41fa13b14983597afc545108632ad197_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

41fa13b14983597afc545108632ad197_JaffaCakes118
Size

2.8MB
MD5

41fa13b14983597afc545108632ad197
SHA1

fbd7a07e1a18bb6e6852ae7c87acaa4e39ff2463
SHA256

41daf275ecf253d9923ead4f61ee8e7099bf26830750b773641bafe066722075
SHA512

9ca03a2bddbf2967ac65189e96598f900bdb71123f9ee938a476456a1c13c717942f85faab935a0244733aaf394483511fc19b575e122ab7aeeab5dead801b77
SSDEEP

49152:cmGpf81pdXzOmUYDCGFS6t/10TF7p10+u8OJVFFf4SD:cnIpdXPUYDTAE/S30+KFf7D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41fa13b14983597afc545108632ad197_JaffaCakes118

Files

41fa13b14983597afc545108632ad197_JaffaCakes118
.exe windows:5 windows x86 arch:x86

8e09dff2a6cd6a152bc607e30578690d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\SVNStorage\Projects\CIS_53_STD\Release\x32\Symbols\cfpupdat.pdb

Imports

kernel32

SetEnvironmentVariableA
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetDriveTypeA
GetCurrentDirectoryA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
GetDateFormatA
GetTimeFormatA
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
SetThreadContext
GetThreadContext
FlushInstructionCache
LocalSize
lstrcpynW
GetExitCodeThread
ResetEvent
EnumResourceTypesW
EnumResourceNamesW
LoadLibraryExA
GetCPInfo
GetTimeZoneInformation
QueryPerformanceCounter
VirtualFree
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
RtlUnwind
UnhandledExceptionFilter
VirtualQuery
VirtualAlloc
HeapReAlloc
HeapSize
CreateThread
ExitThread
GetStartupInfoW
FindResourceExW
GetFileTime
GetFileSizeEx
GetCurrentDirectoryW
GlobalFlags
GlobalGetAtomNameW
GetModuleHandleA
VirtualProtect
FileTimeToSystemTime
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
SetErrorMode
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetThreadLocale
GlobalFindAtomW
CompareStringW
GetVersionExA
GlobalAddAtomW
SetThreadPriority
GlobalDeleteAtom
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
lstrcmpW
LoadLibraryA
SetLastError
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalFree
FreeResource
InterlockedCompareExchange
SetThreadLocale
lstrcmpiW
LoadLibraryExW
InterlockedDecrement
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
TerminateThread
GetExitCodeProcess
GetTempFileNameW
GetTempPathW
FindNextFileW
GetSystemInfo
SizeofResource
GetLogicalDriveStringsW
QueryDosDeviceW
ExpandEnvironmentStringsW
FindClose
FindFirstFileW
GetVersionExW
GetModuleHandleW
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
GetFileAttributesW
InterlockedIncrement
CopyFileW
MoveFileExW
OpenEventW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
MoveFileW
WriteFile
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
DeleteFileW
lstrcpyW
GetCurrentProcessId
GetCurrentThreadId
IsDebuggerPresent
lstrcatW
RaiseException
GetModuleFileNameW
SetUnhandledExceptionFilter
CreateProcessW
LocalAlloc
GetCurrentThread
GetTickCount
GetFileSize
HeapDestroy
HeapCreate
GetProcAddress
LoadLibraryW
CreateFileW
HeapFree
HeapAlloc
GetProcessHeap
ReadFile
SetFilePointer
CreateEventW
SetEvent
CreateDirectoryW
GetCurrentProcess
ResumeThread
SuspendThread
WaitForSingleObject
Sleep
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
LocalFree
FormatMessageW
ExitProcess
GetLastError
CreateMutexW
CloseHandle
FindResourceW
LoadResource
LockResource

user32

SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
CreateWindowExW
GetClassInfoExW
RegisterClassW
GetSysColor
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
PtInRect
GetMenu
SetWindowLongW
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowThreadProcessId
TrackPopupMenu
TrackPopupMenuEx
ScrollWindow
MapWindowPoints
GetMessagePos
GetMessageTime
UnhookWindowsHookEx
GetTopWindow
EndDeferWindowPos
BeginDeferWindowPos
GetLastActivePopup
ShowOwnedPopups
SetCursor
SetWindowsHookExW
CallNextHookEx
GetForegroundWindow
GetWindowTextW
GetWindowTextLengthW
SetFocus
RemovePropW
GetPropW
SetPropW
GetClassNameW
GetClassLongW
GetCapture
IsChild
WinHelpW
SendDlgItemMessageA
SendDlgItemMessageW
RegisterWindowMessageW
PostMessageW
EnableWindow
SendMessageW
RedrawWindow
SetTimer
GetSystemMenu
AppendMenuW
PostQuitMessage
IsWindowVisible
MessageBoxW
KillTimer
LoadIconW
IsWindow
ShowWindow
ExitWindowsEx
GetAsyncKeyState
IsIconic
DestroyIcon
FindWindowW
SendMessageTimeoutW
GetSystemMetrics
CharNextW
GetParent
GetWindow
GetDesktopWindow
ReleaseDC
GetDC
FillRect
GetWindowRect
GetClientRect
GetClassInfoW
LoadStringW
MapDialogRect
InflateRect
IsDialogMessageW
SetWindowTextW
MoveWindow
GetMenuItemInfoW
DestroyMenu
SystemParametersInfoW
CharUpperW
UnregisterClassW
IsRectEmpty
DrawIcon
SetWindowRgn
ClientToScreen
SetCapture
LoadCursorW
ReleaseCapture
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
GetWindowDC
BeginPaint
EndPaint
GetSysColorBrush
SetRect
CopyAcceleratorTableW
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
IsClipboardFormatAvailable
WindowFromPoint
WaitMessage
DeleteMenu
SetRectEmpty
TranslateAcceleratorW
BringWindowToTop
CreatePopupMenu
InsertMenuItemW
LoadAcceleratorsW
UpdateWindow
InvalidateRect
GetMessageW
TranslateMessage
DispatchMessageW
LoadImageW
OffsetRect
GetSubMenu
GetKeyState
PeekMessageW
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
ModifyMenuW
GetMenuItemCount
InsertMenuW
GetMenuItemID
GetMenuStringW
TranslateMDISysAccel
ReuseDDElParam
UnpackDDElParam
RegisterClipboardFormatW
SetParent
UnionRect
PostThreadMessageW
GetDCEx
GetKeyboardLayoutList
LockWindowUpdate
GetKeyboardState
ToUnicodeEx
SetCursorPos
HideCaret
ShowCaret
IsMenu
GetCursor
GetTabbedTextExtentA
GetWindowRgn
GetMenuDefaultItem
GetDoubleClickTime
SetClassLongW
DrawFocusRect
InvertRect
EnumWindows
IsWindowUnicode
GetWindowLongA
SetWindowLongA
DrawIconEx
CreateIconIndirect
CopyIcon
GetIconInfo
DrawStateW
LoadMenuIndirectW
LookupIconIdFromDirectoryEx
CreateIconFromResourceEx
DrawMenuBar
DrawFrameControl
DrawEdge
RegisterClassA
DefMDIChildProcW
DefMDIChildProcA
EnableMenuItem
CheckMenuItem
MapVirtualKeyW
CopyRect
LoadMenuW
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetWindowLongW
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
SetWindowContextHelpId
SetWindowPos
GetMenuState
SetMenuDefaultItem
EnableScrollBar
CallWindowProcA
DefWindowProcA
DefFrameProcA
DefFrameProcW
DefDlgProcA
DefDlgProcW

gdi32

SetRectRgn
CombineRgn
GetMapMode
CreateFontW
StretchDIBits
CreateCompatibleBitmap
EnumFontFamiliesExW
GetTextColor
GetBkColor
CreatePatternBrush
DeleteDC
ExtSelectClipRgn
PolyBezierTo
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutW
RectVisible
GetCharWidthW
GetPixel
GetWindowExtEx
GetViewportExtEx
GetDeviceCaps
CreateFontIndirectW
GetObjectW
DeleteObject
CreateRectRgnIndirect
PatBlt
CreateBitmap
GetClipBox
SetTextColor
SetBkColor
CreateCompatibleDC
BitBlt
ExtTextOutW
GetTextExtentPoint32W
CreateEllipticRgn
DPtoLP
LPtoDP
Ellipse
SaveDC
RestoreDC
SetBkMode
SetStretchBltMode
SetMapMode
ExcludeClipRect
IntersectClipRect
GetTextMetricsW
GetRgnBox
CreateSolidBrush
CreatePen
GetObjectType
PtVisible
GetStockObject
StretchBlt
CreateDIBSection
SetPixel
GetDIBits
Polygon
GetCurrentObject
OffsetRgn
GetTextCharsetInfo
SetBrushOrgEx
CreatePalette
CreateDIBitmap
ExtCreateRegion
Polyline
GetViewportOrgEx
GetTextAlign
GetTextExtentPoint32A
StrokePath
FillPath
StrokeAndFillPath
EndPath
CloseFigure
BeginPath
GetBitmapBits
PtInRegion
CreatePolygonRgn
RoundRect
GetWindowOrgEx
LineTo
MoveToEx
SelectClipRgn
GetClipRgn
CreateRectRgn
SelectPalette

