2edb59b58222069f20e102959e1eda0d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2edb59b58222069f20e102959e1eda0d_JaffaCakes118
Size

138KB
MD5

2edb59b58222069f20e102959e1eda0d
SHA1

77fc18a8de5586f8822069011d3cd807ad714125
SHA256

ce960c4ceda4c377cfa1e9c53548c5b2680e4a81e6c9edd8c1983af0ae464b53
SHA512

cf8ad00c2a00cdc65aa6a0cede53b2dddcb454ad372f3a26cbffddf0525b7a49c3782a8587114300f5c6685c3c430d54f503481cdec5984407b0b729cf85aa1a
SSDEEP

3072:R9A7/MDMCCx8da23UFzp7zvvNyj2D3jBDk5oVht47NWHYQKKxdDIrFePs:R9A7ckUUT7zvvNFDTKWTJ0rFws

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2edb59b58222069f20e102959e1eda0d_JaffaCakes118

Files

2edb59b58222069f20e102959e1eda0d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f2a78c5719bef82dde0ef4761cd4c396

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadProcessMemory
HeapDestroy
HeapCreate
Thread32Next
ReadFile
GetTimeZoneInformation
MultiByteToWideChar
GetTempPathW
GetFileSizeEx
OpenMutexW
VirtualProtectEx
VirtualAllocEx
FindClose
RemoveDirectoryW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
LocalFree
GetSystemTime
GetUserDefaultUILanguage
CreateThread
WideCharToMultiByte
GetLocalTime
GetNativeSystemInfo
GetVersionExW
TlsGetValue
TlsSetValue
TerminateProcess
GetCurrentThreadId
GetCommandLineW
SetErrorMode
GetComputerNameW
OpenEventW
DuplicateHandle
GetCurrentProcessId
GlobalLock
GlobalUnlock
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
CreateRemoteThread
Process32FirstW
Process32NextW
GetModuleFileNameW
GetTickCount
Thread32First
OpenProcess
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualFree
HeapFree
SetFilePointerEx
MoveFileExW
WaitForMultipleObjects
SystemTimeToFileTime
HeapAlloc
CreateProcessW
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
GetPrivateProfileIntW
FlushFileBuffers
WriteFile
GetPrivateProfileStringW
ExpandEnvironmentStringsW
GetModuleHandleW
SetThreadPriority
GetCurrentThread
GetFileAttributesExW
GetProcessId
VirtualAlloc
VirtualFreeEx
SetThreadContext
GetThreadContext
SetFileAttributesW
WTSGetActiveConsoleSessionId
lstrcmpiA
CreateFileW
GetFileAttributesW
Sleep
LoadLibraryW
CreateDirectoryW
ExitProcess
CloseHandle
CreateEventW
ResetEvent
EnterCriticalSection
SetLastError
GetLastError
LeaveCriticalSection
InitializeCriticalSection
SetEvent
lstrcmpiW
LoadLibraryA
GetProcAddress
FreeLibrary
ReleaseMutex
WriteProcessMemory
WaitForSingleObject

user32

RegisterClassA
ExitWindowsEx
CharLowerW
GetMessageA
GetWindowRect
SetCapture
GetParent
GetClassLongW
GetCapture
SetCursorPos
GetAncestor
PeekMessageA
SetWindowPos
IsWindow
ReleaseCapture
MapWindowPoints
GetMessagePos
DefFrameProcW
EndPaint
GetUpdateRgn
GetMessageW
GetWindowDC
FillRect
GetWindowInfo
DrawEdge
EndMenu
GetUpdateRect
IntersectRect
GetDCEx
PostThreadMessageW
EqualRect
CreateDesktopW
SetProcessWindowStation
GetUserObjectInformationW
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
CloseDesktop
SetThreadDesktop
OpenWindowStationW
RegisterWindowMessageW
GetThreadDesktop
GetMenuItemID
SetKeyboardState
GetSubMenu
OpenDesktopW
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
GetMenuItemCount
GetShellWindow
GetKeyboardState
CallWindowProcA
ToUnicode
HiliteMenuItem
GetWindowThreadProcessId
RegisterClassExA
CallWindowProcW
DefFrameProcA
OpenInputDesktop
GetSystemMetrics
GetCursorPos
RegisterClassExW
GetClipboardData
DefWindowProcA
DefMDIChildProcW
PrintWindow
SendMessageW
DefWindowProcW
IsRectEmpty
MapVirtualKeyW
PostMessageW
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
GetDC
TranslateMessage
GetWindowLongW
CharLowerA
PeekMessageW
ReleaseDC
SwitchDesktop
DefDlgProcA
DefMDIChildProcA
RegisterClassW
BeginPaint
GetIconInfo
DrawIcon
CharToOemW
CharLowerBuffA
DispatchMessageW
GetWindow
SendMessageTimeoutW
SetWindowLongW
CharUpperW
DefDlgProcW

advapi32

EqualSid
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
ConvertSidToStringSidW
IsWellKnownSid
GetLengthSid
RegEnumKeyExW
InitiateSystemShutdownExW

shlwapi

UrlUnescapeA
StrCmpNIW
PathIsURLW
StrStrIW
StrStrIA
PathQuoteSpacesW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveBackslashW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
PathRenameExtensionW
PathRemoveFileSpecW

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

CreateCompatibleDC
SetRectRgn
SaveDC
DeleteDC
SetViewportOrgEx
RestoreDC
CreateDIBSection
GetDeviceCaps
GetDIBits
CreateCompatibleBitmap
GdiFlush
SelectObject
DeleteObject

ws2_32

listen
send
closesocket
WSASetLastError
freeaddrinfo
socket
bind
recv
WSASend
getpeername
recvfrom
sendto
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
shutdown
WSAEventSelect
getsockname
accept
WSAGetLastError
setsockopt

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData

wininet

InternetQueryOptionA
InternetOpenA
HttpOpenRequestA
InternetSetOptionA
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
InternetCloseHandle
HttpSendRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFile
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpQueryInfoA
HttpSendRequestExA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f2a78c5719bef82dde0ef4761cd4c396

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 130KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 130KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB