363e5ff122918138bda338df62e7937f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

363e5ff122918138bda338df62e7937f_JaffaCakes118
Size

224KB
MD5

363e5ff122918138bda338df62e7937f
SHA1

e82210eb1c31a23473252201d694101e1f1336df
SHA256

39f94f69b1c313f48ca1b8d513580c81dd135e9f1e1ee7128ba3fc62865f0986
SHA512

6531d73281d3f2ecef46f96228fd97f22add4ed5c5e0b063648bea4c1e3b379d8c9d3d9d3c17f2410e49d9e2b0a737204e3576f7033c4634db9a725d78dd0cfc
SSDEEP

3072:znBSM9pb9TzlqZZtvtPbacIxxW5BczeLstUauCSXlqoOJzYlZJs:QMjb9TOZtNWcIxEq7urrG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
363e5ff122918138bda338df62e7937f_JaffaCakes118

Files

363e5ff122918138bda338df62e7937f_JaffaCakes118
.exe .vbs windows:6 windows x86 arch:x86 polyglot

08996cc55c884a66b635b0a3f4ad7db2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

graphedt.pdb

Imports

advapi32

RegCloseKey
RegDeleteKeyA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegDeleteValueA
RegNotifyChangeKeyValue
RegEnumValueA
RegOpenKeyA

kernel32

LocalFree
LocalUnlock
LocalLock
LocalAlloc
GetCurrentProcessId
InterlockedIncrement
InterlockedDecrement
SetEvent
SetFilePointer
LoadLibraryA
GetProcAddress
lstrlenW
lstrcmpiA
CreateFileA
WriteFile
WaitForMultipleObjects
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
CreateEventA
CreateThread
GetModuleFileNameA
Sleep
GetVersion
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
RtlUnwind
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
GetCurrentThreadId
GetLastError
FreeLibrary
CloseHandle
WaitForSingleObject
GetThreadLocale

gdi32

CreatePen
Pie
GetTextExtentPoint32A
CreateCompatibleDC
CreateFontA
CreateSolidBrush
GetObjectA
BitBlt
SetStretchBltMode
StretchBlt
DPtoLP
PatBlt
GetDeviceCaps

user32

LoadBitmapA
InflateRect
ReleaseDC
GetDC
GetCursorPos
GetSystemMetrics
GetDoubleClickTime
ReleaseCapture
SetCapture
GetCapture
ScreenToClient
LoadMenuA
EnableMenuItem
DrawFocusRect
IntersectRect
PtInRect
RegisterClipboardFormatA
GetDesktopWindow
EnableWindow
UnionRect
OffsetRect
IsDlgButtonChecked
SetTimer
KillTimer
MessageBoxA
SystemParametersInfoA
GetMenu
GetSubMenu
CheckMenuItem
SetRect
LoadCursorA
RegisterClassA
CreateWindowExA
SetWindowLongA
PeekMessageA
WaitMessage
SetForegroundWindow
SetDlgItemTextA
CallWindowProcA
GetDlgItem
LoadIconA
SendMessageA
PostQuitMessage
DefWindowProcA
GetWindowLongA
PostMessageA
DispatchMessageA
TranslateMessage
AppendMenuA
GetMenuItemCount
RemoveMenu
MapDialogRect
WinHelpA
MessageBeep
SetRectEmpty
ShowWindow
UpdateWindow
InvalidateRect
GetWindowRect
MonitorFromRect
GetMonitorInfoA
SetFocus
SetWindowPos
ShowCursor
IsWindow
BeginPaint
GetClientRect
FillRect
EndPaint
DestroyWindow

