4c360d332146e838a98ed55a70cc34f9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4c360d332146e838a98ed55a70cc34f9_JaffaCakes118
Size

21.3MB
MD5

4c360d332146e838a98ed55a70cc34f9
SHA1

ea80188b0bf86ea0434f06e1a5277228f58c82b1
SHA256

5ce10c8d568094cfee68320cd5069b7683f8ec50d5fee924b3ddd7d07e7308d2
SHA512

b0f672280c3f5a8892f5ebc155595bf567d1529a101c3e590d033a61266de462fa0711013062c69a4b115e1322f5d3b5099f60ef8c80f892093674714ea76c57
SSDEEP

196608:9uHfLeNqlpsDoawfN44T/OJiyCEd2HdMu/6PtCqVMP:9KLVJT/2fgxyAqV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c360d332146e838a98ed55a70cc34f9_JaffaCakes118

Files

4c360d332146e838a98ed55a70cc34f9_JaffaCakes118
.exe windows:6 windows x64 arch:x64

3daa0a56c71b870d67ad6abff078c8d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\development\irrTech\flace\win32player\x64\Release\win32player.pdb

Imports

kernel32

GetCommandLineW
LoadLibraryA
GetProcAddress
GetModuleFileNameA
GetModuleHandleA
GetModuleFileNameW
WaitForSingleObject
OutputDebugStringA
WriteConsoleW
HeapSize
SetEndOfFile
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
SetStdHandle
FlushFileBuffers
GetTimeZoneInformation
GetConsoleCP
GetFileAttributesExW
CreateProcessA
GetExitCodeProcess
HeapReAlloc
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
CreateDirectoryW
GetStringTypeW
HeapAlloc
HeapFree
ReadConsoleW
GetConsoleMode
GetACP
GetStdHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
PeekNamedPipe
GetFileType
GetFileInformationByHandle
CreateFileW
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindNextFileW
FindFirstFileExW
FindClose
GetModuleHandleExW
ExitProcess
WideCharToMultiByte
GetCurrentDirectoryW
GetCurrentDirectoryA
SetCurrentDirectoryA
SetEnvironmentVariableA
GetFullPathNameA
GetDriveTypeW
ReadFile
EncodePointer
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RaiseException
RtlPcToFileHeader
RtlUnwindEx
ResumeThread
SetThreadPriority
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ExpandEnvironmentStringsA
FormatMessageA
MulDiv
Sleep
GetVersionExA
lstrcmpiA
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThread
GetSystemInfo
GetTickCount
SetThreadAffinityMask
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalMemoryStatus
WinExec
MultiByteToWideChar
GetFullPathNameW
SetErrorMode
VirtualAlloc
VirtualFree
GetSystemTimeAsFileTime
GetSystemTimeAdjustment
GetLastError
SleepEx
SetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateFileA
WriteFile
GetTempPathA
CloseHandle
GlobalFree
LocalAlloc

user32

LoadIconA
MessageBoxA
SendMessageA
RegisterClassA
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
EnumDisplaySettingsA
ChangeDisplaySettingsA
LoadImageA
DispatchMessageA
PeekMessageA
SendMessageTimeoutA
SendMessageTimeoutW
DefWindowProcA
PostQuitMessage
RegisterClassExA
CreateWindowExA
DestroyWindow
ShowWindow
MoveWindow
SetWindowPos
GetWindowPlacement
GetActiveWindow
GetFocus
TranslateMessage
ToAscii
MapVirtualKeyA
GetCapture
SetCapture
ReleaseCapture
GetSystemMetrics
UpdateWindow
SetActiveWindow
SetForegroundWindow
GetDC
ReleaseDC
BeginPaint
EndPaint
GetClientRect
GetWindowRect
AdjustWindowRect
SetCursorPos
SetCursor
GetCursorPos
ClientToScreen
FillRect
SetWindowLongPtrA
LoadCursorA
GetKeyboardState

advapi32

RegQueryValueExA
RegOpenKeyA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegSetValueExA

shell32

CommandLineToArgvW
ShellExecuteExW

shlwapi

PathRelativePathToA

opengl32

glDisableClientState
glDrawArrays
glDrawElements
glEnable
glEnableClientState
glEnd
glFlush
glFogf
glFogfv
glFogi
glFrontFace
glGetBooleanv
glGetError
glGetFloatv
glGetString
glHint
glLightModelfv
glLightModeli
wglCreateContext
wglDeleteContext
wglGetProcAddress
wglMakeCurrent
glAlphaFunc
glBegin
glBindTexture
glBlendFunc
glClear
glClearColor
glClearDepth
glClipPlane
glColor4ub
glColorMask
glColorPointer
glCullFace
glDepthFunc
glDepthMask
glLightf
glTexSubImage2D
glTexImage2D
glGetTexImage
glGenTextures
glDeleteTextures
glCopyTexSubImage2D
glGetIntegerv
glViewport
glVertexPointer
glVertex3f
glVertex2i
glVertex2f
glTranslatef
glTexParameteri
glTexParameterf
glTexGeni
glTexEnvi
glTexEnvf
glTexCoordPointer
glTexCoord2f
glStencilOp
glStencilMask
glStencilFunc
glShadeModel
glScissor
glRectf
glReadPixels
glReadBuffer
glPushMatrix
glPushAttrib
glPopMatrix
glPopAttrib
glPolygonOffset
glPolygonMode
glPointSize
glPixelStorei
glNormalPointer
glMatrixMode
glMaterialfv
glMaterialf
glLoadMatrixf
glLoadIdentity
glLineWidth
glLightfv
glDisable

wsock32

WSAGetLastError
recv
send
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
WSACleanup
socket
__WSAFDIsSet
select
WSASetLastError
recvfrom
sendto
accept
listen
inet_ntoa
gethostname
closesocket
setsockopt
WSAStartup

ws2_32

freeaddrinfo
getaddrinfo

winmm

waveOutPrepareHeader
waveOutWrite
waveOutOpen
timeEndPeriod
timeBeginPeriod
waveOutClose
waveOutUnprepareHeader
waveOutReset

gdi32

GetPixelFormat
DescribePixelFormat
ChoosePixelFormat
TextOutW
GetObjectA
SetTextColor
SetWindowExtEx
SetViewportExtEx
StretchDIBits
SetMapMode
SetPixelFormat
SelectObject
SetPixel
SetBkMode
GetStockObject
Rectangle
GetTextExtentPoint32W
GetDIBits
GetDeviceCaps
DeleteObject
DeleteDC
CreatePen
CreateFontA
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
SwapBuffers

ole32

CoCreateInstance
CoInitialize
CoUninitialize

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 173KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3daa0a56c71b870d67ad6abff078c8d1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

shlwapi

opengl32

wsock32

ws2_32

winmm

gdi32

ole32

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.rdata Size: 1.0MB - Virtual size: 1.0MB

.data Size: 173KB - Virtual size: 183KB

.pdata Size: 153KB - Virtual size: 153KB

.rsrc Size: 47KB - Virtual size: 47KB

.reloc Size: 43KB - Virtual size: 42KB

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: 173KB - Virtual size: 183KB

.pdata
Size: 153KB - Virtual size: 153KB

.rsrc
Size: 47KB - Virtual size: 47KB

.reloc
Size: 43KB - Virtual size: 42KB