3b4d39c63621f1e7afa4e23e2ccc714a_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

3b4d39c63621f1e7afa4e23e2ccc714a_JaffaCakes118
Size

477KB
MD5

3b4d39c63621f1e7afa4e23e2ccc714a
SHA1

9b26b0d73d2cec4bd3be80872fe5b9eefbc7a50b
SHA256

a6c77a6c4facfdef06e8380183a26be73940e7fb956085e3ed9c7f1588c45128
SHA512

5badf807d27910373fbcfd32c695efd34941ec812fce646ad289b4f62a8ef7b007b0d6b0371c1bb3a58e82b01493513bd8212d0468de1e67be28f7066d4ad454
SSDEEP

12288:dmJORwDnK4LuF6tq+RWpxCAoGTHdISBNZn7HOzJ:dqORwDnbLpqxxCpSR5AJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/systemcomponents2/install.exe

Files

3b4d39c63621f1e7afa4e23e2ccc714a_JaffaCakes118
.cab
systemcomponents2/install.exe
.exe windows:5 windows x86 arch:x86

90e5ef586567ce1dfa50aa0ad2edf52f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Source\ToolsCurrent\release\MicrogamingInstall.pdb

Imports

kernel32

GetModuleFileNameW
MultiByteToWideChar
FindFirstFileA
GetProcAddress
FindClose
RemoveDirectoryW
FindNextFileA
GetModuleHandleA
ReleaseMutex
GetVersionExA
DeleteFileW
SetEvent
GetPrivateProfileStringW
CreateEventA
CreateDirectoryA
CreateMutexA
OutputDebugStringA
FreeLibrary
LoadLibraryA
LocalFree
lstrcpynA
GetDriveTypeA
GetVolumeInformationA
DeviceIoControl
MoveFileExA
Process32First
GetFileAttributesA
TerminateProcess
GetSystemDirectoryA
GetLastError
GetLocalTime
Process32Next
CreateToolhelp32Snapshot
lstrlenA
lstrcpynW
GetFileAttributesW
lstrlenW
lstrcpyA
MapViewOfFile
InterlockedIncrement
GetPrivateProfileIntA
InterlockedExchange
InterlockedExchangeAdd
CreateFileMappingA
GetExitCodeThread
WaitForMultipleObjects
GetCurrentThreadId
CreateThread
SetEndOfFile
LeaveCriticalSection
EnterCriticalSection
SetLastError
CreateSemaphoreA
CreateFileW
ReleaseSemaphore
GetLogicalDriveStringsA
GlobalMemoryStatusEx
GetSystemInfo
GetDiskFreeSpaceExA
ReadFile
SetThreadPriority
GetThreadTimes
ResumeThread
CompareStringW
CompareStringA
GetProcessHeap
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
HeapSize
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
LCMapStringW
LCMapStringA
HeapCreate
VirtualAlloc
VirtualFree
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStdHandle
InterlockedDecrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
RtlUnwind
RaiseException
GetStartupInfoA
GetCommandLineA
GetFullPathNameA
SetCurrentDirectoryA
GetCurrentDirectoryA
SetEnvironmentVariableA
FileTimeToLocalFileTime
FileTimeToSystemTime
MoveFileA
IsDebuggerPresent
SetUnhandledExceptionFilter
FormatMessageW
CopyFileW
WideCharToMultiByte
GetVolumePathNameW
WriteFile
FormatMessageA
GetEnvironmentVariableA
CreateDirectoryW
SetFilePointer
GetFileSize
GetComputerNameA
DeleteFileA
GetTempPathA
CreateFileA
GetCurrentProcessId
CloseHandle
GetModuleFileNameA
GetTempFileNameA
CopyFileA
RemoveDirectoryA
lstrcmpiA
CreateProcessA
Sleep
OpenProcess
WaitForSingleObject
CreateProcessW
GetCurrentThread
UnhandledExceptionFilter
GetCurrentProcess
HeapReAlloc
HeapFree
ExitThread
GetSystemTimeAsFileTime
HeapAlloc
ExitProcess
GetModuleHandleW
SetFileAttributesA

