5dc79ea85103a7367e93ff093de46f72_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5dc79ea85103a7367e93ff093de46f72_JaffaCakes118
Size

138KB
MD5

5dc79ea85103a7367e93ff093de46f72
SHA1

fe4954e136ae435c9c67fcf52133b787124cb62f
SHA256

1e1064018a5af3811072495363bc46937f3b5d2f00b9339e37ddfc51fce30956
SHA512

f720b47a3c8669cd189d35ae1b7fed39c49cc8b112c8f399cb15562e7222b82da2b1c5e44a2cc87e30082aa5e2388626b9a7a5cc5687f28caafbea5e4c350315
SSDEEP

3072:ibE/i0zB3d0jqHu6KS9VWCvrlMbSCyaPYey2OCdIkCtMMGrSz:ibE/dzB3d0CK6+Awy2bSkS3Gr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5dc79ea85103a7367e93ff093de46f72_JaffaCakes118

Files

5dc79ea85103a7367e93ff093de46f72_JaffaCakes118
.exe windows:5 windows x86 arch:x86

958c7d9a79f3f7306c4e64357a61a11e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReleaseMutex
CloseHandle
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
LocalFree
GetSystemTime
WriteProcessMemory
SetFileAttributesW
CreateThread
ExpandEnvironmentStringsW
SetEvent
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
ResetEvent
CreateEventW
CreateRemoteThread
Process32FirstW
Process32NextW
GetCurrentThreadId
ExitProcess
GetCommandLineW
SetErrorMode
GetComputerNameW
GetVersionExW
GetFileAttributesExW
GetFileTime
DuplicateHandle
GetCurrentProcessId
GetNativeSystemInfo
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpiA
WTSGetActiveConsoleSessionId
MoveFileExW
GetUserDefaultUILanguage
TlsGetValue
TlsSetValue
TerminateProcess
GlobalLock
GlobalUnlock
GetLocalTime
GetThreadContext
SetThreadContext
GetProcessId
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
GetFileAttributesW
HeapCreate
CreateToolhelp32Snapshot
VirtualProtect
FindNextFileW
lstrcmpiW
WaitForMultipleObjects
RemoveDirectoryW
LoadLibraryA
FindClose
VirtualAllocEx
HeapDestroy
VirtualProtectEx
VirtualAlloc
GetProcAddress
SetLastError
GetLastError
OpenMutexW
GetFileSizeEx
GetTempPathW
FlushFileBuffers
MultiByteToWideChar
CreateFileW
GetTimeZoneInformation
ReadFile
OpenEventW
Thread32Next
ReadProcessMemory
LoadLibraryW
VirtualFreeEx
WideCharToMultiByte
Thread32First
OpenProcess
WriteFile
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualFree
GetTickCount
GetModuleHandleW
CreateDirectoryW
HeapFree
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
FreeLibrary
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
SetThreadPriority
Sleep
GetCurrentThread
GetModuleFileNameW
WaitForSingleObject

user32

DefFrameProcA
OpenInputDesktop
BeginPaint
GetUpdateRect
RegisterClassExW
GetClipboardData
GetDCEx
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
DefDlgProcA
DefMDIChildProcA
RegisterClassW
CallWindowProcA
CallWindowProcW
DefWindowProcW
DefFrameProcW
DefDlgProcW
GetSystemMetrics
CharLowerW
ExitWindowsEx
GetMessageA
GetWindowRect
GetMessageW
SetCapture
GetProcessWindowStation
GetParent
GetWindowInfo
GetClassLongW
GetCapture
SetCursorPos
RegisterWindowMessageW
GetMenuItemID
CreateWindowStationW
SetKeyboardState
GetSubMenu
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
GetMenuItemCount
HiliteMenuItem
EndMenu
GetShellWindow
MapVirtualKeyW
CharLowerBuffA
GetKeyboardState
ToUnicode
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
OpenDesktopW
CloseDesktop
RegisterClassExA
SetThreadDesktop
CloseWindowStation
RegisterClassA
GetUserObjectInformationW
GetWindowDC
FillRect
DrawEdge
DispatchMessageW
GetWindow
IntersectRect
PostThreadMessageW
EqualRect
PrintWindow
GetAncestor
PeekMessageA
SetWindowPos
GetCursorPos
IsWindow
ReleaseCapture
SendMessageW
MapWindowPoints
GetMessagePos
GetWindowThreadProcessId
IsRectEmpty
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharToOemW
GetDC
DrawIcon
GetIconInfo
EndPaint
GetUpdateRgn
PostMessageW
SendMessageTimeoutW
SetWindowLongW
CharUpperW
ReleaseDC
PeekMessageW
CharLowerA
GetWindowLongW
TranslateMessage
OpenWindowStationW

advapi32

CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
GetLengthSid
IsWellKnownSid
ConvertSidToStringSidW
EqualSid
RegEnumKeyExW
InitiateSystemShutdownExW

shlwapi

PathIsDirectoryW
UrlUnescapeA
PathIsURLW
StrStrIW
StrStrIA
StrCmpNIW
PathRenameExtensionW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveBackslashW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
wvnsprintfW
PathQuoteSpacesW

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

CreateCompatibleDC
SetRectRgn
SaveDC
DeleteDC
SetViewportOrgEx
RestoreDC
SelectObject
CreateDIBSection
GetDeviceCaps
GetDIBits
DeleteObject
GdiFlush
CreateCompatibleBitmap

ws2_32

WSASetLastError
freeaddrinfo
socket
bind
recv
setsockopt
shutdown
getsockname
recvfrom
sendto
getpeername
WSASend
WSAEventSelect
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
closesocket
send
listen
accept
WSAGetLastError

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData

wininet

HttpAddRequestHeadersA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
HttpQueryInfoA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

958c7d9a79f3f7306c4e64357a61a11e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 130KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 130KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB