332efcef63b2eea14d75a1c5089826e5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

332efcef63b2eea14d75a1c5089826e5_JaffaCakes118
Size

274KB
MD5

332efcef63b2eea14d75a1c5089826e5
SHA1

a18a93e9667ed9241a206c1a1e899c4126e3b9c7
SHA256

fc1074ee8f385aba8670d738823e050bb1a777ed2ff20f6037eee7041b96a756
SHA512

96086d8f007ca1097412a633651082cc66c49d0d2326fc2efba080c6c7c211a267329f19e914ff09669e66de1b4f22cf09bca568dc863276b3f50d463bc8c923
SSDEEP

6144:FPOup83CxKcfmrnfc6cU2btV0h7FusG/oIm2g:dOupICxboIm2g

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
332efcef63b2eea14d75a1c5089826e5_JaffaCakes118

Files

332efcef63b2eea14d75a1c5089826e5_JaffaCakes118
.exe windows:5 windows x86 arch:x86

8d1b0417fa095d60f301dfa6b154dd3e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

vsta.pdb

Imports

kernel32

SetFileAttributesW
CreateFileW
GetFileSize
GetFileAttributesW
MapViewOfFile
UnmapViewOfFile
CloseHandle
ExpandEnvironmentStringsW
LeaveCriticalSection
CreateFileMappingA
DeleteCriticalSection
CreateProcessW
LocalFree
FormatMessageW
LoadLibraryExW
WriteFile
GetStdHandle
GetEnvironmentVariableA
LoadLibraryW
CreateDirectoryW
MoveFileW
GetThreadLocale
GetLocaleInfoA
GetACP
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedIncrement
lstrcpynW
VirtualAlloc
VirtualFree
OutputDebugStringW
FindResourceExA
GlobalLock
GlobalUnlock
GlobalAlloc
GlobalFree
CreateFileMappingW
GetFileAttributesA
GetUserDefaultUILanguage
ReleaseMutex
SetEvent
WaitForSingleObject
CreateProcessA
LoadLibraryA
OpenProcess
HeapSize
HeapReAlloc
HeapDestroy
FindFirstFileW
FindNextFileW
FindClose
GetUserDefaultLCID
GetSystemDefaultLCID
InterlockedDecrement
EnterCriticalSection
DuplicateHandle
CreateMutexA
CreateEventA
GetSystemTime
AddAtomW
DeleteAtom
FindAtomW
GetModuleHandleW
CopyFileW
GetFileAttributesExW
InitializeCriticalSection
LoadLibraryExA
lstrcmpiA
IsDBCSLeadByte
FreeLibrary
GetProcAddress
GetModuleHandleA
GetVersionExA
RaiseException
WideCharToMultiByte
lstrlenW
MultiByteToWideChar
FindResourceA
LoadResource
LockResource
SizeofResource
HeapFree
GetProcessHeap
HeapAlloc
SetCurrentDirectoryW
GetCurrentDirectoryW
lstrlenA
GetModuleFileNameW
SetUnhandledExceptionFilter
InterlockedExchange
GetModuleFileNameA
SystemTimeToFileTime
GetLastError

gdi32

DeleteObject

msvcr80

memcpy
_wmakepath_s
_set_purecall_handler
_wtoi
wcspbrk
_wfullpath
memmove
wcschr
wcscat_s
_vsnwprintf_s
memset
memmove_s
calloc
_strlwr_s
_ultow_s
isprint
strrchr
_vswprintf_c_l
swprintf_s
_wtol
_mbscmp
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
wcstok_s
wcscspn
_swab
_wsplitpath_s
wcsncat_s
wcscpy_s
??_V@YAXPAX@Z
_resetstkoflw
_recalloc
strncpy_s
sprintf_s
wcsstr
free
memcpy_s
fprintf
_wcsnicmp
_snwprintf_s
wcsncpy_s
_wcsicmp
fclose
fgets
fopen_s
strcpy_s
_stricmp
??3@YAXPAX@Z
_callnewh
malloc
_vsnprintf_s

user32

GetSystemMetrics
LoadStringW
LoadBitmapA
CharNextA
UnregisterClassA
CharNextW
MessageBoxW
SetForegroundWindow
LoadIconA
LoadImageA

advapi32

RegDeleteKeyW
CryptHashData
CryptCreateHash
CryptImportKey
CryptAcquireContextA
CryptReleaseContext
CryptDestroyKey
RegDeleteValueW
CryptDestroyHash
RegQueryValueExA
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
RegFlushKey
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueA
RegOpenKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
CryptVerifySignatureA

shell32

SHFileOperationW
SHGetFolderPathW
SHCreateDirectoryExW

ole32

CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
StringFromGUID2
OleInitialize
CoTaskMemFree
CoReleaseMarshalData
CreateStreamOnHGlobal
CoMarshalInterface
CoDisconnectObject
StringFromCLSID
CoInitializeSecurity
IIDFromString
OleUninitialize

oleaut32

VarBstrCat
GetErrorInfo
VariantInit
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
VarUI4FromStr
SysStringByteLen
SysAllocStringByteLen
VariantClear
GetActiveObject

shlwapi

SHDeleteKeyW
SHCopyKeyW
PathFileExistsW
PathAddBackslashW
PathIsDirectoryW
PathRemoveFileSpecW
PathRemoveBlanksW
PathUnquoteSpacesW
PathIsRelativeW

mscoree

LockClrVersion
CorBindToRuntimeEx

custsat

ord4
ord5

Sections

.text
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.adata
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8d1b0417fa095d60f301dfa6b154dd3e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

gdi32

msvcr80

user32

advapi32

shell32

ole32

oleaut32

shlwapi

mscoree

custsat

Sections

.text Size: 93KB - Virtual size: 93KB

.data Size: 2KB - Virtual size: 11KB

.rsrc Size: 111KB - Virtual size: 110KB

.adata Size: 60KB - Virtual size: 60KB

.text
Size: 93KB - Virtual size: 93KB

.data
Size: 2KB - Virtual size: 11KB

.rsrc
Size: 111KB - Virtual size: 110KB

.adata
Size: 60KB - Virtual size: 60KB