mfc42

ord1576
ord4275
ord2645
ord3873
ord2411
ord2023
ord4218
ord2578
ord4398
ord3582
ord616
ord2825
ord926
ord922
ord2919
ord491
ord4976
ord5161
ord5162
ord5160
ord4905
ord4948
ord4358
ord4835
ord3699
ord768
ord5287
ord6453
ord4742
ord4258
ord4715
ord1690
ord5288
ord4439
ord2054
ord4431
ord3700
ord497
ord2109
ord2078
ord771
ord3475
ord5637
ord1008
ord2882
ord609
ord2575
ord4396
ord3574
ord825
ord3663
ord1168
ord2841
ord5440
ord6383
ord2107
ord5450
ord6394
ord800
ord4160
ord540
ord823
ord1199
ord2514
ord2393
ord6329
ord1175
ord2863
ord6197
ord3870
ord2652
ord1669
ord641
ord858
ord3499
ord2515
ord355
ord6175
ord939
ord537
ord1200
ord1825
ord4238
ord535
ord4420
ord5740
ord539
ord860
ord4823
ord652
ord4426
ord4623
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord6080
ord3198
ord3454
ord4387
ord5653
ord3172
ord5577
ord1746
ord5243
ord2542
ord2510
ord6336
ord3065
ord3058
ord4696
ord338
ord4614
ord4613
ord1920
ord784
ord736
ord4432
ord4627
ord5277
ord2124
ord2446
ord5260
ord1725
ord5065
ord3748
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5240
ord4407
ord1776
ord4078
ord6055
ord4108
ord4960
ord4963
ord4526
ord4543
ord4545
ord4531
ord4889
ord4349
ord4341
ord4899
ord4589
ord2535
ord1567
ord4262
ord5495
ord4464
ord4524
ord2414
ord268
ord3626
ord3573
ord3654
ord2584
ord4220
ord2438
ord1644
ord1146
ord2864
ord2379
ord439
ord517
ord4723
ord6131
ord6216
ord3075
ord613
ord289
ord4042
ord4508
ord6454
ord5787
ord283
ord4330
ord6270
ord2817
ord3755
ord2859
ord2846
ord6648
ord5856
ord2763
ord4203
ord861
ord3693
ord1641
ord3619
ord3571
ord1640
ord5785
ord4297
ord4133
ord1270
ord640
ord323
ord5788
ord6119
ord2714
ord4234
ord692
ord3597
ord4425
ord5261
ord1727
ord3749
ord5280
ord5241
ord1775
ord6052
ord4998
ord4376
ord5265
ord567
ord3639
ord4424
ord3402
ord4401
ord2581
ord4219
ord2024
ord2413
ord6366
ord1771
ord2302
ord324
ord4853
ord5981
ord4710
ord5681
ord6199
ord2642
ord3092
ord4224
ord4299
ord3138
ord2086
ord6215
ord326
ord4615
ord4612
ord4610
ord815
ord3361
ord561
ord3738
ord4622
ord5714
ord5289
ord5307
ord4698
ord4079
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord3337
ord520
ord3715
ord6451
ord3353
ord4161
ord3194
ord3445
ord989
ord5617
ord3107
ord4214
ord2184
ord2185
ord3948
ord5730
ord2003
ord5940
ord4695
ord788
ord2725
ord1219
ord5953
ord3790
ord5503
ord2635
ord986
ord1205
ord4159
ord5943
ord1842
ord3403
ord4242
ord4235
ord327
ord3598
ord2444
ord5248
ord5279
ord6369
ord5234
ord6053
ord1712
ord1709
ord5082
ord2389
ord4121
ord5471
ord4056
ord4364
ord2530
ord6154
ord642
ord4147
ord2087
ord674
ord796
ord807
ord4427
ord5252
ord4436
ord1665
ord2649
ord5237
ord4077
ord4151
ord2878
ord2879
ord5472
ord975
ord5012
ord3350
ord4303
ord4467
ord5103
ord5100
ord3059
ord2390
ord2723
ord6069
ord1087
ord2122
ord556
ord5282
ord4413
ord2626
ord4055
ord554
ord529
ord366
ord2558
ord6000
ord2117
ord5883
ord2120
ord4457
ord2627
ord4724
ord1871
ord4259
ord6937

msvcrt

__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_controlfp
_amsg_exit
_XcptFilter
_exit
_cexit
__getmainargs
__CxxFrameHandler
_vsnwprintf
_itoa
qsort
rand
strrchr
_stricmp
strstr
printf
swscanf
_strnicmp
_ltow
towupper
??_U@YAPAXI@Z
??_V@YAXPAX@Z
_vsnprintf
_initterm
_acmdln
_ismbblead
_purecall
memset
_CxxThrowException
exit
_setmbcp

ole32

CLSIDFromString
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoGetInterfaceAndReleaseStream
CoUninitialize
StgOpenStorage
StgCreateDocfile
CoTaskMemFree
StringFromGUID2
CoCreateInstance
CreateBindCtx
MkParseDisplayName
GetRunningObjectTable

oleaut32

SysFreeString
VariantClear
SafeArrayUnaccessData
SafeArrayAccessData
SysAllocString
VariantInit
SysStringLen

comdlg32

CommDlgExtendedError
GetOpenFileNameA

comctl32

ImageList_Create
ord17
ImageList_ReplaceIcon

shell32

ShellExecuteA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

quartz

AMGetErrorTextA

Sections

.text
Size: 148KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

08996cc55c884a66b635b0a3f4ad7db2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

mfc42

msvcrt

ole32

oleaut32

comdlg32

comctl32

shell32

version

quartz

Sections

.text Size: 148KB - Virtual size: 148KB

.data Size: 4KB - Virtual size: 25KB

.rsrc Size: 40KB - Virtual size: 40KB

.reloc Size: 30KB - Virtual size: 33KB

.text
Size: 148KB - Virtual size: 148KB

.data
Size: 4KB - Virtual size: 25KB

.rsrc
Size: 40KB - Virtual size: 40KB

.reloc
Size: 30KB - Virtual size: 33KB