3f30eef8700ad229688d42d771c0a8f1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3f30eef8700ad229688d42d771c0a8f1_JaffaCakes118
Size

248KB
MD5

3f30eef8700ad229688d42d771c0a8f1
SHA1

35ab89132f6ba39cb7b3072fdb321185a2b64cee
SHA256

1acefab74f8686dcff4a00ed4acf6c9bddcbbee43d8363413f410e0e8c495890
SHA512

3eca4ecce89c65385247f53db1f38699108700a9ce6de6cb05c27e27ddf5712e9cc8901444b166eb87885ddf84198031f76affda6b0c0a1181a8279cf9b7ae23
SSDEEP

6144:dtb8TsWD2MVA8vn6N8jb38SbY4sTYUZuTrGt:dSTsWD2Mm8vb3XbYZ9ZMrGt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f30eef8700ad229688d42d771c0a8f1_JaffaCakes118

Files

3f30eef8700ad229688d42d771c0a8f1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9271a55fb6e2cf5425f59fd98bf2ba7a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathRemoveFileSpecA

advapi32

AdjustTokenPrivileges
CloseServiceHandle
GetUserNameA
ImpersonateSelf
InitializeSecurityDescriptor
LookupPrivilegeValueA
OpenProcessToken
OpenSCManagerA
OpenServiceA
QueryServiceStatus
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RevertToSelf
SetSecurityDescriptorDacl

kernel32

CloseHandle
CreateEventA
CreateMutexA
CreateProcessA
CreateThread
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
FindClose
FindFirstFileW
FindNextFileW
FindResourceW
FormatMessageA
FreeLibrary
GetACP
GetCommandLineW
GetComputerNameA
GetDateFormatA
GetModuleHandleA
GetProcessHeap
GetShortPathNameA
GetTempFileNameA
GetTempPathA
GetThreadLocale
GetTimeFormatA
GetTimeZoneInformation
GetVolumeInformationA
GlobalAlloc
GlobalFree
GlobalLock
GlobalMemoryStatus
GlobalUnlock
HeapAlloc
HeapFree
LeaveCriticalSection
LoadLibraryExA
LocalFree
MulDiv
OpenEventA
OpenMutexA
OutputDebugStringA
ReleaseMutex
ResetEvent
SetErrorMode
SetFileAttributesA
SetLastError
SystemTimeToTzSpecificLocalTime
TerminateThread
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
lstrcmpiA
lstrcpynA
lstrlenA
GetModuleHandleW
GetProcAddress

netapi32

NetServerEnum

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

wsock32

WSACleanup
WSAGetLastError
WSAStartup
closesocket
connect
gethostbyname
htons
ioctlsocket
inet_addr
recv
send
socket

comctl32

ImageList_Draw
ImageList_GetIconSize

comdlg32

GetOpenFileNameW

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontIndirectW
CreateRectRgn
DeleteDC
DeleteObject
GetClipBox
GetDCOrgEx
GetDeviceCaps
GetObjectW
GetTextExtentExPointW
RestoreDC
SaveDC
SelectClipRgn
SelectObject
SetBkMode
StretchDIBits

shell32

SHBrowseForFolderW
SHGetFileInfoW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteA
ShellExecuteW
SHGetPathFromIDListA

user32

BeginPaint
BringWindowToTop
CharPrevA
CharToOemA
CharUpperA
ClientToScreen
CloseClipboard
DestroyIcon
DrawTextExW
DrawTextW
EndPaint
EqualRect
ExitWindowsEx
FindWindowExW
GetCursorPos
GetDC
GetForegroundWindow
GetLastActivePopup
GetSystemMetrics
GetWindowInfo
GetWindowPlacement
GetWindowRect
InflateRect
IntersectRect
InvalidateRect
IsIconic
IsZoomed
KillTimer
MessageBoxA
OffsetRect
OpenClipboard
PostMessageA
PtInRect
RegisterClassW
RegisterClipboardFormatW
ReleaseCapture
ReleaseDC
ScreenToClient
SendMessageA
SendMessageW
SetCapture
SetFocus
SetForegroundWindow
SetTimer
SetWindowPos
SystemParametersInfoA
WinHelpA

ole32

CoCreateInstance
CoInitialize
CoInitializeEx
CoUninitialize
CreateStreamOnHGlobal
IsEqualGUID
RegisterDragDrop
RevokeDragDrop

oleaut32

OleLoadPicture
SysAllocStringByteLen
SysAllocStringLen
SysFreeString

w32topl

ToplListCreate

mssign32

PvkPrivateKeyAcquireContextA
SignerSign

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.hyrw
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.LXkP
Size: 512B - Virtual size: 302B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.VRczt
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mhgjD
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 213KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Wz
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.AMEkpF
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9271a55fb6e2cf5425f59fd98bf2ba7a

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

advapi32

kernel32

netapi32

version

wsock32

comctl32

comdlg32

gdi32

shell32

user32

ole32

oleaut32

w32topl

mssign32

Sections

.text Size: 18KB - Virtual size: 18KB

.hyrw Size: 1KB - Virtual size: 1KB

.LXkP Size: 512B - Virtual size: 302B

.rdata Size: 5KB - Virtual size: 4KB

.VRczt Size: 1KB - Virtual size: 2KB

.mhgjD Size: 1KB - Virtual size: 2KB

.data Size: 213KB - Virtual size: 213KB

.Wz Size: 1KB - Virtual size: 1KB

.AMEkpF Size: 2KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 2KB

.text
Size: 18KB - Virtual size: 18KB

.hyrw
Size: 1KB - Virtual size: 1KB

.LXkP
Size: 512B - Virtual size: 302B

.rdata
Size: 5KB - Virtual size: 4KB

.VRczt
Size: 1KB - Virtual size: 2KB

.mhgjD
Size: 1KB - Virtual size: 2KB

.data
Size: 213KB - Virtual size: 213KB

.Wz
Size: 1KB - Virtual size: 1KB

.AMEkpF
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB