35be50b188b7afad1923ee9e85628586_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

35be50b188b7afad1923ee9e85628586_JaffaCakes118
Size

875KB
MD5

35be50b188b7afad1923ee9e85628586
SHA1

8716e9e4420cbd98b0c14c39a01c4d41165f199f
SHA256

1d679db08cc39500c6602d6c6babc1c3c3a22bcef98e21d6bdee786b66406618
SHA512

6fd2ad82708ccaf554594ea0c3606b6546b6229a4d01480a7780a430e0872d3402c103063f5237880ddc645acdd99ddac6f9be981f79b0d1ef145f85f501a48f
SSDEEP

12288:6K0xJKAQmGOhS/IzJqrraq/t2qXy6xdRhMAK4/cGPEl0Iod+:6K0iA6GS/EEn/tkIsGPEl0I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
35be50b188b7afad1923ee9e85628586_JaffaCakes118

Files

35be50b188b7afad1923ee9e85628586_JaffaCakes118
.exe windows:6 windows x86 arch:x86

6d86e779a247bf438689a64a68008c86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

dccw.pdb

Imports

advapi32

RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
EventUnregister
EventRegister
EventWrite
RegQueryValueExW

kernel32

GetCurrentProcess
WaitForSingleObject
CreateMutexW
GetSystemTime
CopyFileW
WideCharToMultiByte
WriteFile
CreateFileW
FlushInstructionCache
LocalFree
FormatMessageW
LockResource
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
DeleteCriticalSection
ReleaseMutex
CloseHandle
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
GetCurrentThreadId
FreeLibrary
lstrcmpiW
GetModuleHandleW
GetProcAddress
LoadLibraryW
InterlockedDecrement
InterlockedIncrement
GetLastError
lstrlenW
GetSystemDirectoryW
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
VirtualAlloc
VirtualFree
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedExchange
GetVersionExA
OutputDebugStringA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
UnhandledExceptionFilter

gdi32

SetBkMode
GetObjectW
CreateCompatibleDC
SelectObject
SetStretchBltMode
CreateCompatibleBitmap
StretchBlt
GetTextExtentPoint32W
SetDeviceGammaRamp
GetDeviceGammaRamp
GetStockObject
CreateSolidBrush
SetTextColor
SetBkColor
GetDeviceCaps
DeleteDC
CreateDCW
DeleteObject

user32

GetDC
MessageBoxW
GetWindow
ShowWindow
CharNextW
DestroyWindow
GetActiveWindow
GetSystemMetrics
MonitorFromRect
CallWindowProcW
SetWindowPos
SetForegroundWindow
OpenIcon
SendMessageW
SetWindowLongW
GetWindowLongW
MapDialogRect
RegisterWindowMessageW
DefWindowProcW
SendMessageTimeoutW
AllowSetForegroundWindow
GetWindowTextLengthW
FindWindowW
InvalidateRect
MoveWindow
MapWindowPoints
GetWindowRect
GetDlgItem
GetParent
GetMonitorInfoW
EnumDisplayDevicesW
EnumDisplayMonitors
GetWindowTextW
ReleaseDC
SetTimer
KillTimer
ShowCursor
UnregisterClassA
LoadStringW
SetCursor
LoadCursorW
MonitorFromWindow
PostMessageW
EnumChildWindows
GetWindowThreadProcessId
SetWindowTextW

msvcrt

_controlfp
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
_errno
realloc
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
memcpy
_ftol2
_CIpow
_wcsupr
swscanf_s
_ftol2_sse
_purecall
memset
??_U@YAPAXI@Z
wcsncpy_s
memcpy_s
malloc
??2@YAPAXI@Z
free
??_V@YAXPAX@Z
??3@YAXPAX@Z
wcsstr
_vsnwprintf

ntdll

WinSqmAddToStream

dxva2

DestroyPhysicalMonitors
GetPhysicalMonitorsFromHMONITOR
GetNumberOfPhysicalMonitorsFromHMONITOR
GetVCPFeatureAndVCPFeatureReply
SetVCPFeature
GetMonitorBrightness
SetMonitorBrightness
GetMonitorContrast
SetMonitorContrast
GetMonitorCapabilities

mscms

InstallColorProfileW
GetColorProfileFromHandle
WcsCreateIccProfile
SetColorProfileElementSize
SetColorProfileElement
UninstallColorProfileW
DccwGetDisplayProfileAssociationList
WcsDisassociateColorProfileFromDevice
WcsSetDefaultColorProfile
GetColorDirectoryW
WcsGetUsePerUserProfiles
WcsGetDefaultColorProfile
WcsOpenColorProfileW
DccwGetGamutSize
CloseColorProfile
DccwSetDisplayProfileAssociationList
DccwReleaseDisplayProfileAssociationList
WcsGetCalibrationManagementState
WcsSetCalibrationManagementState
DccwCreateDisplayProfileAssociationList

shell32

ShellExecuteW

gdiplus

GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneBrush
GdipFillRectangleI
GdipCreateFromHDC
GdipCreateLineBrushI
GdipCreateSolidFill
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipDeleteBrush
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdiplusShutdown
GdipCloneImage

comctl32

DestroyPropertySheetPage
CreatePropertySheetPageW
ord345
PropertySheetW

ole32

StringFromCLSID
CoTaskMemRealloc
CoTaskMemAlloc
CreateStreamOnHGlobal
CoCreateInstance
CoTaskMemFree

oleaut32

SysFreeString
VarUI4FromStr
SysAllocString

Sections

.text
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 763KB - Virtual size: 763KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

zwqfvgh
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6d86e779a247bf438689a64a68008c86

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

dxva2

mscms

shell32

gdiplus

comctl32

ole32

oleaut32

Sections

.text Size: 75KB - Virtual size: 75KB

.data Size: 1KB - Virtual size: 2KB

.rsrc Size: 763KB - Virtual size: 763KB

.reloc Size: 33KB - Virtual size: 34KB

zwqfvgh Size: - Virtual size: 4KB

.text
Size: 75KB - Virtual size: 75KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 763KB - Virtual size: 763KB

.reloc
Size: 33KB - Virtual size: 34KB

zwqfvgh
Size: - Virtual size: 4KB