5a8fcb36744724b8b8f9e548b14bdd26_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5a8fcb36744724b8b8f9e548b14bdd26_JaffaCakes118
Size

372KB
MD5

5a8fcb36744724b8b8f9e548b14bdd26
SHA1

417b7f25c52de5d8e517e0b6f5ab40cd12065181
SHA256

9077106865acf134048770dd0c2e811588f713a9a5ed31c56e730a5b3b61048f
SHA512

3c3a914bac9a85b7cadf3ebb10c4aa78f62b6afd03682b1c9f626f315cd0caaac908efb7dccf26d53aab1ae3782100cc625716978c8e1e76d238348b9c871808
SSDEEP

6144:mkeLzR+C3SC00zkK3Ss3VuNIk4D2ge+VCB8MI0nXK6AOFnCO5BMD/TSsQLH5Adm:neLNx00zpFYA2I8eM0OFn15eLSsPdm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5a8fcb36744724b8b8f9e548b14bdd26_JaffaCakes118

Files

5a8fcb36744724b8b8f9e548b14bdd26_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5c4d9bbf2b60b50c2abec4c4ee8913ee

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetProcessShutdownParameters
GetModuleFileNameA
CreateProcessA
OpenProcess
LoadLibraryA
GetLastError
DeleteCriticalSection
SetStdHandle
IsBadWritePtr
DuplicateHandle
LeaveCriticalSection
InitializeCriticalSection
GetCurrentProcess
TerminateProcess
EnterCriticalSection
InterlockedIncrement
InterlockedDecrement
ExitProcess
GetTimeZoneInformation
HeapFree
GetLocalTime
RtlUnwind
SetHandleCount
HeapAlloc
UnhandledExceptionFilter
FreeEnvironmentStringsA
FlushFileBuffers
GetEnvironmentStrings
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsBadReadPtr
IsBadCodePtr
SetUnhandledExceptionFilter
GetCPInfo
GetStringTypeW
GetACP
GetStringTypeA
ReadFile
GetOEMCP
GetFileType
GetModuleHandleA
CompareStringA
GetCommandLineA
GetVersion
GetStartupInfoA
SetEnvironmentVariableA
InterlockedExchange
CompareStringW
GetComputerNameA
GetCurrentThreadId
GetCurrentProcessId
GetVersionExA
GlobalUnlock
Sleep
GlobalAlloc
LockResource
GlobalLock
SizeofResource
FindResourceA
LoadResource
GetStdHandle
AllocConsole
CreateMutexA
SetFilePointer
CreateFileA
SetEndOfFile
CloseHandle
WriteFile
MoveFileExA
WriteConsoleA
SystemTimeToFileTime
OutputDebugStringA
FreeLibrary
TlsGetValue
RaiseException
HeapReAlloc
LCMapStringW
HeapSize
LCMapStringA
TlsSetValue
TlsAlloc
SetLastError
HeapCreate
GetEnvironmentVariableA
MultiByteToWideChar
WideCharToMultiByte
GetProcAddress
HeapDestroy
GetSystemTime
VirtualAlloc
VirtualFree

user32

GetDC
DialogBoxParamA
EndDialog
SetForegroundWindow
ReleaseDC
SetDlgItemTextA
GetForegroundWindow
GetWindowLongA
FlashWindow
MessageBeep
SetActiveWindow
GetWindowThreadProcessId
SetWindowLongA
GetKeyboardState
SetTimer
keybd_event
GetThreadDesktop
mouse_event
GetSystemMetrics
MessageBoxA
SetFocus
GetDlgItem
GetMessageA
GetDlgItemTextA
TranslateMessage
PostThreadMessageA
GetProcessWindowStation
OpenInputDesktop
SetThreadDesktop
EnableWindow
GetUserObjectInformationA
ExitWindowsEx
ShowWindow
GetDlgItemInt
SetWindowTextA
SetMenuDefaultItem
SetDlgItemInt
GetSubMenu
LoadStringA
TrackPopupMenu
GetMenuItemID
LoadIconA
EnableMenuItem
DestroyMenu
MapVirtualKeyA
LoadMenuA
VkKeyScanA
GetClipboardData
GetAsyncKeyState
GetClipboardOwner
PostQuitMessage
SendMessageA
DefWindowProcA
EmptyClipboard
IsWindowVisible
OpenClipboard
GetIconInfo
SetClipboardData
CloseClipboard
RegisterClassExA
DrawIconEx
LoadCursorA
OpenDesktopA
CreateWindowExA
SetClipboardViewer
SystemParametersInfoA
EnumDesktopWindows
CloseDesktop
ChangeClipboardChain
FindWindowA
KillTimer
PeekMessageA
DestroyWindow
PostMessageA
WaitMessage
GetCursorPos
WindowFromPoint
GetWindowRect
DispatchMessageA
GetClassNameA
RegisterWindowMessageA

