3a71933f1047e0ae0cf1dd635d5f9fe7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3a71933f1047e0ae0cf1dd635d5f9fe7_JaffaCakes118
Size

676KB
MD5

3a71933f1047e0ae0cf1dd635d5f9fe7
SHA1

94561ae691dd67fa0a53fe35b00bf26b00251fc2
SHA256

e338a71f4b7584223160effa858c63de338ab94b313ca877734772182470b681
SHA512

86dde8c542d59ffc084ca2d6f507fe4ffb2012166748990c4a10b2119fb028f53f3b9eb3b87a20180fce6eecdbad7e2880f2f9c7d1056280dad4395421ad1aa9
SSDEEP

12288:IDQNFEyqo3PlzYKXpdqUVTaRGisvrkEouIlpjBqwO8:IDQNqo3PlzNoUVTacbvrk3ZxN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a71933f1047e0ae0cf1dd635d5f9fe7_JaffaCakes118

Files

3a71933f1047e0ae0cf1dd635d5f9fe7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dc0ff02c162a0587740fee88a18c8433

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempPathA
FileTimeToDosDateTime
FileTimeToLocalFileTime
GetFileSize
GetFileTime
WriteFile
LocalFileTimeToFileTime
DosDateTimeToFileTime
FreeLibrary
GetProcAddress
LoadLibraryExA
WaitForSingleObject
CreateProcessA
SystemTimeToFileTime
GetSystemTime
GetWindowsDirectoryA
GetTickCount
SetEvent
OpenEventA
GetPrivateProfileStringA
GetCurrentProcess
GetVersionExA
GetShortPathNameA
GetSystemDirectoryA
WinExec
ReadFile
SetFileTime
SetFileAttributesA
LoadLibraryA
FindNextFileA
IsBadWritePtr
IsBadReadPtr
GetPrivateProfileSectionNamesA
WritePrivateProfileSectionA
WritePrivateProfileStringA
RemoveDirectoryA
GlobalFree
GlobalUnlock
lstrcmpA
FindFirstFileA
GetModuleHandleA
GetVersion
CreateThread
lstrcpynA
Sleep
lstrcmpiA
GetCurrentThreadId
GetCommandLineA
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
lstrcatA
GetCurrentProcessId
CreateFileW
GetLocaleInfoA
LockResource
LoadResource
FindResourceA
FindClose
CreateEventA
QueryPerformanceFrequency
CreateFileA
CloseHandle
GetDiskFreeSpaceA
EnterCriticalSection
LeaveCriticalSection
lstrlenW
InterlockedDecrement
LocalFree
InterlockedIncrement
FormatMessageA
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
GetLastError
SetLastError
MoveFileA
DeleteFileA
CopyFileA
GlobalAlloc
GlobalLock
lstrcpyA
GetFileAttributesA
CreateDirectoryA
GetPrivateProfileSectionA
MoveFileExA
GetModuleFileNameA
SetHandleCount
GetEnvironmentStringsW
GetStdHandle
LCMapStringW
MapViewOfFile
UnmapViewOfFile
SearchPathA
VirtualProtect
VirtualQuery
InterlockedExchange
ResetEvent
QueryPerformanceCounter
GetCurrentThread
RtlUnwind
RaiseException
TlsSetValue
ExitThread
HeapAlloc
HeapFree
GetStartupInfoA
ExitProcess
TlsAlloc
TlsGetValue
FlushFileBuffers
SetStdHandle
GetOEMCP
GetStringTypeW
GetStringTypeA
SetFilePointer
IsBadCodePtr
GetFileType
GetCPInfo
LCMapStringA
TerminateProcess
HeapReAlloc
HeapSize
UnhandledExceptionFilter
GetEnvironmentVariableA
HeapCreate
VirtualFree
VirtualAlloc
FreeEnvironmentStringsA
FreeEnvironmentStringsW
CreateFileMappingA
SetUnhandledExceptionFilter
GetACP
GetEnvironmentStrings

user32

CreateDialogIndirectParamA
CharLowerBuffA
wsprintfA
GetDesktopWindow
PostThreadMessageA
DispatchMessageA
TranslateMessage
GetMessageA
CharUpperA
ExitWindowsEx
DestroyWindow
LoadStringA
CharNextA
WaitForInputIdle
MessageBoxA
MsgWaitForMultipleObjects
PeekMessageA
GetDlgItem
SendMessageA
SetDlgItemTextA
IsDialogMessageA

gdi32

GetObjectA
CreateFontIndirectA
DeleteObject
TranslateCharsetInfo

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegConnectRegistryA
RegCloseKey
RegDeleteKeyA
RegOpenKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegSetValueExA
RegQueryInfoKeyA
RegDeleteValueA
OpenThreadToken
RegEnumKeyExA
RegEnumValueA
AllocateAndInitializeSid
RegQueryValueA
FreeSid
EqualSid
GetTokenInformation

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHGetMalloc

ole32

OleLoadFromStream
CoUnmarshalInterface
CoMarshalInterface
CoReleaseMarshalData
CreateFileMoniker
CLSIDFromString
CoCreateGuid
CoRegisterClassObject
StringFromCLSID
CreateItemMoniker
GetRunningObjectTable
CreateStreamOnHGlobal
OleSaveToStream
WriteClassStm
ProgIDFromCLSID
CoTaskMemFree
CoGetInterfaceAndReleaseStream
CoInitialize
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoUninitialize
StgOpenStorage
StgCreateDocfile
CoRevokeClassObject

oleaut32

RegisterTypeLi
SysStringByteLen
SafeArrayCreate
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement
SetErrorInfo
CreateErrorInfo
SafeArrayDestroy
SafeArrayPutElement
VariantCopy
VariantChangeType
VariantInit
LoadRegTypeLi
SysAllocStringLen
SysStringLen
SysReAllocStringLen
SysFreeString
SysAllocStringByteLen
SafeArrayGetDim
LoadTypeLi
SafeArrayCopy
SysAllocString
VariantClear
VariantCopyInd

msi

ord87
ord189
ord18
ord144
ord46
ord136
ord67
ord141
ord168
ord7
ord93
ord91
ord95
ord120
ord17
ord124
ord49
ord75
ord79
ord116
ord73
ord112
ord31
ord159
ord8
ord160
ord117
ord146
ord103
ord33

rpcrt4

RpcRaiseException
NdrConformantStringUnmarshall
RpcServerUseProtseqEpA
RpcServerUnregisterIf
RpcMgmtStopServerListening
NdrPointerBufferSize
NdrPointerMarshall
NdrPointerFree
NdrServerInitializeNew
NdrConvert
I_RpcGetBuffer
RpcServerRegisterIf
RpcServerListen

comctl32

ord17

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 412KB - Virtual size: 408KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 36KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rrdata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

dc0ff02c162a0587740fee88a18c8433

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msi

rpcrt4

comctl32

version

Sections

.text Size: 412KB - Virtual size: 408KB

.rdata Size: 76KB - Virtual size: 75KB

.data Size: 36KB - Virtual size: 121KB

.rsrc Size: 76KB - Virtual size: 72KB

.rrdata Size: 72KB - Virtual size: 72KB

.text
Size: 412KB - Virtual size: 408KB

.rdata
Size: 76KB - Virtual size: 75KB

.data
Size: 36KB - Virtual size: 121KB

.rsrc
Size: 76KB - Virtual size: 72KB

.rrdata
Size: 72KB - Virtual size: 72KB