410711d5c8695b32c370e6e48094332d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

410711d5c8695b32c370e6e48094332d_JaffaCakes118
Size

3.7MB
MD5

410711d5c8695b32c370e6e48094332d
SHA1

bc00447995c72d7d9de71cf23a3c0f0abefab892
SHA256

d39db7d14a9aac8de52da49441e041d88f2fe72d28d49bce01c0566d23714e24
SHA512

5b3e61608714864c748e7cc05692205df0014295cb859a2bd49c4df6e5123d2a60c696512ea7830fdeeab34b58c88e5c7e7b650ac898ddccf1773dd4f227e961
SSDEEP

49152:ZU8MaWbqnuhiwLqXYPCxicHak8Mo8K+sTcK+:waWOuFLqoPCAnkd9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
410711d5c8695b32c370e6e48094332d_JaffaCakes118

Files

410711d5c8695b32c370e6e48094332d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

196c592fd64b8351c46340e70de39e02

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\Work\VSM_localization\EN\Sources\VRMPaid\AntiMalwareMaster\Release\VRM2008.pdb

Imports

kernel32

GetFileTime
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
GetCPInfo
GetOEMCP
SetErrorMode
HeapAlloc
HeapReAlloc
RtlUnwind
VirtualAlloc
GetSystemInfo
VirtualQuery
RaiseException
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoA
ExitProcess
SetStdHandle
GetFileType
HeapSize
GetACP
IsValidCodePage
HeapDestroy
HeapCreate
GetStdHandle
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
GetTimeZoneInformation
SetHandleCount
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
GetFullPathNameA
UnlockFile
LockFile
GetThreadLocale
SuspendThread
ResumeThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetModuleFileNameW
GlobalAlloc
FormatMessageA
GlobalLock
GlobalUnlock
GlobalFree
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
DeviceIoControl
GetTempFileNameA
GetFileAttributesW
CreateFileW
lstrcpyW
lstrcatW
ExpandEnvironmentStringsA
GetCurrentThread
CreateToolhelp32Snapshot
Process32First
Process32Next
Module32First
Module32Next
GetFileAttributesExA
OpenProcess
MoveFileExA
GetShortPathNameA
GetLongPathNameA
GetWindowsDirectoryA
SetThreadPriority
GetProcessHeap
HeapFree
WaitForMultipleObjectsEx
DuplicateHandle
GetCurrentProcessId
GetDiskFreeSpaceExA
GetLogicalDriveStringsA
SetEndOfFile
SetFileAttributesA
CompareFileTime
GetTempPathW
LockFileEx
GetFullPathNameW
DeleteFileW
OpenEventA
GetPrivateProfileSectionA
WritePrivateProfileSectionA
GetPrivateProfileIntA
GetSystemTime
UnmapViewOfFile
CreateFileMappingA
MapViewOfFileEx
GetSystemDirectoryA
GetCurrentDirectoryA
OutputDebugStringA
ExitThread
GetDriveTypeA
GetFileAttributesA
FindResourceExW
FindResourceW
VirtualProtect
GetCurrentProcess
WriteProcessMemory
lstrcmpA
InterlockedCompareExchange
GetCurrentThreadId
GetLocaleInfoA
GetVersionExA
FreeLibrary
GetFileSize
ReadFile
InterlockedDecrement
SetLastError
InterlockedIncrement
MulDiv
lstrcatA
LoadLibraryA
GetProcAddress
LocalAlloc
LocalFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
lstrcmpW
SetFilePointer
FlushFileBuffers
GetExitCodeThread
GetVolumeInformationA
CreateEventA
CreateThread
WaitForSingleObject
AreFileApisANSI
LoadLibraryW
GetFileInformationByHandle
PeekNamedPipe
WritePrivateProfileStringA
CreateProcessA
TerminateProcess
CreateDirectoryA
CopyFileA
RemoveDirectoryA
SystemTimeToFileTime
CreateWaitableTimerA
LocalFileTimeToFileTime
SetWaitableTimer
WaitForMultipleObjects
ResetEvent
SetEvent
FileTimeToLocalFileTime
FileTimeToSystemTime
TerminateThread
GetTempPathA
FindResourceExA
ReleaseMutex
lstrcpyA
CreateFileA
WriteFile
GetTickCount
GetCommandLineA
CreateMutexA
SetCurrentDirectoryA
FreeResource
FindFirstFileA
FindNextFileA
FindClose
Sleep
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
DeleteFileA
lstrcpynA
GetLocalTime
CloseHandle
GetModuleFileNameA
GetModuleHandleA
GetComputerNameA
GetStringTypeExA
GetEnvironmentVariableA
lstrlenA
lstrcmpiA
CompareStringW
CompareStringA
lstrlenW
GetVersion
FindResourceA
LoadResource
LockResource
SizeofResource
GetLastError
WideCharToMultiByte
MultiByteToWideChar
VirtualFree
InterlockedExchange

