2a12f47db2a71dce3123b200fd28faac_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2a12f47db2a71dce3123b200fd28faac_JaffaCakes118
Size

2.7MB
MD5

2a12f47db2a71dce3123b200fd28faac
SHA1

0db98a075f8d832124bad70684970af41cdeb6e5
SHA256

e3b5ccce5858ab69fdf2f38cf4cdfcbe35952ab9d81faa74aab8b9918508da43
SHA512

360b3de0fe1d2df38cf1697bd9e5b94d2ab0e701d9b379c3ca7274f510e9e80799cee7644597a8d9c49ac5637e7743edf81930c6345cfa8920134e3e3bccb3cf
SSDEEP

49152:3Kil4BKNiBTI4HXXqS8WJznfP+KcneqJX83ejTlfC9kVoLpcRFr70vL:vylBHUybf2Kajxq9f0Frgz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2a12f47db2a71dce3123b200fd28faac_JaffaCakes118

Files

2a12f47db2a71dce3123b200fd28faac_JaffaCakes118
.exe windows:5 windows x86 arch:x86

3ccb9afe7c791b6102e9f1f4edec2147

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

gethostbyname
WSACleanup
WSAStartup
inet_addr
gethostname

winmm

mciSendStringA
mixerGetLineInfoA
joyGetDevCapsA
mixerOpen
mixerGetDevCapsA
mixerGetLineControlsA
mixerClose
waveOutSetVolume
mixerGetControlDetailsA
mixerSetControlDetails
joyGetPosEx
waveOutGetVolume

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

comctl32

ImageList_ReplaceIcon
ord6
ImageList_AddMasked
ImageList_Destroy
ImageList_GetIconSize
ImageList_Create

shlwapi

HashData

crypt32

CryptBinaryToStringA
CryptStringToBinaryA

psapi

GetModuleBaseNameA
GetProcessImageFileNameA
GetModuleFileNameExA

wininet

InternetOpenA
InternetCloseHandle
InternetReadFileExA
InternetReadFile
InternetOpenUrlA

kernel32

OpenThread
WideCharToMultiByte
lstrcmpiA
GetStringTypeExA
CreateThread
SetThreadPriority
GetExitCodeThread
CloseHandle
CreateMutexA
GetLastError
InterlockedIncrement
InterlockedDecrement
MultiByteToWideChar
FreeLibrary
SystemTimeToFileTime
SetFilePointerEx
ReadFile
SetFilePointer
GlobalSize
lstrcpyA
lstrlenA
lstrcmpA
LocalFileTimeToFileTime
CreateDirectoryA
CreateDirectoryW
IsBadReadPtr
CreateFileW
CreateFileA
WriteFile
SetFileTime
DuplicateHandle
LoadResource
LockResource
SizeofResource
GetCurrentDirectoryA
GetLocalTime
FileTimeToDosDateTime
GetFileInformationByHandle
GetFileSize
lstrlenW
FindClose
FindFirstFileA
FindNextFileA
LeaveCriticalSection
CreateFileMappingA
MapViewOfFile
SetLastError
FlushInstructionCache
GetTempPathA
HeapAlloc
HeapReAlloc
VirtualAlloc
VirtualFree
GetProcessHeap
HeapCreate
HeapFree
HeapDestroy
GetCommandLineA
WaitForSingleObject
GetThreadLocale
VirtualQuery
GetVersionExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCPInfo
GetACP
GetSystemDirectoryA
GetFullPathNameA
GetShortPathNameA
FileTimeToLocalFileTime
SetEnvironmentVariableA
Beep
MoveFileA
OutputDebugStringA
CreateProcessA
GetFileAttributesA
GetExitCodeProcess
WriteProcessMemory
ReadProcessMemory
GetCurrentProcessId
OpenProcess
TerminateProcess
SetPriorityClass
GetEnvironmentVariableA
GetDateFormatA
GetTimeFormatA
GetDiskFreeSpaceExA
SetVolumeLabelA
DeviceIoControl
GetDriveTypeA
GetVolumeInformationA
GetDiskFreeSpaceA
DeleteFileA
SetFileAttributesA
GetFileSizeEx
GetSystemTime
GetSystemDefaultUILanguage
GetComputerNameA
GetWindowsDirectoryA
TryEnterCriticalSection
QueryDosDeviceA
CompareStringA
GetFullPathNameW
RemoveDirectoryA
CopyFileA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetModuleFileNameW
FormatMessageA
GetPrivateProfileStringA
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
WritePrivateProfileStringA
WritePrivateProfileSectionA
HeapValidate
HeapSize
SetEndOfFile
GetFileType
GetStdHandle
FileTimeToSystemTime
VirtualAllocEx
VirtualFreeEx
EnumResourceNamesA
LoadLibraryExA
RemoveVectoredExceptionHandler
ExitProcess
ExitThread
EnterCriticalSection
GetCurrentThreadId
ResumeThread
SuspendThread
GlobalUnlock
GlobalLock
AddVectoredExceptionHandler
LoadLibraryA
SetErrorMode
InitializeCriticalSection
FindResourceA
VirtualProtect
GetSystemTimeAsFileTime
GetProcessTimes
GetCurrentProcess
CheckRemoteDebuggerPresent
GetCurrentThread
GetProcAddress
GlobalFree
_lclose
_lopen
_lread
GetModuleFileNameA
GlobalAlloc
GetModuleHandleA
SetCurrentDirectoryA
InitializeSListHead
Sleep
GetTickCount
MulDiv
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
UnmapViewOfFile
OutputDebugStringW
GetModuleHandleW
GetStartupInfoW

