606385a2e6cfbb68a58914ffa95a8c15_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

606385a2e6cfbb68a58914ffa95a8c15_JaffaCakes118
Size

336KB
MD5

606385a2e6cfbb68a58914ffa95a8c15
SHA1

2d31695673e4fa7c1e090b14a93d2b982f05a4e2
SHA256

ee74cc755314a258d1f581521843673fdd2e5ccbc38f7f5383975828ac741ca9
SHA512

e117c245358f215027966875e0293bef9783699e47ce5e33be7e8bd0326310abfcfba9596e3a0ac0e2c3675cd9b7a510b1457f79bec6cffc47195a3968e1d5f9
SSDEEP

6144:Pe1ti+Fq9VR1umcY2LXad+1soDtJvQYwO136DtlAoaUfY/vaB5J/pyT:8iCaR1oad+dDtZb1mpfY/vq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
606385a2e6cfbb68a58914ffa95a8c15_JaffaCakes118

Files

606385a2e6cfbb68a58914ffa95a8c15_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e687239a2359b51f02f980d39a359b81

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

ws2_32

recvfrom
recv
ntohs
ioctlsocket
inet_ntoa
inet_addr
htons
htonl
getservbyport
getservbyname
send
gethostbyaddr
connect
closesocket
bind
accept
WSAStringToAddressA
WSAStartup
WSASetLastError
WSAGetLastError
WSACleanup
WSAAsyncSelect
sendto
socket
gethostbyname

kernel32

GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessVersion
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemTime
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetUserDefaultLCID
GetVersion
GetVersionExA
GetVersionExW
GetWindowsDirectoryA
GlobalAddAtomW
GlobalAlloc
GlobalDeleteAtom
GlobalFindAtomW
GlobalFlags
GlobalFree
GlobalGetAtomNameW
GlobalHandle
GlobalLock
GlobalReAlloc
GlobalUnlock
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsBadCodePtr
IsBadReadPtr
IsBadWritePtr
IsValidCodePage
IsValidLocale
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
GetModuleFileNameW
LocalFree
LocalReAlloc
MultiByteToWideChar
RaiseException
ReadFile
ReleaseMutex
RtlUnwind
SetConsoleCtrlHandler
SetEnvironmentVariableA
SetErrorMode
SetEvent
SetFilePointer
SetHandleCount
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
WritePrivateProfileStringW
WriteProfileStringW
lstrcatW
lstrcmpA
lstrcmpW
lstrcmpiA
lstrcmpiW
ExitProcess
lstrcpynW
lstrlenA
lstrlenW
CloseHandle
CompareStringA
CompareStringW
CreateEventA
CreateEventW
CreateFileA
CreateMutexA
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
EnumSystemLocalesA
GetModuleFileNameA
GetLocaleInfoW
GetLocaleInfoA
GetLocalTime
GetLastError
lstrcpyW
GetFileType
GetEnvironmentVariableW
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStringsA
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess
GetConsoleWindow
GetComputerNameW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetACP
FreeLibrary
FreeEnvironmentStringsW
FreeEnvironmentStringsA
FreeConsole
LocalAlloc
FlushFileBuffers

