2dfe08a7afd38efface1c96b09e70ed7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2dfe08a7afd38efface1c96b09e70ed7_JaffaCakes118
Size

10.9MB
MD5

2dfe08a7afd38efface1c96b09e70ed7
SHA1

aa3f64b472493a849c074c02c8b332ad473e5c7c
SHA256

2ad4bafc1b9cebc5c7ca9e665ffa446d5b82f7f6374b526ccf0dc7ab05d1efb5
SHA512

079c3c52abfb5ca003414a8057e3531d2b58f6fe8faf2b175fffe3853db91435288b4a77a8331cc3c1bac77a52fce0ac25e515d360c55463d2cbb5aa9e0e784c
SSDEEP

196608:9uHfLeNVyJwRI3hWE8rZ98ZkW36w33Rx0F0zTiU:9KL8VI3hWE8rZ9QKwHRxvT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2dfe08a7afd38efface1c96b09e70ed7_JaffaCakes118

Files

2dfe08a7afd38efface1c96b09e70ed7_JaffaCakes118
.exe windows:6 windows x64 arch:x64

3daa0a56c71b870d67ad6abff078c8d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\development\irrTech\flace\win32player\x64\Release\win32player.pdb

Imports

kernel32

GetCommandLineW
LoadLibraryA
GetProcAddress
GetModuleFileNameA
GetModuleHandleA
GetModuleFileNameW
WaitForSingleObject
OutputDebugStringA
WriteConsoleW
HeapSize
SetEndOfFile
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
SetStdHandle
FlushFileBuffers
GetTimeZoneInformation
GetConsoleCP
GetFileAttributesExW
CreateProcessA
GetExitCodeProcess
HeapReAlloc
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
CreateDirectoryW
GetStringTypeW
HeapAlloc
HeapFree
ReadConsoleW
GetConsoleMode
GetACP
GetStdHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
PeekNamedPipe
GetFileType
GetFileInformationByHandle
CreateFileW
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindNextFileW
FindFirstFileExW
FindClose
GetModuleHandleExW
ExitProcess
WideCharToMultiByte
GetCurrentDirectoryW
GetCurrentDirectoryA
SetCurrentDirectoryA
SetEnvironmentVariableA
GetFullPathNameA
GetDriveTypeW
ReadFile
EncodePointer
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RaiseException
RtlPcToFileHeader
RtlUnwindEx
ResumeThread
SetThreadPriority
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ExpandEnvironmentStringsA
FormatMessageA
MulDiv
Sleep
GetVersionExA
lstrcmpiA
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThread
GetSystemInfo
GetTickCount
SetThreadAffinityMask
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalMemoryStatus
WinExec
MultiByteToWideChar
GetFullPathNameW
SetErrorMode
VirtualAlloc
VirtualFree
GetSystemTimeAsFileTime
GetSystemTimeAdjustment
GetLastError
SleepEx
SetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateFileA
WriteFile
GetTempPathA
CloseHandle
GlobalFree
LocalAlloc

user32

LoadIconA
MessageBoxA
SendMessageA
RegisterClassA
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
EnumDisplaySettingsA
ChangeDisplaySettingsA
LoadImageA
DispatchMessageA
PeekMessageA
SendMessageTimeoutA
SendMessageTimeoutW
DefWindowProcA
PostQuitMessage
RegisterClassExA
CreateWindowExA
DestroyWindow
ShowWindow
MoveWindow
SetWindowPos
GetWindowPlacement
GetActiveWindow
GetFocus
TranslateMessage
ToAscii
MapVirtualKeyA
GetCapture
SetCapture
ReleaseCapture
GetSystemMetrics
UpdateWindow
SetActiveWindow
SetForegroundWindow
GetDC
ReleaseDC
BeginPaint
EndPaint
GetClientRect
GetWindowRect
AdjustWindowRect
SetCursorPos
SetCursor
GetCursorPos
ClientToScreen
FillRect
SetWindowLongPtrA
LoadCursorA
GetKeyboardState

advapi32

RegQueryValueExA
RegOpenKeyA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegSetValueExA

shell32

CommandLineToArgvW
ShellExecuteExW

shlwapi

PathRelativePathToA

opengl32

glDisableClientState
glDrawArrays
glDrawElements
glEnable
glEnableClientState
glEnd
glFlush
glFogf
glFogfv
glFogi
glFrontFace
glGetBooleanv
glGetError
glGetFloatv
glGetString
glHint
glLightModelfv
glLightModeli
wglCreateContext
wglDeleteContext
wglGetProcAddress
wglMakeCurrent
glAlphaFunc
glBegin
glBindTexture
glBlendFunc
glClear
glClearColor
glClearDepth
glClipPlane
glColor4ub
glColorMask
glColorPointer
glCullFace
glDepthFunc
glDepthMask
glLightf
glTexSubImage2D
glTexImage2D
glGetTexImage
glGenTextures
glDeleteTextures
glCopyTexSubImage2D
glGetIntegerv
glViewport
glVertexPointer
glVertex3f
glVertex2i
glVertex2f
glTranslatef
glTexParameteri
glTexParameterf
glTexGeni
glTexEnvi
glTexEnvf
glTexCoordPointer
glTexCoord2f
glStencilOp
glStencilMask
glStencilFunc
glShadeModel
glScissor
glRectf
glReadPixels
glReadBuffer
glPushMatrix
glPushAttrib
glPopMatrix
glPopAttrib
glPolygonOffset
glPolygonMode
glPointSize
glPixelStorei
glNormalPointer
glMatrixMode
glMaterialfv
glMaterialf
glLoadMatrixf
glLoadIdentity
glLineWidth
glLightfv
glDisable

wsock32

WSAGetLastError
recv
send
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
WSACleanup
socket
__WSAFDIsSet
select
WSASetLastError
recvfrom
sendto
accept
listen
inet_ntoa
gethostname
closesocket
setsockopt
WSAStartup

ws2_32

freeaddrinfo
getaddrinfo

winmm

waveOutPrepareHeader
waveOutWrite
waveOutOpen
timeEndPeriod
timeBeginPeriod
waveOutClose
waveOutUnprepareHeader
waveOutReset

gdi32

GetPixelFormat
DescribePixelFormat
ChoosePixelFormat
TextOutW
GetObjectA
SetTextColor
SetWindowExtEx
SetViewportExtEx
StretchDIBits
SetMapMode
SetPixelFormat
SelectObject
SetPixel
SetBkMode
GetStockObject
Rectangle
GetTextExtentPoint32W
GetDIBits
GetDeviceCaps
DeleteObject
DeleteDC
CreatePen
CreateFontA
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
SwapBuffers

ole32

CoCreateInstance
CoInitialize
CoUninitialize

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 173KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3daa0a56c71b870d67ad6abff078c8d1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

shlwapi

opengl32

wsock32

ws2_32

winmm

gdi32

ole32

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.rdata Size: 1.0MB - Virtual size: 1.0MB

.data Size: 173KB - Virtual size: 183KB

.pdata Size: 153KB - Virtual size: 153KB

.rsrc Size: 47KB - Virtual size: 47KB

.reloc Size: 43KB - Virtual size: 42KB

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: 173KB - Virtual size: 183KB

.pdata
Size: 153KB - Virtual size: 153KB

.rsrc
Size: 47KB - Virtual size: 47KB

.reloc
Size: 43KB - Virtual size: 42KB