user32

CheckMenuItem
BlockInput
IsWindowVisible
SetWindowTextA
GetIconInfo
SetRect
DrawTextA
AdjustWindowRectEx
SystemParametersInfoA
GetClientRect
GetWindowRect
MoveWindow
EnumChildWindows
SetActiveWindow
SetFocus
SetWindowRgn
SetWindowPos
SetLayeredWindowAttributes
InvalidateRect
EnableWindow
ReleaseDC
EnumWindows
IsZoomed
IsIconic
EnumDisplayMonitors
GetMonitorInfoA
RegisterWindowMessageA
GetSysColor
GetSysColorBrush
DrawIconEx
FillRect
DefWindowProcA
SetForegroundWindow
DialogBoxParamA
SendDlgItemMessageA
GetDlgItem
SetWindowTextW
SetDlgItemTextA
MessageBeep
ClientToScreen
GetCursorInfo
GetLastInputInfo
GetSystemMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuStringA
ExitWindowsEx
SetScrollInfo
ScrollWindow
SetMenu
FlashWindow
GetPropA
SetPropA
RemovePropA
MapWindowPoints
RedrawWindow
SetParent
SendMessageW
GetClassInfoExA
GetAncestor
UpdateWindow
GetMessagePos
GetClassLongA
LoadAcceleratorsA
CallWindowProcA
CheckRadioButton
IntersectRect
ChangeClipboardChain
PtInRect
CreateDialogIndirectParamA
CreateAcceleratorTableA
InsertMenuItemA
SetMenuDefaultItem
RemoveMenu
SetMenuItemInfoA
IsMenu
GetMenuItemInfoA
CreateMenu
CreatePopupMenu
SetMenuInfo
AppendMenuA
DestroyMenu
TrackPopupMenuEx
GetDesktopWindow
CopyImage
CreateIconIndirect
CreateIconFromResourceEx
MessageBoxA
EnumClipboardFormats
GetWindow
BringWindowToTop
GetTopWindow
GetQueueStatus
GetDC
OpenClipboard
GetClipboardData
GetClipboardFormatNameA
CloseClipboard
SetClipboardData
EmptyClipboard
PostMessageA
FindWindowA
EndDialog
IsWindow
TranslateMessage
ShowWindow
CountClipboardFormats
SetWindowLongA
ScreenToClient
IsDialogMessageA
WindowFromPoint
SendMessageA
IsWindowEnabled
GetWindowLongA
GetKeyState
TranslateAcceleratorA
KillTimer
PeekMessageA
GetFocus
GetClassNameA
GetWindowThreadProcessId
GetForegroundWindow
GetMessageA
SetTimer
GetScrollInfo
GetParent
GetDlgCtrlID
CharUpperA
IsClipboardFormatAvailable
EnableMenuItem
GetMenu
CreateWindowExA
RegisterClassExA
LoadCursorA
DestroyAcceleratorTable
DestroyIcon
LoadImageA
GetUpdateRect
SetClipboardViewer
DestroyWindow
IsCharAlphaA
UnregisterClassA
MapVirtualKeyA
MapVirtualKeyExA
VkKeyScanExA
GetGUIThreadInfo
GetWindowTextA
mouse_event
GetSystemMetrics
keybd_event
SetKeyboardState
GetKeyboardState
GetCursorPos
PostMessageW
GetAsyncKeyState
AttachThreadInput
SendInput
UnregisterHotKey
RegisterHotKey
PostQuitMessage
SendMessageTimeoutA
UnhookWindowsHookEx
SetWindowsHookExA
PostThreadMessageA
IsCharAlphaNumericA
IsCharUpperA
IsCharLowerA
ToAsciiEx
GetKeyboardLayout
CallNextHookEx
DefDlgProcA
CharLowerA
DispatchMessageA
GetWindowTextLengthA

