41ee526c64a0a85ab12349b7255b9301_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

41ee526c64a0a85ab12349b7255b9301_JaffaCakes118
Size

275KB
MD5

41ee526c64a0a85ab12349b7255b9301
SHA1

bc9bc603cc0873c0e24433b0024b023b3bae7be6
SHA256

09225dc241799ccb727c8b0b38ae8c42318a9fd2bc889b7427fa4c892a3e8241
SHA512

c3427236b64013a928fa7575d2a03a6dc10e0fb2b986d3366a5f7be127fa457a9384162a144463a8364fdb974285b550786a4699cbdd36b0602c84673d411eee
SSDEEP

6144:wzpA/HtqNP5w1JTPTBQJNh+EWDrXjEJRsQZUt2:wiZJB2NWrXjEJE2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41ee526c64a0a85ab12349b7255b9301_JaffaCakes118

Files

41ee526c64a0a85ab12349b7255b9301_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e07cfd65ceb0356d3097b8dc9c43ec88

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlInitUnicodeString

comdlg32

WantArrows

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

oleaut32

VarUI4FromStr
SysStringLen
SysStringByteLen
SysFreeString
VariantClear
SysAllocStringByteLen
SysAllocString
LoadTypeLi
LoadRegTypeLi
VariantCopy
VariantInit
SysAllocStringLen

advapi32

RegSetValueExW
UnregisterTraceGuids
TraceEvent
RegisterTraceGuidsW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
CloseServiceHandle

gdi32

GetDIBits
GetDeviceCaps
GetLayout
GetObjectA
GetObjectW
GetRegionData
GetStockObject
GetWorldTransform
ModifyWorldTransform
OffsetRgn
PatBlt
RealizePalette
SelectObject
SelectPalette
SetBkColor
SetDIBitsToDevice
SetGraphicsMode
SetLayout
SetWorldTransform
GetClipRgn
BitBlt
CombineTransform
CreateCompatibleDC
CreateDIBSection
CreateRectRgn
CreateRectRgnIndirect
CreateSolidBrush
DeleteDC
DeleteObject
ExtCreateRegion
ExtTextOutW

kernel32

ReleaseMutex
ReleaseSemaphore
SetEvent
SetLastError
SetThreadExecutionState
SetThreadPriority
SetUnhandledExceptionFilter
SizeofResource
Sleep
SystemTimeToFileTime
TerminateProcess
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
lstrcmpiW
lstrcpynW
lstrlenW
CloseHandle
CompareStringW
CopyFileW
CreateDirectoryW
CreateEventW
CreateFileMappingW
CreateFileW
CreateMutexW
CreateSemaphoreW
CreateThread
DeleteCriticalSection
DeleteFileW
DisableThreadLibraryCalls
EnterCriticalSection
EnumUILanguagesW
FindResourceExW
FindResourceW
FlushInstructionCache
FormatMessageW
FreeLibrary
FreeLibraryAndExitThread
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeThread
GetFileAttributesExW
GetFileAttributesW
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemDirectoryW
GetSystemTime
GetSystemTimeAsFileTime
GetTempFileNameW
GetTempPathW
GetTickCount
GetUserDefaultUILanguage
GetVersion
GetVersionExA
GetVersionExW
GlobalAlloc
GlobalFree
GlobalLock
GlobalMemoryStatusEx
GlobalUnlock
HeapAlloc
HeapFree
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalAlloc
LocalFree
LockResource
MoveFileExW
MulDiv
MultiByteToWideChar
OutputDebugStringA
PulseEvent
QueryPerformanceCounter
RaiseException

user32

EnumDisplayDevicesW
EnumDisplayMonitors
EnumDisplaySettingsW
FillRect
FindWindowW
GetActiveWindow
GetAncestor
GetCapture
GetClassInfoExW
GetClassLongW
GetClientRect
GetCursor
GetCursorPos
GetDC
GetDesktopWindow
GetDlgCtrlID
GetFocus
GetForegroundWindow
GetKeyState
GetMenuItemCount
GetMenuItemID
GetMenuItemInfoW
GetMessagePos
GetMessageW
GetMonitorInfoW
GetNextDlgGroupItem
GetNextDlgTabItem
GetParent
GetProcessDefaultLayout
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMetrics
GetWindow
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
InflateRect
InsertMenuItemW
InsertMenuW
IntersectRect
InvalidateRect
IsChild
IsDialogMessageW
IsIconic
IsRectEmpty
IsWindow
IsWindowEnabled
IsWindowVisible
IsZoomed
KillTimer
LoadAcceleratorsW
EnumChildWindows
LoadIconW
LoadImageW
LoadMenuW
LoadStringA
LoadStringW
MapWindowPoints
MessageBeep
MessageBoxW
MonitorFromPoint
MonitorFromRect
MoveWindow
MsgWaitForMultipleObjects
NotifyWinEvent
OffsetRect
PeekMessageW
PostMessageW
PostQuitMessage
PostThreadMessageW
PtInRect
RegisterClassExW
RegisterClipboardFormatW
ReleaseCapture
ReleaseDC
RemoveMenu
ScreenToClient
SendMessageW
SetCapture
SetCursor
SetFocus
SetForegroundWindow
SetMenu
SetMenuDefaultItem
SetMenuInfo
SetMenuItemInfoW
SetRect
SetRectEmpty
SetTimer
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowTextW
SetWindowsHookExW
ShowCursor
ShowWindow
SystemParametersInfoW
TrackMouseEvent
TrackPopupMenuEx
TranslateAcceleratorW
TranslateMessage
UnhookWindowsHookEx
UnregisterClassA
UpdateWindow
WindowFromDC
WindowFromPoint
EndPaint
EndMenu
EndDeferWindowPos
EnableWindow
EnableMenuItem
DispatchMessageW
DestroyWindow
DestroyMenu
DeleteMenu
DeferWindowPos
DefWindowProcW
CreateWindowExW
AdjustWindowRectEx
ClientToScreen
ChildWindowFromPointEx
CharNextW
LoadCursorW
CallWindowProcW
CallNextHookEx
BeginPaint
BeginDeferWindowPos
AppendMenuW
AnimateWindow
CreatePopupMenu

shlwapi

StrChrW
SHStrDupW
ord16
PathRenameExtensionW
PathRemoveFileSpecW
PathRemoveExtensionW
PathMatchSpecW
PathIsRootW
PathIsRelativeW
PathIsNetworkPathW
PathIsDirectoryW
PathFindFileNameW
PathFindExtensionW
PathFileExistsW
PathAppendW
PathAddBackslashW
StrStrIW

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleProxyW

shell32

SHGetSpecialFolderPathW
ShellExecuteExW
ShellExecuteW
SHBindToParent
SHAddToRecentDocs
SHGetInstanceExplorer
SHGetFolderPathW
SHGetFileInfoW
SHGetDesktopFolder

ole32

CLSIDFromString
CoAllowSetForegroundWindow
CoCreateInstance
CoGetInterfaceAndReleaseStream
CoInitialize
CoInitializeEx
CoLockObjectExternal
CoMarshalInterThreadInterfaceInStream
CoRegisterClassObject
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoUninitialize
OleFlushClipboard
OleGetClipboard
OleInitialize
OleSetClipboard
OleUninitialize
PropVariantClear
ReleaseStgMedium
StringFromGUID2

Sections

.text
Size: 73KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 155KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e07cfd65ceb0356d3097b8dc9c43ec88

Headers

File Characteristics

Imports

ntdll

comdlg32

version

oleaut32

advapi32

gdi32

kernel32

user32

shlwapi

oleacc

shell32

ole32

Sections

.text Size: 73KB - Virtual size: 76KB

.rdata Size: 155KB - Virtual size: 156KB

.data Size: 14KB - Virtual size: 40KB

.idata Size: 9KB - Virtual size: 11KB

.rsrc Size: 22KB - Virtual size: 23KB

.text
Size: 73KB - Virtual size: 76KB

.rdata
Size: 155KB - Virtual size: 156KB

.data
Size: 14KB - Virtual size: 40KB

.idata
Size: 9KB - Virtual size: 11KB

.rsrc
Size: 22KB - Virtual size: 23KB