5bffb1cfc3818cf5c46b8df33624079b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5bffb1cfc3818cf5c46b8df33624079b_JaffaCakes118
Size

403KB
MD5

5bffb1cfc3818cf5c46b8df33624079b
SHA1

5da9a53a520f0d685f415f956ea9c881fa6371ac
SHA256

c9a601cb62051acc8d67ec3c7ef11995849f1cc21b3eb4137d049924399c331c
SHA512

5f643312d30a34b9237d479e84d63f9aecbdc4c56948e282291e7bcbffd248c01fe31f741c7b7f28e20047027cc75feaad396a92130c022fd2f9bd451bf9c614
SSDEEP

6144:YEyYYWO35H+GMOndcHaHtnfDs4cjHYqQCLazNxGB9tOxJ3dVQdCXnlG1SS7Q1v:YEY+GMOne6HRQ5aktgJ3/QdQlTC6v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5bffb1cfc3818cf5c46b8df33624079b_JaffaCakes118

Files

5bffb1cfc3818cf5c46b8df33624079b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

38d968b98e54bb380c348e2ba9e4dfd6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\ToolsBuild\16.2.0.7719\source\release\MicrogamingInstall.pdb

Imports

kernel32

OutputDebugStringA
ReleaseMutex
TerminateProcess
GetVersionExA
RemoveDirectoryW
GetProcAddress
GetVolumePathNameW
Process32First
CreateDirectoryW
ReadFile
DeleteFileW
GetModuleFileNameW
WideCharToMultiByte
FindNextFileA
GetComputerNameA
SetFilePointer
GetModuleHandleA
CopyFileW
MultiByteToWideChar
lstrcpyA
lstrlenA
lstrcpynA
lstrcpynW
GetFileAttributesW
lstrlenW
GetPrivateProfileStringW
WriteFile
LoadLibraryA
LocalFree
FreeLibrary
GetDriveTypeA
GetVolumeInformationA
DeviceIoControl
SetEvent
CreateFileMappingA
GetExitCodeThread
WaitForMultipleObjects
MapViewOfFile
UnmapViewOfFile
CreateThread
CreateEventA
GetLastError
SetEndOfFile
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
CreateSemaphoreA
FindFirstFileA
ReleaseSemaphore
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileType
SetHandleCount
HeapSize
HeapCreate
HeapDestroy
VirtualAlloc
VirtualFree
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
DeleteCriticalSection
GetStdHandle
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
RtlUnwind
GetFileSize
CreateDirectoryA
Process32Next
GetFileAttributesA
FormatMessageA
GetLocalTime
CreateToolhelp32Snapshot
FormatMessageW
CreateMutexA
FindClose
GetModuleFileNameA
WaitForSingleObject
CopyFileA
CreateProcessA
OpenProcess
RemoveDirectoryA
DeleteFileA
GetTempFileNameA
lstrcmpiA
GetTempPathA
GetCurrentProcessId
CloseHandle
CreateProcessW
Sleep
CreateFileA
CreateFileW
RaiseException
GetStartupInfoA
GetProcessHeap
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
HeapReAlloc
HeapFree
GetCurrentThreadId
ExitThread
HeapAlloc
ExitProcess

user32

TranslateMessage
GetMessageA
IsDialogMessageA
GetDlgCtrlID
LoadCursorA
AdjustWindowRect
ReleaseDC
EnableWindow
PeekMessageA
UpdateWindow
PostMessageA
IsWindowEnabled
GetSystemMetrics
SetWindowLongW
RegisterClassW
GetWindowLongW
MessageBoxW
LoadIconA
DispatchMessageA
InvalidateRect
CreateWindowExW
SetWindowLongA
DefWindowProcW
OffsetRect
GetWindowDC
ChildWindowFromPoint
GetWindowRect
RegisterClassA
CreateWindowExA
DestroyWindow
DefWindowProcA
SetWindowPos
ShowWindow
EnumDisplayDevicesA
MessageBoxA
wvsprintfA
GetActiveWindow
SetFocus
CopyRect
PostThreadMessageA
EnumDisplaySettingsA
SetWindowTextA
wsprintfW
GetDC
MapWindowPoints
wsprintfA

gdi32

CreateCompatibleDC
DeleteDC
CreateDIBSection
GetDIBits
DeleteObject
SelectObject
GetDeviceCaps
BitBlt

advapi32

RegSetValueA
RegQueryValueW
RegEnumKeyW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegSetValueW
FreeSid
RegOpenKeyExA
GetUserNameA
RegCloseKey
RegCreateKeyExA
RegQueryValueExA
OpenSCManagerA
CloseServiceHandle
RegSetValueExA
OpenServiceA

shell32

SHGetSpecialFolderLocation
SHChangeNotify
SHGetPathFromIDListW
SHGetFolderPathW
ShellExecuteA
SHGetMalloc

ole32

CoCreateInstance
CoCreateGuid
CoTaskMemAlloc
CoUninitialize
CoInitialize
OleInitialize
CLSIDFromProgID
OleCreate
OleSetContainedObject
CoTaskMemFree
StringFromIID
OleUninitialize

oleaut32

SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
VariantCopy
VariantChangeType
SysAllocStringLen
SysFreeString
SysStringLen
VariantClear
VariantInit
SysAllocString

psapi

GetModuleFileNameExA

wsock32

recv
WSAStartup
closesocket
send
gethostbyname
socket
htons
inet_ntoa
connect
ioctlsocket
select
WSAGetLastError
WSACleanup

wininet

InternetOpenUrlA
InternetQueryDataAvailable
HttpQueryInfoA
InternetOpenA
InternetCrackUrlA
InternetCrackUrlW
InternetCloseHandle
InternetGetLastResponseInfoA
InternetOpenW
InternetOpenUrlW
InternetConnectA
HttpSendRequestA
HttpAddRequestHeadersA
InternetGetConnectedState
HttpOpenRequestA
InternetCombineUrlA
InternetReadFile

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

shlwapi

UrlGetPartA
PathAppendA
SHDeleteKeyA
PathCanonicalizeW
PathAppendW

sensapi

IsNetworkAlive

urlmon

CoInternetGetSession

Sections

.text
Size: 180KB - Virtual size: 178KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

38d968b98e54bb380c348e2ba9e4dfd6

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

psapi

wsock32

wininet

version

shlwapi

sensapi

urlmon

Sections

.text Size: 180KB - Virtual size: 178KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 36KB - Virtual size: 60KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 180KB - Virtual size: 178KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 36KB - Virtual size: 60KB

.rsrc
Size: 4KB - Virtual size: 3KB