5cd711986e86debe6713107f7bb92ee5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5cd711986e86debe6713107f7bb92ee5_JaffaCakes118
Size

92KB
MD5

5cd711986e86debe6713107f7bb92ee5
SHA1

a61916488a0b9f875d384822ddd1e20b3941cd69
SHA256

5c5e1fde330342a226a9115c81b7e700ea703e330309dd37aadcdf311bfe4ad0
SHA512

69cada418ccc34f1473c3c600fb57ebe30b04e809a42d695317786bd9432ffe2bd2a6b833d1d9d22c7a078e1c10b72b9ecfd286bbdf89168ff57ddfffdc26b0b
SSDEEP

1536:8EN0StqhGM6TUgHRYNntYzDLsWT0HQrWO5K8ghtfxapGpIkz/FUyklp:l0+qhGhTUWOK/sK0HQCCKlhtfxaQpfUJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5cd711986e86debe6713107f7bb92ee5_JaffaCakes118

Files

5cd711986e86debe6713107f7bb92ee5_JaffaCakes118
.exe windows:6 windows x86 arch:x86

39ffd653303861b3373fdacc91301f95

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

ie4uinit.pdb

Imports

advapi32

RegCloseKey
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegEnumValueW
RegSetValueW
RegDeleteKeyW
GetLengthSid
GetNamedSecurityInfoW
SetNamedSecurityInfoW
OpenProcessToken
AddAccessAllowedAceEx
ConvertStringSidToSidW

kernel32

LoadLibraryW
SetErrorMode
GetSystemDirectoryW
GetVersionExW
CloseHandle
WriteFile
SizeofResource
CreateFileW
LockResource
LoadResource
FindResourceW
SetFileAttributesW
GetFileAttributesW
Sleep
GetTickCount
CreateProcessW
DeleteFileW
lstrcmpW
FindFirstFileExW
FindClose
FindNextFileW
FindFirstFileW
SetCurrentDirectoryW
FreeLibrary
GetShortPathNameW
GetSystemDefaultUILanguage
CreateDirectoryW
WaitForSingleObject
ExpandEnvironmentStringsW
CompareStringOrdinal
InterlockedDecrement
GetTempFileNameW
GetTempPathW
SetLastError
FindResourceExW
IsWow64Process
GetNativeSystemInfo
GetPrivateProfileStringW
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
GetModuleFileNameW
LocalFree
LocalAlloc
GetModuleHandleW
GetProcAddress
GetVersion
GetEnvironmentVariableW
GetLastError
lstrlenW
GetCurrentDirectoryW
MapViewOfFile
CreateFileMappingW
GetLocaleInfoW
UnmapViewOfFile
GetUserDefaultUILanguage
SearchPathW
LoadLibraryExW

user32

BlockInput
UnhookWinEvent
SetTimer
GetShellWindow
LoadStringW
PostMessageW
GetMenuItemInfoW
GetMenuItemCount
DestroyMenu
CreatePopupMenu
SendInput
GetCursorPos
SystemParametersInfoW
PostQuitMessage
SetWinEventHook
KillTimer
DispatchMessageW
GetMessageW

msvcrt

??1type_info@@UAE@XZ
iswalpha
wcschr
??3@YAXPAX@Z
??2@YAPAXI@Z
_time64
_vsnwprintf
iswctype
memcpy
wcsncmp
_wcsnicmp
_wcsicmp
bsearch
memcpy_s
wcsrchr
fclose
swscanf_s
fgetws
_controlfp
_except_handler4_common
?terminate@@YAXXZ
memset
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_CxxThrowException
_wfopen_s

shell32

SHGetSpecialFolderPathW
SHSetLocalizedName
SHParseDisplayName
SHGetFolderPathW
SHBindToParent
ord190
ord526
ord165
SHChangeNotify
SHGetSpecialFolderLocation
ord155
SHGetDesktopFolder

ole32

OleUninitialize
CoTaskMemFree
PropVariantClear
CoCreateInstance
CoUninitialize
CoInitializeEx
OleInitialize

ieadvpack

RegRestoreAllW
ExecuteCabW
RunSetupCommandW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

shlwapi

SHRegGetUSValueW
PathIsNetworkPathW
PathCombineW
SHRegGetValueW
SHRegDeleteUSValueW
ord388
StrStrW
ord225
PathRemoveExtensionW
PathFindFileNameW
PathRemoveBlanksW
SHDeleteValueW
SHSetValueW
StrCmpIW
SHGetValueW
SHStrDupW
SHRegSetUSValueW
PathFileExistsW
StrStrIW
ord158
ord437
StrCmpNIW
SHDeleteKeyW
SHCopyKeyW

iertutil

ord650
ord39
ord33
ord57
ord654

oleacc

AccessibleObjectFromEvent

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

Sections

.text
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

39ffd653303861b3373fdacc91301f95

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

shell32

ole32

ieadvpack

version

shlwapi

iertutil

oleacc

oleaut32

Sections

.text Size: 63KB - Virtual size: 63KB

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 23KB - Virtual size: 24KB

.text
Size: 63KB - Virtual size: 63KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 23KB - Virtual size: 24KB