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

RegCreateKeyExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegSetValueExW
QueryServiceStatus
OpenSCManagerW
OpenServiceW
ChangeServiceConfigW
CloseServiceHandle
QueryServiceConfigW
StartServiceW
OpenThreadToken
DuplicateToken
AllocateAndInitializeSid
InitializeSecurityDescriptor
RegQueryValueW
RegOpenKeyW
RegEnumKeyW
RegFlushKey
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
SetNamedSecurityInfoW
AddAccessAllowedAceEx
InitializeSid
RegQueryValueExW
FreeSid
AccessCheck
IsValidSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
RegOpenKeyExW

shell32

Shell_NotifyIconW
SHGetFolderPathW
ord165
ShellExecuteW
ord727
SHGetFileInfoW
ShellExecuteExW
DragFinish
DragQueryFileW

comctl32

ImageList_ReplaceIcon
ImageList_Add
ImageList_Remove
ImageList_DrawIndirect
ImageList_GetImageInfo
ImageList_GetBkColor
_TrackMouseEvent
FlatSB_GetScrollProp
ImageList_GetImageCount
ImageList_Destroy
ImageList_DrawEx
ImageList_GetIconSize
InitCommonControlsEx

shlwapi

PathAppendW
PathRemoveExtensionW
PathFindFileNameW
PathRemoveFileSpecW
PathQuoteSpacesW
PathStripPathW
PathAddBackslashW
SHDeleteKeyW
PathStripToRootW
PathIsUNCW
PathFindExtensionW

oledlg

OleUIBusyW
OleUIAddVerbMenuW

ole32

OleInitialize
CoFreeUnusedLibraries
OleUninitialize
OleRun
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoRevokeClassObject
CoDisconnectObject
OleIsCurrentClipboard
CreateStreamOnHGlobal
CoTaskMemRealloc
CoTaskMemAlloc
CLSIDFromProgID
CoUninitialize
CoInitialize
CLSIDFromString
StringFromGUID2
CoCreateGuid
CoTaskMemFree
CoCreateInstance
OleFlushClipboard
CoRegisterMessageFilter
CoGetClassObject

oleaut32

OleLoadPicturePath
VarUdateFromDate
VariantChangeTypeEx
OleCreateFontIndirect
LoadTypeLi
VarBstrFromDate
SafeArrayDestroy
VariantCopy
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocStringByteLen
VarDateFromStr
VarUI4FromStr
SysStringByteLen
VariantClear
VariantInit
VariantChangeType
SysAllocString
SysAllocStringLen
SysStringLen
SysFreeString
SystemTimeToVariantTime
VariantTimeToSystemTime

dbghelp

ImageDirectoryEntryToData
MiniDumpWriteDump

fltlib

FilterConnectCommunicationPort
FilterSendMessage

imagehlp

ImageEnumerateCertificates
ImageGetCertificateData
ImageGetCertificateHeader

crypt32

CertVerifyCertificateChainPolicy
CertGetCertificateChain
CryptUnprotectData
CertFreeCertificateContext
CertGetNameStringW
CryptProtectData
CryptVerifyMessageSignature
CertFreeCertificateChain

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WinVerifyTrust

msi

ord224

winmm

PlaySoundW

ws2_32

ntohs
htons

mpr

WNetGetUniversalNameW

gdiplus

GdiplusStartup
GdipCreateFromHDC
GdipDeleteGraphics
GdiplusShutdown
GdipFree
GdipAlloc
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipDrawImageRectI
GdipGetImageWidth
GdipGetImageHeight
GdipDisposeImage
GdipCloneImage

wininet

HttpSendRequestW
HttpOpenRequestW
InternetWriteFile
InternetReadFile
HttpSendRequestExW
InternetOpenW
InternetQueryOptionW
InternetCloseHandle
InternetSetOptionW
InternetGetLastResponseInfoW
HttpEndRequestW
HttpQueryInfoW
InternetConnectW

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 514KB - Virtual size: 514KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 38KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 547KB - Virtual size: 546KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.trdata
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8e09dff2a6cd6a152bc607e30578690d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

dbghelp

fltlib

imagehlp

crypt32

wintrust

msi

winmm

ws2_32

mpr

gdiplus

wininet

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 514KB - Virtual size: 514KB

.data Size: 38KB - Virtual size: 76KB

.rsrc Size: 547KB - Virtual size: 546KB

.trdata Size: 80KB - Virtual size: 80KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 514KB - Virtual size: 514KB

.data
Size: 38KB - Virtual size: 76KB

.rsrc
Size: 547KB - Virtual size: 546KB

.trdata
Size: 80KB - Virtual size: 80KB