4581c658c8f57903019f70a0c188ca93_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4581c658c8f57903019f70a0c188ca93_JaffaCakes118
Size

1.2MB
MD5

4581c658c8f57903019f70a0c188ca93
SHA1

0ddc7feee3af83c94ffd896d60ebe6eb11ac8291
SHA256

176cfe51cbb49f33445176d4cfb67062aa7dc26c9601dc8247a9a983761f9ed0
SHA512

a9870692fbe2da8e2c785d67b84a7d40e5567232f288ab4ec7cb89c7f6c3a36230b6ca2d367383df292b97f8d55f06c38245d161de2c54fa6b1e5c4e71c1d541
SSDEEP

24576:XZSv1X0FWT2avJ+5YTm6kYsp37TaG8hysS/v1f:JSvB3r+CyYCTaQf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4581c658c8f57903019f70a0c188ca93_JaffaCakes118

Files

4581c658c8f57903019f70a0c188ca93_JaffaCakes118
.exe windows:5 windows x86 arch:x86

ca2c30e23fbf0f92c528d7635b8247cc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

recv
socket
sendto
__WSAFDIsSet
closesocket
getsockopt
WSASetLastError
ioctlsocket
getprotobyname
send
WSAGetLastError
htons
gethostbyname
WSAStartup
recvfrom
shutdown
ntohs
inet_addr
connect
bind
select
inet_ntoa
getservbyname
WSACleanup

winhttp

WinHttpOpen
WinHttpReadData
WinHttpReceiveResponse
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpConnect
WinHttpCrackUrl
WinHttpSendRequest
WinHttpSetStatusCallback
WinHttpQueryDataAvailable

version

VerQueryValueA

kernel32

WideCharToMultiByte
RaiseException
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
WaitForSingleObject
SetEvent
CreateEventA
SetThreadPriority
MultiByteToWideChar
lstrlenW
EnterCriticalSection
LeaveCriticalSection
GetLastError
InterlockedIncrement
InterlockedDecrement
lstrlenA
lstrcmpiA
IsDBCSLeadByte
FreeLibrary
LoadLibraryExA
GetModuleHandleA
GetModuleFileNameA
TerminateProcess
OpenProcess
GetCurrentProcessId
DeleteFileA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetFileAttributesExA
Sleep
FindClose
FindNextFileA
FindFirstFileA
GetWindowsDirectoryA
MoveFileExA
GetFileAttributesA
TryEnterCriticalSection
GetVersionExA
GetCurrentProcess
ResetEvent
HeapFree
GetProcessHeap
FlushInstructionCache
GetCurrentThreadId
SetLastError
lstrcmpA
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
SetFilePointer
ReadFile
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetHandleCount
HeapCreate
GetStdHandle
WriteFile
IsValidCodePage
GetOEMCP
GetCPInfo
GetDateFormatA
GetTimeFormatA
FindResourceExA
SetStdHandle
RemoveDirectoryA
GetFileType
PeekNamedPipe
GetTimeZoneInformation
GetStartupInfoA
GetCommandLineA
SetEnvironmentVariableA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualProtect
CreateThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
GetSystemTimeAsFileTime
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapAlloc
HeapDestroy
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GlobalFree
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
FindNextFileW
ResumeThread
TlsFree
TlsAlloc
DuplicateHandle
GetProcessAffinityMask
GetThreadPriority
WaitForMultipleObjects
InterlockedExchangeAdd
TlsSetValue
GetCurrentThread
TlsGetValue
SetThreadContext
FindResourceA
LoadResource
LockResource
SizeofResource
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
SetEndOfFile
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CreateFileW
CompareStringW
GetThreadContext
GetFileInformationByHandle
CreateFileA
MoveFileA
WritePrivateProfileStringA
SetFileAttributesA
GetShortPathNameA
FindFirstFileW
GetFullPathNameA
LoadLibraryA
GetProcAddress
HeapCompact
CreateDirectoryA
ExitProcess

user32

PostMessageA
SetTimer
KillTimer
MessageBoxA
SendMessageA
ExitWindowsEx
RegisterWindowMessageA
SetForegroundWindow
SetWindowLongA
DefWindowProcA
CallWindowProcA
LoadMenuA
DestroyMenu
SetMenuDefaultItem
GetMonitorInfoA
MonitorFromPoint
UnregisterClassA
TrackPopupMenu
GetWindowLongA
CharNextA
GetSubMenu
GetCursorPos
LoadImageA
GetSystemMetrics
CharLowerA
CreateWindowExA
SetWindowTextA
MoveWindow
GetWindowRect
GetClientRect
SetFocus
GetParent
IsWindow
GetClassInfoExA
ShowWindow
PostQuitMessage
InvalidateRgn
GetWindowTextLengthA
GetWindowTextA
IsWindowEnabled
EnableWindow
CreateAcceleratorTableA
GetFocus
GetWindow
DestroyAcceleratorTable
BeginPaint
EndPaint
FillRect
ReleaseCapture
GetClassNameA
GetDlgItem
IsChild
SetCapture
RedrawWindow
LoadCursorA
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
SetWindowPos
GetSysColor
RegisterClassExA
GetDesktopWindow
DestroyWindow
GetMessageA
TranslateMessage
DispatchMessageA
SetLayeredWindowAttributes

gdi32

BitBlt
GetStockObject
GetObjectA
CreateSolidBrush
GetDeviceCaps
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject

advapi32

RegDeleteKeyA
RegEnumKeyA
RegQueryValueExA
RegFlushKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA

shell32

ShellExecuteExW
Shell_NotifyIconA

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoSetProxyBlanket
CoUninitialize
CoInitialize
CoInitializeSecurity
StringFromGUID2
OleLockRunning
CoGetClassObject
CLSIDFromProgID
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CLSIDFromString

oleaut32

VariantCopy
LoadTypeLi
GetErrorInfo
SysFreeString
SysAllocString
VariantInit
VariantClear
VarUI4FromStr
VariantChangeType
SysAllocStringLen
SysStringLen
VarBstrCat
SysStringByteLen
OleCreateFontIndirect
LoadRegTypeLi

iphlpapi

GetNetworkParams

shlwapi

StrStrA

Sections

.text
Size: 697KB - Virtual size: 696KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 356KB - Virtual size: 356KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ca2c30e23fbf0f92c528d7635b8247cc

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

winhttp

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

iphlpapi

shlwapi

Sections

.text Size: 697KB - Virtual size: 696KB

.rdata Size: 356KB - Virtual size: 356KB

.data Size: 47KB - Virtual size: 65KB

.rsrc Size: 101KB - Virtual size: 101KB

.text
Size: 697KB - Virtual size: 696KB

.rdata
Size: 356KB - Virtual size: 356KB

.data
Size: 47KB - Virtual size: 65KB

.rsrc
Size: 101KB - Virtual size: 101KB