user32

GetMessagePos
GetMessageTime
GetMessageW
GetNextDlgTabItem
GetParent
GetPropW
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMetrics
GetTopWindow
GetWindow
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextW
GrayStringW
InvalidateRect
IsIconic
IsWindow
IsWindowEnabled
IsWindowVisible
KillTimer
LoadAcceleratorsW
LoadBitmapW
LoadCursorW
LoadIconW
LoadMenuW
LoadStringW
MapWindowPoints
MessageBoxW
ModifyMenuW
PeekMessageW
PostMessageW
PostQuitMessage
PtInRect
RegisterClassW
RegisterWindowMessageW
ReleaseCapture
ReleaseDC
RemovePropW
ReuseDDElParam
ScreenToClient
SendMessageTimeoutW
SendMessageW
SetActiveWindow
SetCursor
SetFocus
SetForegroundWindow
SetMenu
SetMenuItemBitmaps
SetPropW
SetRectEmpty
SetTimer
GetMenuState
SetWindowPos
SetWindowTextW
SetWindowsHookExW
ShowOwnedPopups
ShowWindow
SystemParametersInfoW
TabbedTextOutW
TranslateAcceleratorW
TranslateMessage
UnhookWindowsHookEx
UnpackDDElParam
UnregisterClassW
UpdateWindow
ValidateRect
WaitMessage
WinHelpW
wsprintfW
GetMenuCheckMarkDimensions
GetMenu
GetLastActivePopup
GetKeyState
GetForegroundWindow
GetFocus
GetDlgItem
GetDlgCtrlID
GetDesktopWindow
GetDC
GetCursorPos
GetClientRect
GetClassNameW
GetClassInfoW
GetCapture
GetActiveWindow
EqualRect
EnumWindows
EnumThreadWindows
EndDeferWindowPos
EnableMenuItem
DrawTextW
DispatchMessageW
DestroyWindow
DestroyMenu
DeferWindowPos
DefWindowProcW
CreateWindowExW
CopyRect
ClientToScreen
CheckMenuItem
CallWindowProcW
CallNextHookEx
BringWindowToTop
BeginDeferWindowPos
AdjustWindowRectEx
GetMenuItemID
SetWindowLongW
GetMenuItemCount
EnableWindow

gdi32

CreateBitmap
DeleteObject
Escape
ExtTextOutW
GetClipBox
GetDeviceCaps
GetObjectW
GetStockObject
OffsetViewportOrgEx
PtVisible
RectVisible
RestoreDC
SaveDC
ScaleViewportExtEx
ScaleWindowExtEx
SelectObject
SetBkColor
SetMapMode
SetTextColor
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
TextOutW
DeleteDC

advapi32

OpenProcessToken
CloseServiceHandle
LookupAccountSidW
LookupAccountNameW
IsValidSid
SetThreadToken
SetSecurityDescriptorDacl
RevertToSelf
ReportEventA
RegisterEventSourceA
RegSetValueExW
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegQueryValueA
RegOpenKeyW
RegOpenKeyExW
RegOpenKeyExA
RegOpenKeyA
RegNotifyChangeKeyValue
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExW
RegCreateKeyExA
RegCloseKey
QueryServiceStatus
OpenThreadToken
OpenServiceW
OpenSCManagerW
InitializeSecurityDescriptor
GetUserNameW
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
FreeSid
EqualSid
DeregisterEventSource
AllocateAndInitializeSid

shell32

DragFinish
DragQueryFileW

comctl32

ord17

Exports

Exports

JgSClose
JgSGetAssetBytes
JgSGetAssetInfo
JgSGetAssetStallPoint
JgSGetAuxInfo
JgSGetCommand
JgSGetImage
JgSGetMask
JgSGetNumberOfAssets
JgSGetNumberOfCommands
JgSGetPerformance
JgSGetReport
JgSGetStreamInfo
JgSGetTimePosition
JgSHeartbeat
JgSInputStream
JgSOpen
JgSPauseShow
JgSResumeShow
JgSSetEOFMark
JgSSetTimePosition
JgSSound
JgSStartShow
JgSStopShow

Sections

.text
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 80KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e687239a2359b51f02f980d39a359b81

Headers

File Characteristics

Imports

version

ws2_32

kernel32

user32

gdi32

advapi32

shell32

comctl32

Exports

Exports

Sections

.text Size: 160KB - Virtual size: 160KB

.rdata Size: 48KB - Virtual size: 48KB

.data Size: 80KB - Virtual size: 1.7MB

.idata Size: 12KB - Virtual size: 12KB

.rsrc Size: 32KB - Virtual size: 32KB

.text
Size: 160KB - Virtual size: 160KB

.rdata
Size: 48KB - Virtual size: 48KB

.data
Size: 80KB - Virtual size: 1.7MB

.idata
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 32KB - Virtual size: 32KB