5c1f6235d8ad29b60a5ec606d3a546d3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5c1f6235d8ad29b60a5ec606d3a546d3_JaffaCakes118
Size

71KB
MD5

5c1f6235d8ad29b60a5ec606d3a546d3
SHA1

4348efb8ad38a8066f3834bdc13284c50e1ab0f7
SHA256

299175b8592c0241cf91d01654c569d8a78c37b4bb095f6a96b4adf076121b33
SHA512

02be8e108e2e435e3577ac8a0fdf2a724c9c9c9843a48ce078024e589aaa3772eb83987e52fa437641e1630517d6dbb36e5f981889573fba457d7ff516ec05ba
SSDEEP

1536:c5kr8+IqhwW6DWeG6HLH1Sf0WSioNTCenjhUy/G4RuaGjfxYyCpeRV:cWjIcwDw8HE03HVUypRolbCpeRV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5c1f6235d8ad29b60a5ec606d3a546d3_JaffaCakes118

Files

5c1f6235d8ad29b60a5ec606d3a546d3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

af734e2764b51005fc1bd7d5ad8f2089

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ddraw

DirectDrawCreate
DirectDrawCreateEx

shell32

Shell_NotifyIconW
FindExecutableW
CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW
SHAppBarMessage
ShellExecuteExW

secur32

GetUserNameExW

kernel32

UnhandledExceptionFilter
Sleep
LoadLibraryExW
GetVersionExW
MulDiv
IsDebuggerPresent
FormatMessageW
FindResourceW
FreeLibrary
SetUnhandledExceptionFilter
CreateFileW
GetCurrentThreadId
InterlockedIncrement
CloseHandle
CreateEventW
GetModuleFileNameW
GetSystemTimeAsFileTime
InterlockedDecrement
LoadResource
LockResource
InterlockedExchange
EnterCriticalSection
GetSystemInfo
InitializeCriticalSection
GetStartupInfoW
GetThreadLocale
ReleaseMutex
LocalAlloc
LoadLibraryA
GlobalLock
GetSystemDirectoryW
GetACP
OpenProcess
IsProcessorFeaturePresent
LocalFree
RaiseException
VirtualLock
VirtualAlloc
SizeofResource
HeapSetInformation
GetProcAddress
HeapSize
CreateThread
WaitForMultipleObjects
lstrcmpW
GetLocaleInfoW
lstrlenW
GetComputerNameW
SetEvent
LCMapStringW
VirtualUnlock
FindResourceExW
GlobalAlloc
ResetEvent
FlushInstructionCache
MultiByteToWideChar
TerminateProcess
GlobalHandle
GetTickCount
HeapAlloc
ProcessIdToSessionId
WideCharToMultiByte
HeapDestroy
LoadLibraryW
GetCurrentProcess
LeaveCriticalSection
GetLastError
GlobalFree
lstrlenA
VirtualFree
HeapFree
WaitForSingleObject
SetLastError
HeapReAlloc
DeleteCriticalSection
GlobalUnlock
GetProcessId
GetVersionExA
QueryPerformanceCounter
InterlockedCompareExchange
GetLocaleInfoA
CreateMutexW
GetTempPathW
GetModuleHandleW

gdi32

DeleteDC
GetStockObject
GetDeviceCaps
CreateCompatibleDC
DeleteObject
CreateSolidBrush
BitBlt
CreateCompatibleBitmap
SelectObject
GetObjectW

msvcrt

_wcmdln
_cexit
_initterm
?terminate@@YAXXZ
__set_app_type
fabs
memset
__p__commode
_exit
__setusermatherr
memcpy
exit
_controlfp
_wtoi64
__p__fmode
__wgetmainargs
_amsg_exit
iswdigit
_initterm
_XcptFilter

ole32

OleUninitialize
CoGetClassObject
CLSIDFromString
CreateStreamOnHGlobal
CoSetProxyBlanket
StringFromGUID2
OleInitialize
CoCreateInstance
CoTaskMemFree
StringFromCLSID
CoInitializeSecurity
CoTaskMemAlloc
CoUninitialize
CoAllowSetForegroundWindow
OleLockRunning
CoInitializeEx
CLSIDFromProgID
CoCreateGuid

shlwapi

UrlApplySchemeW
PathCombineW
UrlCanonicalizeW
UrlCombineW
UrlGetPartW
PathAppendW

crypt32

CryptUnprotectData
CryptProtectData

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wtsapi32

WTSQuerySessionInformationW
WTSEnumerateSessionsW
WTSUnRegisterSessionNotification
WTSFreeMemory
WTSRegisterSessionNotification

gdiplus

GdipAlloc
GdiplusShutdown
GdipDisposeImage
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromFile
GdipFree
GdipCloneImage
GdiplusStartup
GdipCreateBitmapFromFileICM

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

af734e2764b51005fc1bd7d5ad8f2089

Headers

File Characteristics

Imports

ddraw

shell32

secur32

kernel32

gdi32

msvcrt

ole32

shlwapi

crypt32

version

wtsapi32

gdiplus

Sections

.text Size: 40KB - Virtual size: 39KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 22KB - Virtual size: 22KB

.rsrc Size: 2KB - Virtual size: 2KB

.text
Size: 40KB - Virtual size: 39KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 22KB - Virtual size: 22KB

.rsrc
Size: 2KB - Virtual size: 2KB