user32

WinHelpA
IsChild
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetWindowTextLengthA
GetLastActivePopup
SetActiveWindow
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
GetMenu
CreateWindowExA
GetClassInfoExA
RegisterClassA
AdjustWindowRectEx
EqualRect
GetScrollInfo
DefWindowProcA
IntersectRect
SetWindowTextA
IsWindowUnicode
GetMessageW
GetMessageA
PostThreadMessageA
EndDialog
GetForegroundWindow
EnumWindows
GetWindowPlacement
MsgWaitForMultipleObjects
wsprintfA
GetWindowTextA
GetActiveWindow
GetDlgItem
BeginPaint
EndPaint
GetAsyncKeyState
GetKeyState
DrawFocusRect
GetCapture
GetComboBoxInfo
DestroyCursor
LoadMenuA
IsWindowEnabled
SetFocus
EnableScrollBar
SendDlgItemMessageA
MapWindowPoints
CallWindowProcA
GetSysColorBrush
GetClassInfoA
DestroyMenu
InvalidateRgn
IsZoomed
SetMenuDefaultItem
EnableMenuItem
SetRect
GetSubMenu
WindowFromPoint
LoadImageW
LoadImageA
LoadCursorW
LoadIconW
LoadBitmapW
LoadStringW
GetFocus
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
SystemParametersInfoA
TrackPopupMenuEx
TrackPopupMenu
SetRectEmpty
GetMenuItemRect
UnionRect
FrameRect
SetMenuItemInfoA
SetMenuItemBitmaps
GetMenuItemInfoA
GetMenuDefaultItem
InflateRect
GetMenuItemCount
GetMenuState
IsMenu
InsertMenuItemA
OffsetRect
ReleaseCapture
SetCapture
CopyRect
ClientToScreen
GetSysColor
CopyImage
LookupIconIdFromDirectoryEx
CreateIconFromResourceEx
GetDesktopWindow
GetNextDlgTabItem
CreateDialogIndirectParamA
GetMenuStringA
CheckMenuItem
ModifyMenuA
GetMenuCheckMarkDimensions
SetDlgItemTextA
IsDialogMessageA
MoveWindow
TabbedTextOutA
DrawTextExA
GrayStringA
PostQuitMessage
ValidateRect
DrawTextA
ShowWindow
GetClassNameA
SetWindowLongA
ScreenToClient
PtInRect
GetSystemMenu
GetWindowThreadProcessId
MapDialogRect
SetWindowContextHelpId
GetKeyNameTextA
MapVirtualKeyA
CharNextA
UnregisterClassA
SetScrollPos
MessageBeep
DrawStateA
GetWindowLongA
DestroyIcon
AdjustWindowRect
GetDC
LoadBitmapA
FindWindowExA
UpdateWindow
FillRect
wsprintfW
TranslateMessage
DispatchMessageA
RegisterClipboardFormatA
GetMenuItemID
CopyAcceleratorTableA
IsRectEmpty
GetNextDlgGroupItem
PeekMessageA
InvalidateRect
FlashWindowEx
SetCursor
GetDlgCtrlID
LoadCursorA
SetWindowRgn
RedrawWindow
GetParent
CharLowerBuffA
RegisterWindowMessageA
GetCursorPos
UnregisterHotKey
RegisterHotKey
SetParent
SetTimer
IsWindowVisible
AppendMenuA
CreatePopupMenu
IsWindow
GetWindowRect
GetWindowDC
ReleaseDC
FindWindowA
GetWindow
KillTimer
PostMessageA
LoadStringA
MessageBoxA
SetForegroundWindow
SetWindowPos
CharUpperA
GetSystemMetrics
EnableWindow
LoadIconA
GetClientRect
IsIconic
SendMessageA
DrawIcon
DispatchMessageW

gdi32

RestoreDC
SaveDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
SelectClipRgn
ExcludeClipRect
DeleteObject
GetClipBox
PatBlt
CreateRectRgnIndirect
GetTextMetricsA
GetRgnBox
SetPixel
GetDeviceCaps
GetBitmapBits
SetBitmapBits
GetPixel
CreateBrushIndirect
MoveToEx
LineTo
GetTextColor
SetStretchBltMode
DPtoLP
CreateBitmap
GetMapMode
SetMapMode
CreateSolidBrush
CreateDIBitmap
GetBkColor
GetBkMode
SetBkColor
SetBkMode
SetTextColor
TextOutA
GetDIBits
CreateEllipticRgn
Rectangle
CreateFontIndirectA
ExtCreatePen
CreatePen
CombineRgn
GetStockObject
GetTextExtentPoint32A
CreateFontA
CreateRectRgn
GetObjectA
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
StretchBlt
DeleteDC

msimg32

AlphaBlend

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

CryptHashData
RegDeleteKeyA
GetUserNameA
RegCloseKey
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegQueryValueA
RegOpenKeyA
QueryServiceStatus
StartServiceA
OpenServiceA
DeleteService
OpenSCManagerA
CloseServiceHandle
CreateServiceA
RegSaveKeyA
CryptCreateHash
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextA
CryptReleaseContext
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenThreadToken
OpenProcessToken
RegEnumKeyA
RegCreateKeyA
RegEnumKeyExA
RegQueryInfoKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteValueA

shell32

Shell_NotifyIconA
ShellExecuteExA
SHGetSpecialFolderPathA
SHAppBarMessage
SHGetFolderPathA
SHFileOperationA
SHGetFolderPathW
ShellExecuteA

comctl32

ImageList_AddMasked
ImageList_GetIconSize
ImageList_Draw
ImageList_DrawEx
ImageList_GetImageInfo
_TrackMouseEvent
ord17
ImageList_GetImageCount

shlwapi

PathAddBackslashA
PathRemoveFileSpecA
PathStripPathA
PathAppendA
StrCmpNIW
PathIsDirectoryA
PathFileExistsA
PathCombineA
StrToIntA
PathFindExtensionA
PathRemoveExtensionA
SHDeleteKeyA
SHDeleteValueA
PathMatchSpecA
PathCanonicalizeA
PathUnquoteSpacesA
SHCreateStreamOnFileA
PathFindFileNameA
PathStripToRootA
PathIsUNCA

oledlg

ord8

ole32

CLSIDFromProgID
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
CoTaskMemAlloc
CoRegisterMessageFilter
CoCreateGuid
StringFromCLSID
CoTaskMemFree
CoInitializeEx
CoUninitialize
CoInitialize
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoCreateInstance
OleRun
StringFromGUID2
OleFlushClipboard
OleIsCurrentClipboard
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject

oleaut32

SysFreeString
SysAllocStringLen
SysAllocString
SysStringLen
VarBstrCmp
VariantInit
VariantClear
SysAllocStringByteLen
VariantCopy
VariantChangeType
SafeArrayGetVartype
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
LoadTypeLi
OleCreateFontIndirect
VariantTimeToSystemTime
SystemTimeToVariantTime

urlmon

ObtainUserAgentString

dbghelp

ImageDirectoryEntryToData

wininet

HttpSendRequestA
HttpAddRequestHeadersA
InternetSetCookieA
HttpOpenRequestA
InternetGetConnectedState
InternetQueryOptionA
FindNextUrlCacheEntryExA
InternetCrackUrlA
FindCloseUrlCache
FindFirstUrlCacheEntryExA
InternetReadFile
InternetGetCookieA
InternetGetLastResponseInfoA
InternetCanonicalizeUrlA
InternetOpenA
InternetSetOptionA
HttpQueryInfoA
InternetOpenUrlA
InternetCloseHandle
InternetConnectA

rpcrt4

UuidCreate

iphlpapi

IcmpSendEcho
IcmpCreateFile
GetAdaptersInfo

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

ws2_32

WSAResetEvent
WSAWaitForMultipleEvents
WSASetEvent
WSACreateEvent
WSACloseEvent
inet_addr
WSAGetLastError
inet_ntoa
shutdown
closesocket
WSAStartup
gethostbyname
WSASocketA
setsockopt
WSASendTo
WSARecvFrom
WSACleanup

setupapi

SetupInstallFileA

psapi

GetModuleFileNameExA
EnumProcessModules
EnumProcesses

netapi32

NetWkstaUserGetInfo
NetUserGetInfo
NetGetDCName
NetLocalGroupGetMembers
NetLocalGroupEnum
NetApiBufferFree

userenv

UnloadUserProfile

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 320KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 541B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

196c592fd64b8351c46340e70de39e02

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

urlmon

dbghelp

wininet

rpcrt4

iphlpapi

version

ws2_32

setupapi

psapi

netapi32

userenv

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 320KB - Virtual size: 316KB

.data Size: 28KB - Virtual size: 48KB

.tls Size: 4KB - Virtual size: 541B

.rsrc Size: 1.6MB - Virtual size: 1.6MB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 320KB - Virtual size: 316KB

.data
Size: 28KB - Virtual size: 48KB

.tls
Size: 4KB - Virtual size: 541B

.rsrc
Size: 1.6MB - Virtual size: 1.6MB