479de486045c103d56f30ec70edc704a_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

479de486045c103d56f30ec70edc704a_JaffaCakes118
Size

1.0MB
MD5

479de486045c103d56f30ec70edc704a
SHA1

cd546be64ff864943a69c3baa83a93e6f3df25a0
SHA256

6802e7255a65ef464db7e000c9b41c313690e4c21a5f31a7881c419a1038cb30
SHA512

32731df44f17775ba0e930d06bd428eb6458b4e0ba7371d184307a2d45300bb6085527bc6f6aeda37dc5409040da69d2a7d3b3a2876d651fb56c21855c3e49d5
SSDEEP

12288:NGM3oaRR8jLRAUvj5hH+FMAzDykCrjPWBS6whmo1Eb3DL0:NGM3jR+TL5txAz+kuPaQhr163D4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
479de486045c103d56f30ec70edc704a_JaffaCakes118

Files

479de486045c103d56f30ec70edc704a_JaffaCakes118
.exe windows:5 windows x86 arch:x86

4bf3384bc58b8af9686312bf588c81f6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalFree
LocalAlloc
FlushFileBuffers
RemoveDirectoryW
DisconnectNamedPipe
GetStartupInfoW
SetFilePointer
GetCurrentDirectoryW
WriteFile
GetCurrentThread
GetTickCount
GetThreadPriority
WaitForSingleObject
GetFileSize
LoadLibraryA
FreeLibrary
PeekNamedPipe
MoveFileW
GetLocaleInfoW
LoadLibraryW
SetThreadPriority
GetTimeZoneInformation
CreateProcessW
GetProcAddress
SetEvent
GlobalFree
GlobalAlloc
GetVersionExW
GlobalLock
GetCurrentProcess
GetSystemTime
FindNextFileW
WideCharToMultiByte
ResetEvent
GetCurrentThreadId
FindFirstFileW
FindClose
SystemTimeToFileTime
CopyFileW
GetTempPathW
CreateDirectoryW
ReadFile
DeleteCriticalSection
WritePrivateProfileStringW
GetTempFileNameW
DeleteFileW
GetFileTime
GetFileAttributesW
Sleep
CloseHandle
GetPrivateProfileStringW
EnterCriticalSection
CreateEventW
LeaveCriticalSection
GetPrivateProfileIntW
InitializeCriticalSection
CreateFileW
GetLastError
SetLastError
MultiByteToWideChar
GetUserDefaultLangID
GetUserDefaultLCID
GetPrivateProfileSectionNamesW
WriteProcessMemory
VirtualFreeEx
SystemTimeToTzSpecificLocalTime
ReadProcessMemory
VirtualAllocEx
CreateThread
ResumeThread
HeapReAlloc
GetComputerNameW
WaitForMultipleObjects
ConnectNamedPipe
GetOverlappedResult
CancelIo
WaitNamedPipeW
GetModuleHandleA
CreateNamedPipeW
GetStdHandle
DuplicateHandle
CreatePipe
CreateMutexW
ReleaseMutex
GetCommandLineW
ProcessIdToSessionId
HeapFree
FindResourceW
Process32FirstW
CreateToolhelp32Snapshot
lstrcpyW
GetProcessHeap
GetEnvironmentVariableW
LockResource
OpenProcess
SizeofResource
WTSGetActiveConsoleSessionId
Process32NextW
HeapAlloc
LoadResource
FileTimeToLocalFileTime
GetDriveTypeW
FileTimeToSystemTime
GetDiskFreeSpaceExW
SetFileAttributesW
SetUnhandledExceptionFilter
GetModuleFileNameW
VirtualQuery
ExitProcess
SetEndOfFile
GetCurrentProcessId
CreateEventA
GlobalUnlock
SetEnvironmentVariableW
GetSystemTimeAsFileTime
GetCommandLineA
GetVersionExA
GetStartupInfoA
VirtualFree
VirtualAlloc
HeapDestroy
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
RaiseException
HeapCreate
GetModuleFileNameA
UnhandledExceptionFilter
TlsGetValue
TlsAlloc
TlsSetValue
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
RtlUnwind
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
TlsFree
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapSize
IsDebuggerPresent
TerminateProcess
InterlockedDecrement
InterlockedIncrement