gdi32

GetDeviceCaps
RealizePalette
SelectObject
CreateRectRgn
CombineRgn
DeleteObject
SetRectRgn
OffsetRgn
GdiFlush
BitBlt
CreateDIBSection
GetStockObject
CreatePalette
SelectPalette
GetRgnBox
GetRegionData
SetDIBColorTable
CreateCompatibleDC
CreateCompatibleBitmap
GetDIBits
DeleteDC
GetSystemPaletteEntries

wsock32

WSAGetLastError
recv
send
getpeername
accept
listen
ioctlsocket
connect
htons
htonl
bind
shutdown
closesocket
socket
setsockopt
WSACleanup
WSAStartup
gethostname
gethostbyname
getsockname
inet_addr

shell32

Shell_NotifyIconA

advapi32

CreateServiceA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
SetServiceStatus
RegOpenKeyA
RegDeleteValueA
OpenServiceA
ControlService
QueryServiceStatus
DeleteService
OpenSCManagerA
RegCloseKey
CloseServiceHandle
RegCreateKeyA
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
OpenProcessToken
ImpersonateLoggedOnUser
RevertToSelf
GetUserNameA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA

ole32

CoInitialize
CoCreateInstance

vnchooks

UnSetHooks
SetHooks
SetKeyboardFilterHook
SetMouseFilterHook

othread2

?set_priority@omni_thread@@QAEXW4priority_t@1@@Z
?join@omni_thread@@QAEXPAPAX@Z
?start@omni_thread@@QAEXXZ
?sleep@omni_thread@@SAXKK@Z
?broadcast@omni_condition@@QAEXXZ
?wait@omni_condition@@QAEXXZ
?signal@omni_condition@@QAEXXZ
??1omni_condition@@QAE@XZ
??1omni_thread@@MAE@XZ
?create@omni_thread@@SAPAV1@P6AXPAX@Z0W4priority_t@1@@Z
?create@omni_thread@@SAPAV1@P6APAXPAX@Z0W4priority_t@1@@Z
??1omni_mutex@@QAE@XZ
??0omni_mutex@@QAE@XZ
??0init_t@omni_thread@@QAE@XZ
??0omni_thread@@IAE@PAXW4priority_t@0@@Z
?post@omni_semaphore@@QAEXXZ
?wait@omni_semaphore@@QAEXXZ
??0omni_semaphore@@QAE@I@Z
?unlock@omni_mutex@@QAEXXZ
?lock@omni_mutex@@QAEXXZ
??0omni_condition@@QAE@PAVomni_mutex@@@Z
?start_undetached@omni_thread@@IAEXXZ

Exports

Exports

??0omni_mutex_lock@@QAE@AAVomni_mutex@@@Z
??0omni_semaphore_lock@@QAE@AAVomni_semaphore@@@Z
??0omni_thread_fatal@@QAE@H@Z
??1omni_mutex_lock@@QAE@XZ
??1omni_semaphore_lock@@QAE@XZ
??4init_t@omni_thread@@QAEAAV01@ABV01@@Z
??4omni_thread_fatal@@QAEAAV0@ABV0@@Z
??4omni_thread_invalid@@QAEAAV0@ABV0@@Z
??_Fomni_semaphore@@QAEXXZ
??_Fomni_thread@@QAEXXZ
??_Fomni_thread_fatal@@QAEXXZ
?acquire@omni_mutex@@QAEXXZ
?id@omni_thread@@QAEHXZ
?priority@omni_thread@@QAE?AW4priority_t@1@XZ
?release@omni_mutex@@QAEXXZ
?run@omni_thread@@EAEXPAX@Z
?run_undetached@omni_thread@@EAEPAXPAX@Z
?state@omni_thread@@QAE?AW4state_t@1@XZ

Sections

.text
Size: 168KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 132KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5c4d9bbf2b60b50c2abec4c4ee8913ee

Headers

File Characteristics

Imports

kernel32

user32

gdi32

wsock32

shell32

advapi32

ole32

vnchooks

othread2

Exports

Exports

Sections

.text Size: 168KB - Virtual size: 165KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 44KB - Virtual size: 50KB

.rsrc Size: 132KB - Virtual size: 129KB

.text
Size: 168KB - Virtual size: 165KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 44KB - Virtual size: 50KB

.rsrc
Size: 132KB - Virtual size: 129KB