4d5619c7b20502b5a6ed7cab78babd20_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

4d5619c7b20502b5a6ed7cab78babd20_JaffaCakes118
Size

138KB
MD5

4d5619c7b20502b5a6ed7cab78babd20
SHA1

19f19de324f778d9b98e2cd06c55f010c8c19f7a
SHA256

7afa7aff36a78078ebb4bee395edd54351df462734dacdc11a16a1910661f121
SHA512

9e52dc3d653e9f355395903dfde8b2695080a6483ebce6e16661f7f014c4af7a9fec621e18f82c8a7d7e6b1595fd24757e2091bbc21cf26706b7d80e2c520986
SSDEEP

3072:Ci78XAmw/TcEHON5k/+eWaP+D8BlnqV2/AtdICRNIhIG5FQPL:Ci78wZ/gXn/eWaP+D8LWqhIGFQPL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d5619c7b20502b5a6ed7cab78babd20_JaffaCakes118

Files

4d5619c7b20502b5a6ed7cab78babd20_JaffaCakes118
.exe windows:5 windows x86 arch:x86

0f2f393909993ff250457526415fabb4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsBadReadPtr
SetFileTime
VirtualQueryEx
OpenProcess
Thread32First
WideCharToMultiByte
ReadProcessMemory
HeapDestroy
HeapCreate
Thread32Next
ReadFile
GetTimeZoneInformation
MultiByteToWideChar
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
VirtualProtectEx
VirtualAllocEx
FindClose
RemoveDirectoryW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetModuleHandleW
FileTimeToLocalFileTime
GetProcessHeap
DeleteFileW
GetFileInformationByHandle
WriteProcessMemory
ResetEvent
GetCommandLineW
SetErrorMode
GetComputerNameW
GetModuleFileNameW
OpenEventW
DuplicateHandle
GetCurrentProcessId
TlsGetValue
TlsSetValue
TerminateProcess
MoveFileExW
GetUserDefaultUILanguage
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
CreateRemoteThread
Process32FirstW
Process32NextW
GetFileAttributesExW
GetProcessId
VirtualFree
HeapFree
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
SetEndOfFile
FindFirstFileW
CreateMutexW
VirtualAlloc
VirtualFreeEx
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
LoadLibraryA
CreateThread
GetLocalTime
GetVersionExW
GetNativeSystemInfo
GetSystemTime
LocalFree
GetPrivateProfileIntW
FlushFileBuffers
WriteFile
GetVolumeNameForVolumeMountPointW
GetPrivateProfileStringW
SetThreadContext
GetThreadContext
GlobalUnlock
GlobalLock
ReleaseMutex
GetCurrentThreadId
SetLastError
GetTickCount
ExpandEnvironmentStringsW
SetFileAttributesW
lstrcmpiW
WTSGetActiveConsoleSessionId
GetProcAddress
CreateFileW
GetFileAttributesW
Sleep
LoadLibraryW
SetEvent
CreateDirectoryW
FreeLibrary
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CloseHandle
WaitForMultipleObjects
CreateEventW
lstrcmpiA
SetThreadPriority
GetCurrentThread
GetFileTime
WaitForSingleObject

user32

DispatchMessageW
DrawIcon
GetIconInfo
EndPaint
GetUpdateRgn
RegisterClassExA
GetWindowDC
DefDlgProcW
DefFrameProcA
OpenInputDesktop
BeginPaint
GetUpdateRect
GetDC
RegisterClassExW
GetDCEx
ReleaseDC
DefWindowProcA
GetWindow
SwitchDesktop
DefDlgProcA
DefMDIChildProcA
RegisterClassW
CallWindowProcA
CallWindowProcW
DefWindowProcW
GetThreadDesktop
RegisterClassA
MapVirtualKeyW
CharLowerW
TranslateMessage
GetKeyboardState
RegisterWindowMessageW
GetMenuItemID
SetProcessWindowStation
SetKeyboardState
GetSubMenu
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
GetMenuItemCount
HiliteMenuItem
EndMenu
GetShellWindow
FillRect
DrawEdge
IntersectRect
PostThreadMessageW
EqualRect
PrintWindow
GetSystemMetrics
CloseWindowStation
CreateWindowStationW
CharUpperW
GetProcessWindowStation
CreateDesktopW
DefMDIChildProcW
OpenDesktopW
SetWindowLongW
SetThreadDesktop
GetUserObjectInformationW
CharLowerBuffA
CharToOemW
OpenWindowStationW
GetTopWindow
LoadImageW
GetClipboardData
ToUnicode
GetMessageA
GetWindowRect
GetMessageW
SetCapture
PostMessageW
GetParent
GetWindowInfo
GetClassLongW
GetCapture
SetCursorPos
GetWindowLongW
GetAncestor
PeekMessageW
PeekMessageA
SetWindowPos
GetCursorPos
MsgWaitForMultipleObjects
WindowFromPoint
CharLowerA
DefFrameProcW
ExitWindowsEx
IsRectEmpty
GetWindowThreadProcessId
GetMessagePos
MapWindowPoints
SendMessageW
ReleaseCapture
IsWindow
SendMessageTimeoutW
CloseDesktop

advapi32

EqualSid
InitiateSystemShutdownExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
ConvertSidToStringSidW
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegSetValueExW
CryptHashData
IsWellKnownSid
GetLengthSid

shlwapi

PathIsURLW
StrCmpNIW
PathRenameExtensionW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveBackslashW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
StrStrIW
StrStrIA
PathQuoteSpacesW
PathRemoveFileSpecW

shell32

ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

CreateCompatibleDC
SetRectRgn
SaveDC
DeleteDC
SetViewportOrgEx
RestoreDC
SelectObject
CreateDIBSection
GetDeviceCaps
GetDIBits
DeleteObject
GdiFlush
CreateCompatibleBitmap

ws2_32

sendto
select
getaddrinfo
recvfrom
getpeername
send
closesocket
WSASend
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
WSAGetLastError
shutdown
setsockopt
bind
socket
WSASetLastError
recv
freeaddrinfo
WSAEventSelect
getsockname
accept
listen

crypt32

CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData
PFXExportCertStoreEx

wininet

HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
InternetQueryOptionA
InternetSetOptionA
InternetQueryOptionW
HttpSendRequestW
InternetReadFile
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetCrackUrlA
InternetConnectA
HttpQueryInfoA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0f2f393909993ff250457526415fabb4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 129KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 129KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB