33dc8e7bb779c5f7adef83b8e5b7f109_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

33dc8e7bb779c5f7adef83b8e5b7f109_JaffaCakes118
Size

144KB
MD5

33dc8e7bb779c5f7adef83b8e5b7f109
SHA1

60d1dc9c4937f941d96273d7270f7c519a2c1e0b
SHA256

29efc9a7514ea8d3a5a02eb9759306bbeb0f5e286bba2a42b3a75b72c3bf465d
SHA512

8f6e8abad3bee2d7767f3b51a76312b4544f5718306df602bb80e98c0b6e8b882dabf924be526fb5c31e6ad91a58ec232ac60f31ef789e1631bf07c647ca4c7c
SSDEEP

3072:Hndfjed3VlqzpqDbceT7ww64QwbGgFnnC/BdjZSjn1:9fjed3VQFqDbtww6QXFnns/Sjn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
33dc8e7bb779c5f7adef83b8e5b7f109_JaffaCakes118

Files

33dc8e7bb779c5f7adef83b8e5b7f109_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b5ccd112c9e6a99c80c1fff1e66c7f94

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
SetFileAttributesA
MultiByteToWideChar
GetCurrentDirectoryA
TerminateProcess
ReadFile
LocalAlloc
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateFileMappingA
GetFileSize
Module32Next
Module32First
GetCurrentThreadId
lstrlenA
SetLastError
FindFirstFileA
GetPrivateProfileIntA
lstrlenW
lstrcatA
lstrcpyA
GlobalFree
GlobalAlloc
GetPrivateProfileStringA
SetEndOfFile
LockResource
LoadResource
SizeofResource
RemoveDirectoryA
LoadLibraryExA
MoveFileExA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FindClose
FindNextFileA
GetLastError
LocalFree
GetDriveTypeA
GetLogicalDrives
GetDiskFreeSpaceExA
GlobalMemoryStatusEx
lstrcmpiA
GetSystemDirectoryA
GetUserDefaultLangID
VirtualProtectEx
WriteProcessMemory
DeleteCriticalSection
GetModuleHandleA
GetModuleFileNameA
GetCurrentProcess
MapViewOfFile
GetCurrentProcessId
DuplicateHandle
DeviceIoControl
UnmapViewOfFile
GetSystemInfo
ReadProcessMemory
VirtualQueryEx
FindResourceA
WaitForMultipleObjects
QueryPerformanceCounter
OpenProcess
QueryPerformanceFrequency
LoadLibraryA
GetProcAddress
FreeLibrary
GetProcessHeap
HeapAlloc
WideCharToMultiByte
HeapFree
CreateEventA
GetLocalTime
CreateFileA
SetFilePointer
WriteFile
GetVersionExA
CreateSemaphoreA
CreateThread
CloseHandle
SetEvent
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
Sleep
ReleaseSemaphore
GetTickCount
SetConsoleTitleA
SetConsoleCtrlHandler
InitializeCriticalSection
FormatMessageA

user32

DispatchMessageA
TranslateMessage
GetMessageA
DefWindowProcA
EnumDisplaySettingsA
RegisterClassA
LoadCursorA
LoadIconA
ExitWindowsEx
CreateWindowExA
EnumChildWindows
GetForegroundWindow
SendMessageA
SetUserObjectSecurity
GetUserObjectSecurity
CloseDesktop
SetThreadDesktop
CloseWindowStation
SetProcessWindowStation
GetThreadDesktop
GetProcessWindowStation
wsprintfA
OemToCharBuffW
PostMessageA

gdi32

GetStockObject

advapi32

AllocateLocallyUniqueId
QueryServiceStatus
StartServiceA
ControlService
OpenEventLogA
ClearEventLogA
CloseEventLog
RegEnumValueA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
RegEnumKeyA
RegSetValueExA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
LookupPrivilegeValueA
AdjustTokenPrivileges
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
AllocateAndInitializeSid
EqualSid
LookupAccountSidA
OpenProcessToken
GetTokenInformation
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegDeleteKeyA
CreateServiceA
RegCreateKeyExA
ChangeServiceConfigA
DeleteService
EnumServicesStatusA
LookupAccountNameA
SetSecurityDescriptorDacl
MakeAbsoluteSD
GetSecurityDescriptorDacl
SetTokenInformation
ImpersonateLoggedOnUser
DuplicateTokenEx
IsValidSid
CreateProcessAsUserA
LsaFreeMemory
GetUserNameA
LsaClose
LsaRetrievePrivateData
LsaOpenPolicy
LogonUserA
LookupPrivilegeDisplayNameA
LookupPrivilegeNameA
IsValidSecurityDescriptor

shell32

SHGetSpecialFolderPathA
SHGetSpecialFolderLocation
SHGetPathFromIDListA

odbc32

ord31
ord41
ord39
ord75
ord24
ord9

ws2_32

ntohl
gethostname
gethostbyname
closesocket
WSACleanup
inet_addr
ntohs
recv
WSAIoctl
select
WSAGetLastError
connect
ioctlsocket
WSASend
send
WSAAsyncSelect
listen
WSASocketA
shutdown
WSAAccept
bind
htons
socket
sendto
htonl
setsockopt
WSAStartup
WSARecv
__WSAFDIsSet
inet_ntoa

wininet

FtpCommandA
FtpOpenFileA
InternetConnectA
InternetOpenA
InternetWriteFile
InternetGetLastResponseInfoA
FtpFindFirstFileA
InternetFindNextFileA
FtpGetCurrentDirectoryA
InternetReadFile
FtpSetCurrentDirectoryA
InternetCrackUrlA
InternetCloseHandle

wtsapi32

WTSQuerySessionInformationA
WTSEnumerateSessionsA
WTSFreeMemory

netapi32

NetUserAdd
NetLocalGroupAddMembers
NetUserGetLocalGroups
NetUserDel
NetShareEnum
NetWkstaGetInfo
NetServerGetInfo
NetUserEnum
NetUserGetInfo
NetApiBufferFree
NetUserSetInfo

iphlpapi

SetTcpEntry

imagehlp

MapAndLoad
UnMapAndLoad
ImageRvaToVa

rasapi32

RasEnumDevicesA
RasGetEntryDialParamsA
RasDialA
RasSetCredentialsA
RasHangUpA
RasDeleteEntryA
RasSetEntryPropertiesA
RasGetEntryPropertiesA
RasEnumEntriesA
RasGetConnectStatusA
RasEnumConnectionsA
RasGetProjectionInfoA
RasGetErrorStringA

shlwapi

SHDeleteKeyA

msvcrt

_stricmp
_getch
_strupr
_strcmpi
_strnicmp
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
_exit
fflush
toupper
sscanf
_iob
fprintf
ctime
_ultoa
_ftol
strncmp
atol
strcmp
wcslen
_wcsicmp
memcmp
mbstowcs
wcscpy
malloc
_snprintf
rand
memcpy
memset
strstr
strtok
free
strncpy
sprintf
printf
strcpy
atoi
strlen
strcat

Sections

.text
Size: 88KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b5ccd112c9e6a99c80c1fff1e66c7f94

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

odbc32

ws2_32

wininet

wtsapi32

netapi32

iphlpapi

imagehlp

rasapi32

shlwapi

msvcrt

Sections

.text Size: 88KB - Virtual size: 85KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 40KB - Virtual size: 252KB

.rsrc Size: 4KB - Virtual size: 2KB

.text
Size: 88KB - Virtual size: 85KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 40KB - Virtual size: 252KB

.rsrc
Size: 4KB - Virtual size: 2KB