advapi32

DeleteService
RegQueryInfoKeyW
RegEnumKeyExW
StartServiceW
GetSecurityInfo
LookupAccountNameW
ChangeServiceConfig2W
LsaAddAccountRights
EqualSid
LsaOpenPolicy
QueryServiceObjectSecurity
ChangeServiceConfigW
SetSecurityInfo
SetServiceObjectSecurity
CreateServiceW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
LsaClose
GetUserNameW
RegDeleteValueW
RegOpenKeyW
DuplicateTokenEx
FreeSid
GetSecurityDescriptorDacl
RegEnumValueW
RegSetValueExW
SetEntriesInAclW
AllocateAndInitializeSid
IsValidSecurityDescriptor
GetSecurityDescriptorLength
SetFileSecurityW
GetSidSubAuthority
AdjustTokenPrivileges
RegCreateKeyExW
InitializeAcl
OpenProcessToken
GetAce
LookupPrivilegeValueW
InitializeSid
SetSecurityDescriptorDacl
GetSidLengthRequired
RegRestoreKeyW
RegSetKeySecurity
RegSaveKeyW
InitializeSecurityDescriptor
AddAccessAllowedAce
RegQueryValueExW
SetServiceStatus
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
RegCloseKey
RegOpenKeyExW
RegDeleteKeyW
OpenServiceW
OpenSCManagerW
QueryServiceStatusEx
ControlService
CloseServiceHandle

comctl32

PropertySheetW
ord17
ImageList_Destroy
ImageList_DrawEx
ImageList_GetIconSize
ImageList_ReplaceIcon
ImageList_Create
ImageList_AddMasked
_TrackMouseEvent
CreateToolbarEx
InitCommonControlsEx

comdlg32

GetSaveFileNameW
GetOpenFileNameW

gdi32

DeleteDC
CreateCompatibleBitmap
CreateDIBitmap
CreateCompatibleDC
CreatePatternBrush
TextOutW
CreateRoundRectRgn
GetStockObject
SetBkMode
DeleteObject
SelectObject
MoveToEx
CreateSolidBrush
CreateFontW
CreateFontIndirectW
CreatePen
GetObjectW
SetTextColor
GetCurrentObject
GetTextExtentPoint32W
BitBlt
SetTextAlign
ExtTextOutW
Polyline
SetBrushOrgEx
PolyPolyline
StretchBlt
SetPixel
GetPixel
PolyDraw
PolyTextOutW
SetBkColor
CreateBitmap
LineTo
SetStretchBltMode

msacm32

acmStreamUnprepareHeader
acmStreamSize
acmStreamClose
acmStreamConvert
acmFormatChooseW
acmStreamOpen
acmStreamPrepareHeader

ole32

CoTaskMemFree
CoUninitialize
CoInitialize
CreateStreamOnHGlobal
CoInitializeSecurity
CoTaskMemAlloc
CoCreateInstance

oleaut32

OleLoadPicture
OleLoadPicturePath
SysAllocString
VariantInit
VariantClear

shell32

SHFileOperationW
Shell_NotifyIconW
ShellExecuteExW
SHGetMalloc
ord680
CommandLineToArgvW
SHChangeNotify
SHGetFolderPathW
SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteW

