3de2e791389e4d662df3e7c76b48cd47_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3de2e791389e4d662df3e7c76b48cd47_JaffaCakes118
Size

5.2MB
MD5

3de2e791389e4d662df3e7c76b48cd47
SHA1

7bfe433dd9c14edf781f075aa0eb835b00fe9d03
SHA256

60590419a6290719a0001ef36be992d800e35fa9e4b05632d9bca314256ab600
SHA512

3a84ec1b46ddf218bdcd5251d4e339034b2668cc44aa9f0c141a2f1b1d00bc063d002301e353ab423c26432a873d388ea4f515a5ed5702b94267fed110186f15
SSDEEP

98304:Q343URKdBZWEBBki2BrCdbr/vOM1Bh6LvAJfF88cK7a+oWEcyvmMnt1N/K2z4HIq:Q343URKdBZWEBBki2BrCdbr/vR1jTfFE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3de2e791389e4d662df3e7c76b48cd47_JaffaCakes118

Files

3de2e791389e4d662df3e7c76b48cd47_JaffaCakes118
.exe windows:4 windows x86 arch:x86

19ce098d354694007f6f5efa042c6952

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

imm32

ImmGetIMEFileNameA
ImmGetDefaultIMEWnd
ImmGetCompositionStringA
ImmGetCompositionWindow
ImmGetDescriptionA
ImmGetContext
ImmGetOpenStatus
ImmSetOpenStatus
ImmGetConversionStatus
ImmSetConversionStatus
ImmReleaseContext
ImmSetCompositionWindow

dsound

ord1
ord2

opengl32

glColor4f
glDisable
glEnd
glVertex2f
glTexCoord2f
glColor4ub
glBegin
glColor3f
glTexImage2D
glBindTexture
glFlush
glClear
glPopMatrix
glAlphaFunc
glDepthFunc
glTranslatef
glRotatef
glLoadIdentity
glPushMatrix
glMatrixMode
glVertex3f
glNormal3f
glVertex3fv
glColor3fv
glDeleteTextures
glTexParameteri
glGenTextures
glTexEnvf
glDepthMask
glPolygonMode
glFrontFace
glStencilFunc
glColorMask
glStencilOp
glScalef
glGetFloatv
glReadPixels
glBlendFunc
glViewport
glFogfv
glFogf
glFogi
wglDeleteContext
wglMakeCurrent
glGetString
wglCreateContext
glClearColor
glTexEnvi
glGetIntegerv
glColor3ub
glEnable

glu32

gluPerspective
gluOrtho2D

winmm

timeSetEvent
timeGetTime
mmioClose
mmioAscend
mmioRead
mmioDescend
mmioOpenA
mmioWrite
timeBeginPeriod
timeGetDevCaps
timeEndPeriod
timeKillEvent

kernel32

TlsAlloc
GetSystemTimeAsFileTime
ExitThread
TlsGetValue
TlsSetValue
CreateThread
HeapAlloc
GetVersion
GetStartupInfoA
TlsFree
HeapReAlloc
HeapSize
InitializeCriticalSection
DeleteCriticalSection
FatalAppExitA
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
GetTickCount
IsBadReadPtr
lstrlenA
GlobalUnlock
GlobalLock
OutputDebugStringA
GetCurrentThreadId
Sleep
Process32Next
Process32First
CreateToolhelp32Snapshot
MoveFileA
GetFileAttributesA
CreateFileA
GetCommandLineA
CloseHandle
ReadFile
GetFileSize
GetLastError
GetPrivateProfileStringA
GetCurrentDirectoryA
DeleteFileA
CopyFileA
SetFileAttributesA
TerminateProcess
OpenProcess
WinExec
FindClose
FindFirstFileA
GetLocalTime
GetModuleFileNameA
SetFilePointer
WriteFile
GetEnvironmentVariableA
lstrcmpiA
GetVersionExA
QueryPerformanceCounter
SetProcessAffinityMask
SetThreadPriority
SetPriorityClass
GetProcessAffinityMask
GetThreadPriority
GetPriorityClass
GetCurrentThread
GetCurrentProcess
QueryPerformanceFrequency
FreeLibrary
GetProcAddress
LoadLibraryA
GlobalMemoryStatus
ExitProcess
SetConsoleMode
GetStdHandle
AllocConsole
FreeConsole
SetConsoleTitleA
GetConsoleTitleA
SetLastError
SetConsoleCursorPosition
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
ReadConsoleOutputA
GetCurrentProcessId
GetModuleHandleA
LeaveCriticalSection
EnterCriticalSection
GetSystemTime
GetTimeZoneInformation
WideCharToMultiByte
HeapFree
RaiseException
InterlockedIncrement
InterlockedDecrement
RtlUnwind
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFullPathNameA
FindNextFileA
RemoveDirectoryA
GetThreadContext
lstrcpynA
Module32First
Module32Next
SetUnhandledExceptionFilter
WaitForSingleObject
CreateDirectoryA
ResetEvent
GetExitCodeProcess
WaitForMultipleObjects
CreateProcessA
CreateEventA
OpenEventA
ResumeThread
OpenMutexA
MoveFileExA
lstrcatA
TerminateThread
ReleaseMutex
GetComputerNameA
lstrcmpA
GetModuleFileNameW
VirtualProtect
OpenFileMappingA
VirtualQuery
LoadLibraryExA
GetTempFileNameA
GetTempPathA
GetProcessHeap
GetFileInformationByHandle
DuplicateHandle
CreatePipe
PeekNamedPipe
lstrcpyA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
FlushFileBuffers
IsBadCodePtr
SetStdHandle
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
SetConsoleCtrlHandler
GetLocaleInfoW
SetEvent
CreateMutexA
GetSystemDirectoryA

