2f23ca3bbe56c4b14c260bf8e33918ec_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2f23ca3bbe56c4b14c260bf8e33918ec_JaffaCakes118
Size

246KB
MD5

2f23ca3bbe56c4b14c260bf8e33918ec
SHA1

74d5cb379338170c913877a29fb03ec3a66f74c3
SHA256

675fe38d2cd759b1e764dfb250121437146f58efb5b5291dfb02ba05bcdd376e
SHA512

4059aed914461e19649af02dfbd10a4d8e11aec363db06eee8c9e8a1b5c74436c8fd119834d0f96069387b138184f5a07b1b08d927362366ba8fe321acc5a251
SSDEEP

6144:RjFxGdWa3IGZZIVlUkyTtNn94EupOaJs3verTp/v2LSsQLH5AdA:9FsdWa4oZclUkyTtXakSsPdA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f23ca3bbe56c4b14c260bf8e33918ec_JaffaCakes118

Files

2f23ca3bbe56c4b14c260bf8e33918ec_JaffaCakes118
.exe windows:5 windows x86 arch:x86

1c977b542f2e1f4879c44ecccae5c2b6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc90u

ord794
ord4071
ord4043
ord1137
ord799
ord813
ord4081
ord4080
ord2764
ord2893
ord2774
ord3115
ord2966
ord4728
ord3112
ord2983
ord2771
ord6018
ord5663
ord5680
ord1272
ord589
ord4347
ord2447
ord5676
ord5674
ord3217
ord2087
ord4213
ord5830
ord6741
ord5548
ord1048
ord4179
ord6035
ord2206
ord2251
ord4747
ord6803
ord1603
ord2326
ord5572
ord5573
ord3589
ord341
ord3670
ord4681
ord4905
ord4348
ord4996
ord2891
ord286
ord617
ord600
ord1250
ord4173
ord6801
ord4423
ord4448
ord1183
ord5567
ord909
ord1248
ord265
ord266
ord4967
ord801

msvcr90

localeconv
wcspbrk
memset
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
wcsspn
_wtof
ceil
_time64
_localtime64_s
isleadbyte
_beginthreadex
_wsopen_s
isalpha
_errno
_wmkdir
wcscpy_s
_purecall
realloc
malloc
_vsnwprintf_s
floor
_wcsicmp
wcsrchr
wcschr
wcsncpy_s
_recalloc
calloc
free
_wtoi
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
memmove_s
memcpy_s
wcslen
__CxxFrameHandler3
toupper
islower
_wstat64
_wtoi64
_snwprintf_s
_close

kernel32

GlobalLock
GlobalUnlock
GlobalAlloc
GetSystemTimeAsFileTime
FormatMessageW
GetLogicalDrives
GetDriveTypeW
GetVolumeInformationW
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
RaiseException
LoadLibraryA
InterlockedExchange
LocalAlloc
lstrcmpW
lstrcpynW
GetCurrentProcess
GetACP
GetProcessHeap
HeapFree
OutputDebugStringW
GetDiskFreeSpaceW
DeviceIoControl
CreateFileA
GetVersion
GetDiskFreeSpaceExW
FindNextFileW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
GetFileSize
SetEndOfFile
SetFileTime
SetFilePointer
WriteFile
ReadFile
CreateFileW
LocalFileTimeToFileTime
SystemTimeToFileTime
GetExitCodeThread
GetCurrentThreadId
SetEvent
PulseEvent
ResetEvent
CreateEventW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
GetFileAttributesW
FindClose
FindFirstFileW
SetErrorMode
FreeLibrary
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetTempPathW
InterlockedDecrement
GetVersionExW
InterlockedIncrement
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
CreateMutexW
GetLastError
ReleaseMutex
CloseHandle
Sleep
GetModuleFileNameW

user32

RegisterClassExW
RegisterWindowMessageW
GetMessageW
UnregisterDeviceNotification
RegisterDeviceNotificationW
LoadCursorW
PostMessageW
CreateWindowExW
SetWindowLongW
ShowWindow
SendMessageW
GetWindowLongW
DefWindowProcW
MessageBoxW
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
EmptyClipboard
SetClipboardData
TranslateMessage
DispatchMessageW
DestroyWindow
PostQuitMessage
UnregisterClassW

advapi32

RegOpenCurrentUser
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW

shell32

ord2
ord4
SHGetPathFromIDListW
SHGetFolderPathW
SHGetMalloc
SHGetFolderLocation

shlwapi

PathIsDirectoryW

ole32

CoInitializeEx
CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

SysFreeString
SysStringLen
VariantInit
VariantClear
SysStringByteLen
SysAllocString

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Sections

.text
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1c977b542f2e1f4879c44ecccae5c2b6

Headers

DLL Characteristics

File Characteristics

Imports

mfc90u

msvcr90

kernel32

user32

advapi32

shell32

shlwapi

ole32

oleaut32

msvcp90

version

Sections

.text Size: 136KB - Virtual size: 136KB

.rdata Size: 42KB - Virtual size: 42KB

.data Size: 3KB - Virtual size: 4KB

.rsrc Size: 62KB - Virtual size: 62KB

.text
Size: 136KB - Virtual size: 136KB

.rdata
Size: 42KB - Virtual size: 42KB

.data
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 62KB - Virtual size: 62KB