4354f81f88568499f974222bae5e4ba5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4354f81f88568499f974222bae5e4ba5_JaffaCakes118
Size

549KB
MD5

4354f81f88568499f974222bae5e4ba5
SHA1

b97e9152189b786b5fb18fba20d28d8732bdf76e
SHA256

8695110fc30e9c6a3d4c934ae43b3900dbf0d19b16637c99d4034fe0499bbe33
SHA512

1a16e38fab0756d07439a7821136e4330e6211128fadc5a163bbdc09f6ead7136f9429eae82dd7465c18dae9150a3ccc36cf93b62c5769f6e9595f095fb4e9fc
SSDEEP

12288:4+pBk8Zl8MemNCRcRr2yJrA5Fa7UD4gxou7:4+pBk8ZmmQcNrA5F0kJxJ7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4354f81f88568499f974222bae5e4ba5_JaffaCakes118

Files

4354f81f88568499f974222bae5e4ba5_JaffaCakes118
.exe windows:5 windows x86 arch:x86

eed813332091fc5dce24af6f83964ff8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Projects\LightInstaller\branch\SI\Release\LightInstaller.pdb

Imports

ws2_32

WSAStartup
WSAGetLastError
closesocket
listen
bind
htons
gethostbyname
socket
gethostname
connect
accept
send
recv

wininet

HttpQueryInfoA
FtpCommandA
FtpFindFirstFileA
InternetGetCookieA
InternetCreateUrlA
InternetCanonicalizeUrlA
InternetCrackUrlA
FtpSetCurrentDirectoryA
HttpEndRequestA
InternetGetLastResponseInfoA
InternetQueryOptionA
InternetAutodial
InternetCloseHandle
InternetWriteFile
InternetSetOptionA
HttpSendRequestExA
InternetReadFile
HttpSendRequestA
InternetOpenA
InternetConnectA
HttpOpenRequestA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

gdiplus

GdipCloneImage
GdipLoadImageFromFile
GdipDisposeImage
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageRectI
GdipGetImageWidth
GdipGetImageHeight

kernel32

SetLastError
GetCurrentProcess
FlushInstructionCache
GetProcAddress
GetModuleHandleA
InitializeCriticalSection
DeleteCriticalSection
GetTempPathA
GetFileAttributesA
DeleteFileA
RemoveDirectoryA
Sleep
GetFileSizeEx
CreateProcessA
WaitForSingleObject
CloseHandle
WideCharToMultiByte
MultiByteToWideChar
FindResourceA
LoadResource
SizeofResource
LockResource
GetModuleFileNameA
LoadLibraryA
lstrcatA
CreateFileA
GetCurrentProcessId
TerminateProcess
GetLocalTime
SystemTimeToFileTime
FileTimeToDosDateTime
FreeLibrary
lstrlenA
lstrcmpiA
IsDBCSLeadByte
lstrlenW
LoadLibraryExA
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
SetUnhandledExceptionFilter
LocalFree
CreateDirectoryA
CopyFileA
GetFileAttributesW
CreateDirectoryW
SetFilePointer
SetEndOfFile
FormatMessageA
CreateFileW
ReadFile
WriteFile
GetModuleFileNameW
GetFileSize
GlobalAlloc
GlobalLock
GlobalUnlock
RaiseException
lstrcpyA
GetCurrentDirectoryA
CompareStringA
SetFileAttributesA
SetFileTime
MoveFileA
CreateThread
GetFileTime
GetExitCodeThread
TerminateThread
GetTickCount
CreateMutexA
ReleaseMutex
QueryPerformanceCounter
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
EncodePointer
DecodePointer
VirtualProtect
GetModuleHandleW
GetSystemInfo
GetCurrentThreadId
VirtualQuery
ExitThread
GetCommandLineA
HeapSetInformation
GetStartupInfoW
LeaveCriticalSection
EnterCriticalSection
GetLastError
MulDiv
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwind
UnhandledExceptionFilter
IsDebuggerPresent
HeapSize
ExitProcess
HeapReAlloc
HeapCreate
GetStdHandle
GetCPInfo
GetACP
GetOEMCP
LCMapStringW
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetSystemTimeAsFileTime
LoadLibraryW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleW
FlushFileBuffers
InterlockedPushEntrySList
GlobalFree
InterlockedCompareExchange

user32

KillTimer
SetTimer
UpdateWindow
CharNextA
DialogBoxParamA
InvalidateRect
InflateRect
wsprintfA
GetActiveWindow
GetDC
DestroyWindow
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
CallWindowProcA
IsWindowEnabled
GetWindow
GetKeyState
ReleaseCapture
GetCapture
SetCapture
CharLowerA
DispatchMessageA
PeekMessageA
TranslateMessage
CopyRect
SetFocus
GetWindowLongA
DrawFocusRect
GetFocus
GetSysColorBrush
FillRect
GetSysColor
SetCursor
PtInRect
GetCursorPos
DefWindowProcA
SetRectEmpty
EndDialog
SetDlgItemTextA
LoadIconA
SetWindowLongA
CreateWindowExA
LoadCursorA
GetClassInfoExA
RegisterClassExA
SetWindowPos
ReleaseDC
DrawTextA
GetWindowDC
EndPaint
GetClientRect
BeginPaint
EnableWindow
MoveWindow
PostMessageA
MessageBoxA
GetWindowTextA
GetParent
ScreenToClient
GetWindowRect
SetWindowTextA
ShowWindow
SendMessageA
GetDlgItem
UnregisterClassA
IsWindow

gdi32

BitBlt
CreateDCA
GetPixel
CreateCompatibleBitmap
LineTo
MoveToEx
CreatePen
GetTextMetricsA
SelectObject
CreateFontIndirectA
CreateSolidBrush
SetBkColor
GetTextExtentPoint32A
GetObjectA
CreateCompatibleDC
GetDeviceCaps
DeleteDC
SetTextColor
GetStockObject
SetBkMode
DeleteObject

advapi32

RegCreateKeyExA
RegCloseKey
RegSetValueExA
RegDeleteKeyA
RegQueryValueExA
RegDeleteValueA
RegEnumKeyExA
RegQueryInfoKeyW
RegOpenKeyExA

shell32

Shell_NotifyIconA
SHGetFolderPathA
ShellExecuteA

ole32

CoUninitialize
CoCreateGuid
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
StringFromCLSID
CLSIDFromProgID
CoGetClassObject
CoGetMalloc
OleRun
CoInitialize

oleaut32

VarUI4FromStr

comctl32

PropertySheetA
CreatePropertySheetPageA
DestroyPropertySheetPage

Sections

.text
Size: 326KB - Virtual size: 326KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 106KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eed813332091fc5dce24af6f83964ff8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

wininet

version

gdiplus

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

Sections

.text Size: 326KB - Virtual size: 326KB

.rdata Size: 76KB - Virtual size: 75KB

.data Size: 11KB - Virtual size: 19KB

.rsrc Size: 106KB - Virtual size: 105KB

.reloc Size: 25KB - Virtual size: 24KB

.text
Size: 326KB - Virtual size: 326KB

.rdata
Size: 76KB - Virtual size: 75KB

.data
Size: 11KB - Virtual size: 19KB

.rsrc
Size: 106KB - Virtual size: 105KB

.reloc
Size: 25KB - Virtual size: 24KB