user32

MapWindowPoints
LoadImageA
IsWindowVisible
GetSystemMetrics
RegisterClassW
MessageBoxW
DispatchMessageA
CreateWindowExW
CreatePopupMenu
SetLayeredWindowAttributes
GetCursorPos
SetWindowPos
SetWindowLongW
CreateWindowExA
PeekMessageA
UpdateWindow
AppendMenuW
GetWindowLongW
InvalidateRect
SetWindowLongA
OffsetRect
ChildWindowFromPoint
TranslateMessage
IsDialogMessageA
SendMessageA
SetFocus
GetClientRect
IsWindowEnabled
LoadIconA
SetForegroundWindow
GetWindowDC
TrackPopupMenu
EnableWindow
AdjustWindowRect
LoadCursorA
GetDlgCtrlID
DefWindowProcW
FlashWindowEx
MoveWindow
DefWindowProcA
ShowWindow
wvsprintfA
GetActiveWindow
PostThreadMessageA
SetActiveWindow
GetWindowRect
GetMessageA
DestroyWindow
RegisterClassA
wsprintfW
PostMessageA
SetWindowTextA
wsprintfA
MessageBoxA
ReleaseDC
CopyRect

gdi32

DeleteDC
CreateDIBSection
GetDIBits
DeleteObject
SelectObject
CreateCompatibleDC
GetStockObject
BitBlt

advapi32

RegCloseKey
RegQueryValueW
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyW
OpenSCManagerA
CloseServiceHandle
OpenServiceA
RegSetValueExW
RegQueryValueExW
RegSetValueW
RegSetValueA
FreeSid
GetUserNameA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA

shell32

SHGetFolderPathW
SHGetPathFromIDListW
SHGetMalloc
SHGetSpecialFolderLocation
Shell_NotifyIconA
SHGetSpecialFolderPathA
SHChangeNotify
ShellExecuteA

ole32

OleUninitialize
OleInitialize
OleCreate
OleSetContainedObject
CoTaskMemFree
StringFromIID
CLSIDFromProgID
CoInitialize
CoUninitialize
CoTaskMemAlloc
CoCreateGuid
CoCreateInstance

oleaut32

SafeArrayCreateVector
VariantTimeToSystemTime
VariantCopy
VariantChangeType
VariantInit
VariantClear
SysAllocString
SysFreeString
SysAllocStringLen
SysStringLen
SafeArrayUnaccessData
SafeArrayAccessData

wsock32

WSAStartup
gethostbyname
inet_addr
ioctlsocket
htonl
WSAGetLastError
htons
ntohs
getservbyport
getservbyname
WSASetLastError
gethostbyaddr
WSACleanup

wininet

InternetConnectA
InternetOpenUrlA
InternetCrackUrlA
InternetOpenA
InternetQueryOptionA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetGetLastResponseInfoA
HttpQueryInfoA
InternetReadFile
InternetOpenUrlW
InternetOpenW
InternetCreateUrlA
InternetCrackUrlW
InternetCloseHandle

shlwapi

PathCanonicalizeA
PathAppendA
SHDeleteKeyA
PathCanonicalizeW
PathAppendW
StrStrA
UrlGetPartA

psapi

GetModuleFileNameExA

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

ws2_32

WSAAddressToStringA

urlmon

CoInternetGetSession

Exports

Exports

?CreateDefaultBrowserInfo@@YGPAVIDefaultBrowserInfo@@XZ
?CreateDirectXVersionInfo@@YGPAVIDirectXVersionInfo@@XZ
?CreateDisplaysDeviceInfo@@YGPAVIDisplayDevicesInfo@@XZ
?CreateFixedDriveInfo@@YGPAVIFixedDriveInfo@@XZ
?CreateFixedDrivesInfo@@YGPAVIFixedDrivesInfo@@XZ
?CreateFlashInfo@@YGPAVIFlashInfo@@XZ
?CreateIEVersionInfo@@YGPAVIIEVersionInfo@@XZ
?CreateMacAddress@@YGPAVIMacAddress@@XZ
?CreateMachineInfo@@YGPAVIMachineInfo@@XZ
?CreateMachineInfoXML@@YGPAVIMachineInfoXML@@XZ
?CreateOSInfo@@YGPAVIOSInfo@@XZ
?CreateProcessorsInfo@@YGPAVIProcessorsInfo@@XZ
?CreateRamInfo@@YGPAVIRamInfo@@XZ
?CreateSoundDevicesInfo@@YGPAVISoundDevicesInfo@@XZ
?CreateUserExperience@@YGPAVIUserExperience@@XZ
?CreateVMInfo@@YGPAVIVMInfo@@XZ

Sections

.text
Size: 361KB - Virtual size: 361KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 53KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

90e5ef586567ce1dfa50aa0ad2edf52f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wsock32

wininet

shlwapi

psapi

version

ws2_32

urlmon

Exports

Exports

Sections

.text Size: 361KB - Virtual size: 361KB

.rdata Size: 48KB - Virtual size: 47KB

.data Size: 53KB - Virtual size: 74KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 361KB - Virtual size: 361KB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 53KB - Virtual size: 74KB

.rsrc
Size: 4KB - Virtual size: 3KB