gdi32

CreateFontA
CreateSolidBrush
CreateDCA
GetStockObject
SelectObject
GetTextFaceA
GetTextMetricsA
GetObjectA
DeleteDC
CreateEllipticRgn
CreateRoundRectRgn
CreateRectRgn
CreatePolygonRgn
CreateCompatibleDC
GetDIBits
GetSystemPaletteEntries
CreateCompatibleBitmap
BitBlt
GetPixel
SetBkColor
SetTextColor
ExcludeClipRect
GetClipRgn
FillRgn
GetClipBox
GetCharABCWidthsA
SetBkMode
CreatePatternBrush
SetBrushOrgEx
EnumFontFamiliesExA
CreateDIBSection
GdiFlush
GetDeviceCaps
DeleteObject

comdlg32

GetOpenFileNameA
CommDlgExtendedError
GetSaveFileNameA

advapi32

RegSetValueExA
RegEnumKeyExA
RegCreateKeyExA
CryptReleaseContext
CryptDestroyKey
CryptDestroyHash
CryptDeriveKey
CryptHashData
CryptCreateHash
CryptAcquireContextA
RegDeleteValueA
RegQueryValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CloseServiceHandle
UnlockServiceDatabase
LockServiceDatabase
OpenSCManagerA
GetUserNameA
RegEnumValueA
RegQueryInfoKeyA
RegConnectRegistryA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA

shell32

SHGetMalloc
SHGetDesktopFolder
SHGetFolderPathA
SHGetPathFromIDListA
SHFileOperationA
SHEmptyRecycleBinA
ShellExecuteExA
Shell_NotifyIconA
DragFinish
SHBrowseForFolderA
DragQueryPoint
ExtractIconA
DragQueryFileA

ole32

CoGetObject
CLSIDFromProgID
StringFromGUID2
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoCreateInstance
OleInitialize
CLSIDFromString

oleaut32

SysAllocString
SysFreeString
SafeArrayDestroy
GetActiveObject
SysStringLen
SafeArrayCreate
VariantClear
VariantChangeType
SafeArrayCopy
VariantCopyInd
OleLoadPicture
SafeArrayUnaccessData
SafeArrayGetElemsize
SafeArrayAccessData
SafeArrayUnlock
SafeArrayPtrOfIndex
SafeArrayLock
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound

vcruntime140

_except_handler3
__RTDynamicCast
_CxxThrowException
__std_exception_destroy
__std_exception_copy
memset
_except_handler4_common
_purecall
__std_terminate
__CxxFrameHandler3
memcpy
memmove

api-ms-win-crt-convert-l1-1-0

_i64toa
_atoi64
_strtoi64
mbstowcs
strtoul
strtol
wcstombs
strtod
_itoa
_ultoa
_strtoui64
atoi
atof

api-ms-win-crt-multibyte-l1-1-0

_mbsupr
_mbsnbcpy
_mbscspn
_mbctoupper
_mbsnbicmp
_mbsicmp
_mbschr
_mbsrchr
_mbsnbcmp
_ismbcspace
_mbsstr
_ismbcdigit
_mbscmp

api-ms-win-crt-heap-l1-1-0

realloc
_set_new_mode
_msize
_callnewh
free
_expand
malloc

api-ms-win-crt-runtime-l1-1-0

_get_narrow_winmain_command_line
terminate
_initterm
_set_app_type
_initterm_e
_controlfp_s
_seh_filter_exe
exit
_cexit
_exit
_crt_atexit
_register_onexit_function
_beginthreadex
_register_thread_local_exe_atexit_callback
__p___argv
__p___argc
_c_exit
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

setvbuf
fwrite
fclose
ftell
fseek
fopen
__acrt_iob_func
fputs
__stdio_common_vfprintf
__p__commode
__stdio_common_vsprintf
fread
_set_fmode

api-ms-win-crt-utility-l1-1-0

qsort
rand
bsearch

api-ms-win-crt-string-l1-1-0

tolower
strncpy
_wcsnicmp
_isctype
_strdup
isdigit
toupper
strncmp
isxdigit

api-ms-win-crt-filesystem-l1-1-0

_splitpath

api-ms-win-crt-math-l1-1-0

_except1
__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

AHKASSIGN
AHKEXECUTELINE
AHKFINDFUNC
AHKFINDLABEL
AHKFUNCTION
AHKGETVAR
AHKISUNICODE
AHKLABEL
AHKPAUSE
AHKPOSTFUNCTION
AhkAssign
AhkExecuteLine
AhkExecuteline
AhkFindFunc
AhkFindLabel
AhkFindfunc
AhkFindlabel
AhkFunction
AhkGetVar
AhkGetvar
AhkIsUnicode
AhkIsunicode
AhkLabel
AhkPause
AhkPostFunction
AhkPostfunction
Ahkassign
AhkexecuteLine
Ahkexecuteline
AhkfindFunc
AhkfindLabel
Ahkfindfunc
Ahkfindlabel
Ahkfunction
AhkgetVar
Ahkgetvar
AhkisUnicode
Ahkisunicode
Ahklabel
Ahkpause
AhkpostFunction
Ahkpostfunction
ahkAssign
ahkExecuteLine
ahkExecuteline
ahkFindFunc
ahkFindLabel
ahkFindfunc
ahkFindlabel
ahkFunction
ahkGetVar
ahkGetvar
ahkIsUnicode
ahkIsunicode
ahkLabel
ahkPause
ahkPostFunction
ahkPostfunction
ahkassign
ahkexecuteLine
ahkexecuteline
ahkfindFunc
ahkfindLabel
ahkfindfunc
ahkfindlabel
ahkfunction
ahkgetVar
ahkgetvar
ahkisUnicode
ahkisunicode
ahklabel
ahkpause
ahkpostFunction
ahkpostfunction

Sections

.text
Size: 651KB - Virtual size: 650KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3ccb9afe7c791b6102e9f1f4edec2147

Headers

File Characteristics

Imports

wsock32

winmm

version

comctl32

shlwapi

crypt32

psapi

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

vcruntime140

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 651KB - Virtual size: 650KB

.rdata Size: 70KB - Virtual size: 70KB

.data Size: 9KB - Virtual size: 153KB

.rsrc Size: 1.9MB - Virtual size: 1.9MB

.text
Size: 651KB - Virtual size: 650KB

.rdata
Size: 70KB - Virtual size: 70KB

.data
Size: 9KB - Virtual size: 153KB

.rsrc
Size: 1.9MB - Virtual size: 1.9MB