59e561e580799037a642ab04d02775f9_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

59e561e580799037a642ab04d02775f9_JaffaCakes118
Size

388KB
MD5

59e561e580799037a642ab04d02775f9
SHA1

78ccf38d82ab9f662f84cd427c2079f3c7edf97b
SHA256

a61b169505928f54c8bf0f1094d1d0aca94306f90f39f31be99d08c8a647725f
SHA512

b86ffb516d5177cd7808485459d60270abcbf13b47ebe1612e7678f4e2e327537af211e21da3bb46c9d7ada560307fa3389cc24f7ed58e4f50243bb577f55b6d
SSDEEP

3072:f4iyKjYyGIBiHpUJQQZ18jXyfDtGue+KRnSak6Jyjw:sCFBise2ATRnSak68j

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
59e561e580799037a642ab04d02775f9_JaffaCakes118

Files

59e561e580799037a642ab04d02775f9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5a31549bedcf0d5a0cb54d0e04da8c7f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

h:\work\PP\tags\1.1.0.1\_release\PP.pdb

Imports

wininet

InternetCloseHandle
InternetSetOptionA
InternetOpenA
HttpQueryInfoA
InternetConnectA
InternetReadFile
InternetQueryOptionA
InternetOpenUrlA

user32

SetWindowLongA
GetWindowLongA
SystemParametersInfoA
SendMessageA
SetWindowTextA
SetWindowPos
GetWindowRect
GetClientRect
BeginPaint
GetMessageA
PeekMessageA
CharNextA
TranslateMessage
DispatchMessageA
RegisterWindowMessageA
GetWindowTextLengthA
GetWindowTextA
CreateAcceleratorTableA
GetDesktopWindow
GetFocus
GetWindow
DestroyAcceleratorTable
ReleaseCapture
GetClassNameA
GetDlgItem
GetParent
SetCapture
RedrawWindow
InvalidateRgn
UnregisterClassA
ScreenToClient
ClientToScreen
MoveWindow
GetSysColor
LoadIconA
CallWindowProcA
RegisterClassExA
CreateWindowExA
DefWindowProcA
PostThreadMessageA
LoadBitmapA
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
SetForegroundWindow
DestroyWindow
LoadCursorA
GetClassInfoExA
DrawTextA
FillRect
IsWindow
IsChild
SetFocus
SetActiveWindow
IsWindowVisible
ShowWindow
InvalidateRect
UpdateWindow
ReleaseDC
GetDC
EndPaint

ole32

CLSIDFromProgID
CLSIDFromString
CoGetClassObject
OleInitialize
OleUninitialize
OleLockRunning
StringFromGUID2
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CreateStreamOnHGlobal
CoTaskMemAlloc

oleaut32

DispCallFunc
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
VariantInit
SysStringByteLen
SysAllocStringLen
SysStringLen
VariantClear
SysAllocString
VarUI4FromStr
SysFreeString

kernel32

FreeEnvironmentStringsA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetCPInfo
IsDebuggerPresent
TerminateProcess
ExitProcess
HeapCreate
GetEnvironmentStrings
TlsSetValue
TlsAlloc
TlsGetValue
GetStdHandle
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoA
GetCommandLineA
RtlUnwind
VirtualQuery
GetSystemInfo
VirtualProtect
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
SetFilePointer
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
TlsFree
FindResourceA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcAddress
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapAlloc
HeapDestroy
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
GetProcessHeap
HeapFree
CreateProcessA
GetSystemDirectoryA
GetTempFileNameA
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
CloseHandle
InterlockedExchange
MultiByteToWideChar
WideCharToMultiByte
GetLastError
lstrlenW
lstrcmpiA
lstrlenA
RaiseException
InitializeCriticalSection
DeleteCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceExA
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
IsDBCSLeadByte
FreeLibrary
LoadLibraryExA
GetModuleHandleA
GetModuleFileNameA
CreateFileA
WriteFile
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
SetLastError
lstrcmpA
MulDiv

advapi32

RegDeleteKeyA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteValueA

shell32

ShellExecuteA

shlwapi

StrStrIA
PathRemoveFileSpecA

gdi32

DeleteDC
SelectObject
DeleteObject
GetObjectA
CreateFontA
SetStretchBltMode
SetTextColor
Rectangle
BitBlt
StretchBlt
GetTextExtentPoint32A
CreateSolidBrush
GetStockObject
CreateCompatibleBitmap
GetDeviceCaps
CreateCompatibleDC

Sections

.text
Size: 120KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 224KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5a31549bedcf0d5a0cb54d0e04da8c7f

Headers

File Characteristics

PDB Paths

Imports

wininet

user32

ole32

oleaut32

kernel32

advapi32

shell32

shlwapi

gdi32

Sections

.text Size: 120KB - Virtual size: 117KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 12KB - Virtual size: 16KB

.rsrc Size: 224KB - Virtual size: 224KB

.text
Size: 120KB - Virtual size: 117KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 12KB - Virtual size: 16KB

.rsrc
Size: 224KB - Virtual size: 224KB