be8da29672bac3418ef1c19944_JaffaCakes118

Files

2a2164be8da29672bac3418ef1c19944_JaffaCakes118
.exe windows:5 windows x86 arch:x86

5d2d16c5a7bb46f9c7660730bc3f5362

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
SetLastError
GetProcAddress
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
FindClose
LoadLibraryA
RemoveDirectoryW
WaitForMultipleObjects
lstrcmpiW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
LocalFree
WriteProcessMemory
SetFileAttributesW
VirtualFreeEx
ExitProcess
GetTimeZoneInformation
lstrcmpiA
WTSGetActiveConsoleSessionId
MoveFileExW
GetModuleFileNameW
GetUserDefaultUILanguage
GetCommandLineW
SetErrorMode
GetComputerNameW
GetVersionExW
CreateEventW
GetFileAttributesExW
OpenEventW
DuplicateHandle
GetCurrentProcessId
SetThreadPriority
GlobalLock
GlobalUnlock
GetNativeSystemInfo
GetThreadContext
SetThreadContext
GetProcessId
GetPrivateProfileStringW
GetPrivateProfileIntW
ResetEvent
CreateRemoteThread
Process32FirstW
Process32NextW
WideCharToMultiByte
Thread32First
ReadFile
Thread32Next
GetFileAttributesW
HeapCreate
HeapDestroy
ReadProcessMemory
OpenProcess
WriteFile
Sleep
SetEvent
LoadLibraryW
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualFree
GetCurrentThread
GetTickCount
GetModuleHandleW
WaitForSingleObject
CreateDirectoryW
HeapFree
InitializeCriticalSection
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
FreeLibrary
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
CreateThread
GetSystemTime
CloseHandle
GetLocalTime
EnterCriticalSection
LeaveCriticalSection
ExpandEnvironmentStringsW

user32

ExitWindowsEx
LoadImageW
ToUnicode
GetClipboardData
GetKeyboardState
GetCursorPos
DispatchMessageW
GetIconInfo
MsgWaitForMultipleObjects
CharToOemW
TranslateMessage
DrawIcon
CharLowerBuffA
CharLowerW
CharUpperW
PeekMessageW
CharLowerA

advapi32

GetSecurityDescriptorSacl
RegOpenKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptCreateHash
LookupPrivilegeValueW
SetNamedSecurityInfoW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CreateProcessAsUserW
RegQueryValueExW
CryptReleaseContext
RegCreateKeyExW
GetTokenInformation
GetSidSubAuthorityCount
OpenThreadToken
CryptAcquireContextW
GetSidSubAuthority
OpenProcessToken
CryptGetHashParam
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
EqualSid
IsWellKnownSid
GetLengthSid
ConvertSidToStringSidW
InitiateSystemShutdownExW

shlwapi

UrlUnescapeA
wvnsprintfW
PathIsDirectoryW
PathFindFileNameW
PathRemoveFileSpecW
PathAddBackslashW
SHDeleteValueW
PathSkipRootW
SHDeleteKeyW
PathCombineW
PathAddExtensionW
PathUnquoteSpacesW
PathRemoveBackslashW
PathMatchSpecW
StrCmpNIA
wvnsprintfA
StrCmpNIW
PathRenameExtensionW
PathQuoteSpacesW
PathIsURLW

shell32

ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

CLSIDFromString
StringFromGUID2

ws2_32

closesocket
freeaddrinfo
socket
bind
shutdown
recv
setsockopt
WSAEventSelect
getpeername
recvfrom
sendto
WSAIoctl
connect
WSAStartup
getaddrinfo
select
WSAGetLastError
getsockname
send
listen
accept
WSASetLastError

crypt32

PFXImportCertStore
PFXExportCertStoreEx
CertDeleteCertificateFromStore
CertOpenSystemStoreW
CertCloseStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext

wininet

HttpOpenRequestA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetQueryOptionA
InternetSetOptionA
InternetReadFile
InternetQueryOptionW
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpAddRequestHeadersA
InternetCrackUrlA
InternetConnectA
HttpQueryInfoA

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5d2d16c5a7bb46f9c7660730bc3f5362

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

ws2_32

crypt32

wininet

netapi32

Sections

.text Size: 87KB - Virtual size: 87KB

.data Size: 512B - Virtual size: 7KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 87KB - Virtual size: 87KB

.data
Size: 512B - Virtual size: 7KB

.reloc
Size: 4KB - Virtual size: 3KB