user32

GetDC
SetWindowPos
SetWindowTextA
GetWindowTextA
GetCaretPos
GetWindowLongA
GetAsyncKeyState
SendMessageA
CallWindowProcA
OpenClipboard
SetFocus
CloseClipboard
SetWindowLongA
DestroyWindow
SetRect
GetActiveWindow
GetCursorPos
ScreenToClient
GetDoubleClickTime
PtInRect
OffsetRect
MessageBoxA
PostMessageA
GetFocus
IsWindowVisible
GetScrollPos
SetScrollPos
ShowWindow
wsprintfA
GetDesktopWindow
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
GetWindowRect
RegisterHotKey
UnregisterHotKey
SetCursorPos
FindWindowA
ShowCursor
ChangeDisplaySettingsA
ReleaseDC
SystemParametersInfoA
ReleaseCapture
SetCapture
DefWindowProcA
PostQuitMessage
EndPaint
BeginPaint
RegisterClassA
LoadCursorA
LoadIconA
SetForegroundWindow
GetSystemMetrics
AdjustWindowRect
IsIconic
SetTimer
CreateWindowExA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
UpdateWindow
EnumDisplaySettingsA
KillTimer
GetKeyboardLayoutNameA
GetKeyboardLayout
wvsprintfA
EnumChildWindows
RemoveMenu
DrawMenuBar
GetSystemMenu
GetClassNameA
GetWindowThreadProcessId
GetClipboardData
IntersectRect

gdi32

GetStockObject
SetPixelFormat
ChoosePixelFormat
SetTextColor
SwapBuffers
GetTextExtentPoint32A
CreateFontA
DeleteObject
GetTextExtentPointA
SelectObject
TextOutA
DeleteDC
SetBkColor
CreateDIBSection
CreateCompatibleDC

advapi32

InitializeSecurityDescriptor
CryptGetHashParam
CryptDeriveKey
CryptDecrypt
CryptCreateHash
CryptHashData
CryptVerifySignatureA
CryptDestroyHash
RegEnumValueA
RegDeleteValueA
GetUserNameA
CryptAcquireContextA
SetSecurityDescriptorDacl
CryptDestroyKey
CryptEncrypt
CryptImportKey
RegOpenKeyExA
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
CryptReleaseContext
RegSetValueExA
RegCloseKey

shell32

ShellExecuteA

ole32

CoUninitialize
CoInitialize
CoCreateInstance

ws2_32

sendto
WSAGetLastError
htons
send
WSACleanup
WSAStartup
closesocket
recv
shutdown
socket
setsockopt
WSAAsyncSelect
connect
gethostbyname
WSASend
inet_addr

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

wzaudio

wzAudioGetStreamOffsetRange
wzAudioStop
wzAudioOption
wzAudioCreate
wzAudioDestroy
wzAudioPlay

urlmon

URLDownloadToFileA

wininet

InternetReadFile
FtpOpenFileA
HttpSendRequestA
HttpQueryInfoA
FtpFindFirstFileA
InternetOpenA
HttpOpenRequestA
InternetQueryDataAvailable
InternetConnectA
InternetCloseHandle

Sections

.text
Size: 4.8MB - Virtual size: 4.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 204KB - Virtual size: 202KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 204KB - Virtual size: 136.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

19ce098d354694007f6f5efa042c6952

Headers

File Characteristics

Imports

imm32

dsound

opengl32

glu32

winmm

kernel32

user32

gdi32

advapi32

shell32

ole32

ws2_32

version

wzaudio

urlmon

wininet

Sections

.text Size: 4.8MB - Virtual size: 4.8MB

.rdata Size: 204KB - Virtual size: 202KB

.data Size: 204KB - Virtual size: 136.9MB

.rsrc Size: 8KB - Virtual size: 8KB

.text
Size: 4.8MB - Virtual size: 4.8MB

.rdata
Size: 204KB - Virtual size: 202KB

.data
Size: 204KB - Virtual size: 136.9MB

.rsrc
Size: 8KB - Virtual size: 8KB