2dc3037fbcb81bc2571ed7bd35cf7874_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

2dc3037fbcb81bc2571ed7bd35cf7874_JaffaCakes118
Size

336KB
MD5

2dc3037fbcb81bc2571ed7bd35cf7874
SHA1

dc984272d0d2753f548473fa063895c7299b9a82
SHA256

d92561bfefc3a93542837c79dd7842fff07396a98a16d9851dd2cc5fb62c79ba
SHA512

95658aa7a212f8004ebb0ff035795a5f67015e08d9bec235ec2635a0fa18a7712ba568d9fd0f6edf844c3cdf345a2150d8cb24c9d65139c741f8f0f09cba53af
SSDEEP

6144:+TPkJpsT0UCN9P5PTnUQutOUuwWbbrBtTjnk6zgGNjS1v/MYP/j9pU:gPkET0hFHgkTT/NjS1h9pU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2dc3037fbcb81bc2571ed7bd35cf7874_JaffaCakes118

Files

2dc3037fbcb81bc2571ed7bd35cf7874_JaffaCakes118
.exe windows:4 windows x86 arch:x86

78c428cc5d26182bf19c99afe33ed7de

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOverlappedResult
GetProcAddress
GetShortPathNameW
GetSystemDefaultLangID
GetSystemDirectoryA
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathW
GetTickCount
GetTimeFormatW
GetUserDefaultLangID
GetVersion
GetVersionExA
GetVersionExW
GetVolumeInformationW
GetVolumePathNameW
GlobalMemoryStatus
InitializeCriticalSection
InterlockedCompareExchange
InterlockedExchange
IsBadReadPtr
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LocalFree
MapViewOfFile
MoveFileExW
MoveFileW
MultiByteToWideChar
GetLogicalDriveStringsW
OpenProcess
OpenSemaphoreW
OutputDebugStringA
OutputDebugStringW
QueryDosDeviceW
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
RemoveDirectoryW
ResetEvent
SetEndOfFile
SetEvent
SetFileAttributesW
SetFilePointer
SetFileTime
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TerminateThread
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualQuery
WaitForMultipleObjectsEx
WaitForSingleObject
WaitNamedPipeW
WideCharToMultiByte
WriteFile
lstrcmpiA
lstrlenA
GetLocalTime
GetLastError
GetHandleInformation
GetFullPathNameW
GetFileTime
GetFileInformationByHandle
GetFileAttributesW
GetFileAttributesExW
GetFileAttributesA
GetExitCodeProcess
GetEnvironmentStringsW
GetDriveTypeW
GetDriveTypeA
GetDiskFreeSpaceW
GetDiskFreeSpaceExW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetComputerNameExW
GetACP
FreeLibrary
FreeEnvironmentStringsW
FormatMessageW
FormatMessageA
FlushFileBuffers
FindNextFileW
FindNextChangeNotification
FindFirstFileW
FindFirstChangeNotificationW
FindCloseChangeNotification
FindClose
ExitThread
EnterCriticalSection
DuplicateHandle
DeviceIoControl
DeleteFileW
DeleteCriticalSection
CreateThread
CreateProcessW
CreatePipe
CreateFileW
CreateFileMappingA
CreateFileA
CreateEventA
CreateDirectoryW
CloseHandle
OpenEventW
CancelIo

user32

UnhookWindowsHookEx
SetWindowsHookExA
RegisterWindowMessageW
PostThreadMessageA
PeekMessageA
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MessageBoxW
GetSystemMetrics
DispatchMessageA
CallNextHookEx

advapi32

RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
OpenThreadToken
OpenProcessToken
MapGenericMask
LookupPrivilegeValueA
LookupAccountNameW
LogonUserW
InitializeSecurityDescriptor
InitializeAcl
ImpersonateSelf
ImpersonateLoggedOnUser
GetUserNameW
GetTokenInformation
GetSecurityDescriptorControl
GetNamedSecurityInfoW
GetLengthSid
GetFileSecurityW
GetExplicitEntriesFromAclW
FreeSid
EqualSid
DuplicateTokenEx
DuplicateToken
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
CryptAcquireContextA
CheckTokenMembership
AllocateAndInitializeSid
AdjustTokenPrivileges
AddAccessAllowedAce
AccessCheck
RegQueryValueExA
RegQueryValueExW
RegSetKeySecurity
RegSetValueExA
RegSetValueExW
RevertToSelf
SetEntriesInAclW
SetSecurityDescriptorControl
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
RegOpenKeyExA

ole32

CoCreateInstance
CoUninitialize
CoSetProxyBlanket
CoInitialize
CoInitializeEx
CoQueryProxyBlanket
CoInitializeSecurity
CoTaskMemFree

ws2_32

inet_ntoa
socket
WSACleanup
WSACreateEvent
WSADuplicateSocketA
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSASetLastError
WSASocketA
WSAStartup
accept
bind
closesocket
connect
gethostbyaddr
setsockopt
gethostname
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
gethostbyname
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
send

winmm

waveOutGetDevCapsW
waveOutGetNumDevs

crypt32

CertGetCertificateChain
CertGetNameStringW
CertFreeCertificateContext
CertFreeCertificateChain
CertCreateCertificateContext

winspool.drv

SetPrinterW
OpenPrinterW
GetPrinterW
EnumPrintersW
ClosePrinter

Exports

Exports

SqmAddToAverage
SqmAddToStream
SqmAddToStreamDWord
SqmAddToStreamString
SqmAddToStreamV
SqmCleanup
SqmClearFlags
SqmCreateNewId
SqmEndSession
SqmFlushSession
SqmGetEnabled
SqmGetFlags
SqmGetMachineId
SqmGetSession
SqmGetSessionStartTime
SqmGetUserId
SqmIncrement
SqmIsWindowsOptedIn
SqmReadSharedMachineId
SqmReadSharedUserId
SqmSet
SqmSetAppId
SqmSetAppVersion
SqmSetBits
SqmSetBool
SqmSetCurrentTimeAsUploadTime
SqmSetEnabled
SqmSetFlags
SqmSetIfMax
SqmSetIfMin
SqmSetMachineId
SqmSetString
SqmSetUserId
SqmStartSession
SqmStartUpload
SqmSysprepGeneralize
SqmSysprepSpecialize
SqmTimerAccumulate
SqmTimerAddToAverage
SqmTimerRecord
SqmTimerStart
SqmUnattendedSetup
SqmWaitForUploadComplete
SqmWriteSharedMachineId
SqmWriteSharedUserId

Sections

.text
Size: 232KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

78c428cc5d26182bf19c99afe33ed7de

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

ws2_32

winmm

crypt32

winspool.drv

Exports

Exports

Sections

.text Size: 232KB - Virtual size: 232KB

.rdata Size: 48KB - Virtual size: 48KB

.data Size: 20KB - Virtual size: 1.7MB

.idata Size: 8KB - Virtual size: 8KB

.rsrc Size: 24KB - Virtual size: 24KB

.text
Size: 232KB - Virtual size: 232KB

.rdata
Size: 48KB - Virtual size: 48KB

.data
Size: 20KB - Virtual size: 1.7MB

.idata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 24KB - Virtual size: 24KB