4ad86ec2daec5aa4ed641e2c0fe2ea6c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4ad86ec2daec5aa4ed641e2c0fe2ea6c_JaffaCakes118
Size

227KB
MD5

4ad86ec2daec5aa4ed641e2c0fe2ea6c
SHA1

59a589f53a54a3a88268e5acc64c41ac02c4bbf4
SHA256

8590d1a0698f114a7166812837bc2d8c8c0ed2fd74d8019b9b1827d7707b185f
SHA512

0c59deebbd07d093cdfb9fd3b500258254f035ecc180a141aa52388139eac11b7a5be02a82c8f34bd625b9b6a77fc323125b4834095e453c13df4bf2aebb1d96
SSDEEP

6144:MIpWjeXHByh7NXyKp62y9hcr6uX5zpfW69/0J:M6Wa3Ofpshcr6uXVpdR0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ad86ec2daec5aa4ed641e2c0fe2ea6c_JaffaCakes118

Files

4ad86ec2daec5aa4ed641e2c0fe2ea6c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

8a42cee706caf48886472149aac62304

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcessId
OpenProcess
MoveFileA
DeleteFileA
GetModuleFileNameA
GetCommandLineA
Sleep
GetLocalTime
MultiByteToWideChar
GetTickCount
GetCurrentThreadId
lstrlenW
lstrcmpiA
WideCharToMultiByte
RaiseException
FlushInstructionCache
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcmpA
MulDiv
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
DeleteCriticalSection
SetEvent
InterlockedDecrement
InitializeCriticalSection
IsProcessorFeaturePresent
InterlockedCompareExchange
ReadFile
GetProcessHeap
SetEndOfFile
LoadLibraryA
GetTempPathA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSectionAndSpinCount
CreateFileA
SetFilePointer
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
GetStdHandle
VirtualFree
HeapCreate
ExitProcess
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetConsoleMode
GetConsoleCP
WriteFile
GetStartupInfoA
HeapFree
CreateDirectoryA
RemoveDirectoryA
CreateMutexA
ExpandEnvironmentStringsA
lstrcpyA
lstrcatA
lstrlenA
GetFileAttributesExA
GetModuleHandleA
DuplicateHandle
GetCurrentProcess
GetExitCodeProcess
GetProcAddress
CreateRemoteThread
GetLastError
CloseHandle
SetLastError
WaitForSingleObject
CreateThread
RtlUnwind
ExitThread
HeapAlloc
HeapReAlloc
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
VirtualProtect
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
ResumeThread

user32

SetLayeredWindowAttributes
SetWindowPos
MessageBoxA
wsprintfA
LoadBitmapA
FillRect
IsWindowVisible
BringWindowToTop
PeekMessageA
TranslateMessage
DispatchMessageA
SetWindowLongA
ClientToScreen
MoveWindow
IsWindow
GetWindowRect
GetFocus
WindowFromPoint
GetForegroundWindow
GetCursorPos
GetWindowThreadProcessId
AttachThreadInput
FindWindowExA
DefWindowProcA
ShowWindow
GetWindowLongA
PostThreadMessageA
DestroyWindow
GetDlgItem
InvalidateRgn
InvalidateRect
SetCapture
ReleaseCapture
ScreenToClient
CreateAcceleratorTableA
GetDC
GetDesktopWindow
ReleaseDC
CharNextA
GetParent
GetClassNameA
RedrawWindow
IsChild
SetFocus
GetWindow
GetSysColor
DestroyAcceleratorTable
SendMessageA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
RegisterWindowMessageA
GetClassInfoExA
LoadCursorA
RegisterClassExA
EndPaint
BeginPaint
CallWindowProcA
GetClientRect
CreateWindowExA
UnregisterClassA

gdi32

CreateSolidBrush
DeleteObject
CreateCompatibleBitmap
GetStockObject
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
GetObjectA
GetDeviceCaps

advapi32

RegDeleteValueA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA

shell32

ShellExecuteA

ole32

CoUninitialize
CoInitialize
OleLockRunning
CoTaskMemAlloc
StringFromGUID2
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoInitializeEx
CoCreateInstance

oleaut32

VariantClear
VariantInit
SysFreeString
LoadRegTypeLi
LoadTypeLi
SysStringLen
DispCallFunc
SysAllocString
SysAllocStringLen
OleCreateFontIndirect

shlwapi

PathGetArgsA
StrStrIW
StrToIntA
UrlUnescapeA
PathIsDirectoryA
PathRemoveBlanksA
PathRemoveFileSpecA
PathFindFileNameA
PathFileExistsA

ws2_32

htons
ioctlsocket
connect
select
__WSAFDIsSet
closesocket
send
recv
gethostbyname
WSAStartup
socket

netapi32

Netbios

psapi

EnumProcesses
GetModuleFileNameExA

Sections

.text
Size: 155KB - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8a42cee706caf48886472149aac62304

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

netapi32

psapi

Sections

.text Size: 155KB - Virtual size: 155KB

.rdata Size: 42KB - Virtual size: 41KB

.data Size: 8KB - Virtual size: 16KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 17KB - Virtual size: 17KB

.text
Size: 155KB - Virtual size: 155KB

.rdata
Size: 42KB - Virtual size: 41KB

.data
Size: 8KB - Virtual size: 16KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 17KB - Virtual size: 17KB