shlwapi

SHDeleteKeyW
SHDeleteEmptyKeyW

user32

WaitForInputIdle
RegisterWindowMessageW
DispatchMessageW
MsgWaitForMultipleObjects
PeekMessageW
SendMessageTimeoutW
TranslateMessage
FindWindowW
LoadIconW
GetPropW
IsCharAlphaW
SetWindowPos
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CallWindowProcW
CloseClipboard
GetMessageW
MapDialogRect
CreateDialogIndirectParamW
DrawTextW
GetDC
GetScrollInfo
FrameRect
DrawIconEx
DefWindowProcW
RegisterClassW
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
DrawStateW
DrawEdge
InflateRect
DrawFocusRect
GetIconInfo
SetWindowWord
EndPaint
LoadBitmapW
BeginPaint
IsWindowEnabled
GetWindowWord
UpdateWindow
EnableWindow
GetFocus
ReleaseCapture
SetCapture
GetCapture
EndDialog
DialogBoxIndirectParamW
ScrollWindowEx
GetSubMenu
IsDialogMessageW
GetKeyState
MapVirtualKeyW
GetKeyNameTextW
ScreenToClient
ModifyMenuW
PostQuitMessage
FlashWindowEx
InsertMenuItemW
GetSystemMenu
InsertMenuW
SetWindowPlacement
FindWindowExW
wsprintfW
GetWindowThreadProcessId
SetMenuItemInfoW
SetClassLongW
GetSysColorBrush
MonitorFromRect
MonitorFromWindow
GetMonitorInfoW
GetActiveWindow
IsWindowVisible
GetSystemMetrics
GetClassNameW
GetClassNameA
CreateDialogParamW
GetCursor
GetParent
SetMenuDefaultItem
SetActiveWindow
IsWindow
SetPropW
GetDlgCtrlID
KillTimer
SetForegroundWindow
SetDlgItemInt
GetWindowLongW
TrackPopupMenu
SetWindowTextW
GetMenu
AppendMenuW
IsZoomed
SendMessageW
GetSysColor
SetScrollInfo
SetDlgItemTextW
GetDlgItemTextW
DialogBoxParamW
DestroyWindow
SendDlgItemMessageW
GetDesktopWindow
MoveWindow
FillRect
InvalidateRect
GetClientRect
SetWindowLongW
GetDlgItem
ShowWindow
CreateWindowExW
PostMessageW
EnableMenuItem
DestroyMenu
CheckDlgButton
GetWindowPlacement
GetWindowRect
DeleteMenu
ReleaseDC
SetFocus
IsDlgButtonChecked
MessageBoxW
GetCursorPos
LoadCursorW
RemovePropW
DestroyIcon
SetTimer
SetCursor
ClientToScreen
IsIconic
CreatePopupMenu
MapWindowPoints
LoadImageW
SetWindowRgn
GetWindowDC
GetWindowTextW

winmm

waveOutOpen
waveOutPause
waveOutPrepareHeader
waveInClose
waveOutReset
waveOutGetVolume
waveOutMessage
waveOutClose
waveOutUnprepareHeader
waveOutSetVolume
waveOutWrite
waveOutGetDevCapsW
waveOutGetNumDevs
waveInStart
waveInAddBuffer
waveInMessage
waveInGetDevCapsW
mixerGetLineInfoW
mixerGetLineControlsW
mixerSetControlDetails
mixerGetID
waveInPrepareHeader
waveInUnprepareHeader
waveInReset
waveInOpen
waveInStop
waveInGetNumDevs

ws2_32

closesocket
WSACleanup
htons
gethostbyname
inet_addr
recv
gethostname
gethostbyaddr
WSAStartup
socket
setsockopt
getsockopt
connect
send
ioctlsocket
ntohs
__WSAFDIsSet
WSAGetLastError
select

netapi32

NetUserGetLocalGroups
NetApiBufferFree
NetUserGetInfo
NetQueryDisplayInformation

msimg32

GradientFill

iphlpapi

GetIpAddrTable
GetAdaptersInfo

wininet

InternetAutodialHangup
InternetQueryOptionW
InternetAutodial
InternetGetConnectedState

dnsapi

DnsRecordListFree
DnsQuery_W

Sections

.rdata
Size: 209KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 495KB - Virtual size: 649KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 339KB - Virtual size: 338KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4bf3384bc58b8af9686312bf588c81f6

Headers

File Characteristics

Imports

kernel32

advapi32

comctl32

comdlg32

gdi32

msacm32

ole32

oleaut32

shell32

shlwapi

user32

winmm

ws2_32

netapi32

msimg32

iphlpapi

wininet

dnsapi

Sections

.rdata Size: 209KB - Virtual size: 208KB

.data Size: 495KB - Virtual size: 649KB

.rsrc Size: 339KB - Virtual size: 338KB

.rdata
Size: 209KB - Virtual size: 208KB

.data
Size: 495KB - Virtual size: 649KB

.rsrc
Size: 339KB - Virtual size: 338KB