5e733120eb0671b7a675dfac9ee19290_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5e733120eb0671b7a675dfac9ee19290_JaffaCakes118
Size

139KB
MD5

5e733120eb0671b7a675dfac9ee19290
SHA1

e03023cf9d86b09498f6645eaaa2d7bd688b0ade
SHA256

2b0132d08e340ec200ba38d497430d9b7ad80ebc72ca329aa43d4439c6907307
SHA512

4e87818b961138bb2cee3801af5e2bf072f4dc5e0e630cebf9e27ea0fc42c91f2d9bc809c93844f70a20f8067818b8894a113718756ab289504ad82dee3e8b2b
SSDEEP

3072:Pr6OFWmBjprD6I/I7KPCu0KQ4XIZu4HUoUy0jCiqrqDR0/jzzgewohIrAi:Pr6bacIQ7K6u1Q4XINUzDRUhrSrAi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5e733120eb0671b7a675dfac9ee19290_JaffaCakes118

Files

5e733120eb0671b7a675dfac9ee19290_JaffaCakes118
.exe windows:5 windows x86 arch:x86

084c8360397098fdd906023ddc432a05

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapDestroy
HeapCreate
GetFileAttributesW
Thread32Next
ReadFile
GetTimeZoneInformation
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetFileSizeEx
OpenMutexW
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
FindClose
LoadLibraryA
RemoveDirectoryW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
ResetEvent
SetFileAttributesW
ExpandEnvironmentStringsW
GetPrivateProfileStringW
GetPrivateProfileIntW
GlobalLock
GlobalUnlock
MoveFileExW
GetUserDefaultUILanguage
CreateRemoteThread
Process32FirstW
Process32NextW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
GetThreadContext
SetThreadContext
GetProcessId
TlsGetValue
TlsSetValue
TerminateProcess
GetNativeSystemInfo
GetLocalTime
WTSGetActiveConsoleSessionId
GetLastError
WriteProcessMemory
ReadProcessMemory
LoadLibraryW
WideCharToMultiByte
Thread32First
OpenProcess
WriteFile
VirtualQueryEx
SetFileTime
IsBadReadPtr
LocalFree
GetCurrentProcessId
GetProcessHeap
CreateDirectoryW
HeapFree
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
FreeLibrary
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
CreateThread
GetEnvironmentVariableW
CloseHandle
DuplicateHandle
OpenEventW
WaitForMultipleObjects
CreateEventW
GetModuleFileNameW
GetVersionExW
VirtualFreeEx
VirtualFree
SetEvent
GetComputerNameW
SetErrorMode
GetCommandLineW
ExitProcess
lstrcmpiA
SetThreadPriority
GetCurrentThread
GetSystemTime
lstrcmpiW
GetFileAttributesExW
GetProcAddress
Sleep
GetModuleHandleW
ReleaseMutex
GetCurrentThreadId
SetLastError
GetTickCount
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
GetFileInformationByHandle
InitializeCriticalSection

user32

SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
OpenWindowStationW
EndPaint
GetUpdateRgn
RegisterClassExA
GetWindowDC
DefDlgProcW
DefFrameProcA
OpenInputDesktop
CreateDesktopW
GetUpdateRect
GetDC
TranslateMessage
RegisterClassExW
GetClipboardData
GetDCEx
ReleaseDC
GetSystemMetrics
DefMDIChildProcW
SwitchDesktop
DefDlgProcA
DefMDIChildProcA
RegisterClassW
FillRect
DrawEdge
GetIconInfo
IntersectRect
EqualRect
PrintWindow
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
GetSubMenu
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
GetMenuItemCount
PostThreadMessageW
HiliteMenuItem
EndMenu
GetShellWindow
MapVirtualKeyW
GetKeyboardState
ToUnicode
CharLowerBuffA
DrawIcon
BeginPaint
GetTopWindow
CharLowerW
MsgWaitForMultipleObjects
WindowFromPoint
IsRectEmpty
GetWindowThreadProcessId
CharToOemW
CharLowerA
CharUpperW
CallWindowProcA
CallWindowProcW
DefWindowProcW
DefFrameProcW
RegisterClassA
GetMessageA
GetWindowRect
GetMessageW
SetCapture
PostMessageW
GetParent
GetWindowInfo
GetClassLongW
GetCapture
SetCursorPos
GetWindowLongW
GetAncestor
PeekMessageW
SetWindowLongW
GetWindow
DispatchMessageW
ExitWindowsEx
DefWindowProcA
GetMessagePos
MapWindowPoints
SendMessageW
ReleaseCapture
IsWindow
SendMessageTimeoutW
GetCursorPos
SetWindowPos
PeekMessageA
LoadImageW

advapi32

IsWellKnownSid
GetLengthSid
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
RegEnumKeyExW
InitiateSystemShutdownExW
ConvertSidToStringSidW
EqualSid

shlwapi

wvnsprintfW
PathRemoveBackslashW
StrCmpNIW
PathQuoteSpacesW
PathIsURLW
StrStrIW
StrStrIA
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW
UrlUnescapeA
PathRenameExtensionW

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

RestoreDC
SaveDC
DeleteDC
GdiFlush
SetViewportOrgEx
CreateCompatibleDC
SelectObject
CreateDIBSection
GetDeviceCaps
GetDIBits
DeleteObject
SetRectRgn
CreateCompatibleBitmap

ws2_32

listen
WSASetLastError
freeaddrinfo
socket
bind
recv
setsockopt
recvfrom
sendto
WSAEventSelect
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
WSAGetLastError
getsockname
accept
getpeername
WSASend
closesocket
send
shutdown

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
PFXImportCertStore
CryptUnprotectData

wininet

InternetQueryOptionA
InternetOpenA
HttpOpenRequestA
InternetSetOptionA
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
HttpAddRequestHeadersA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
InternetCloseHandle
HttpSendRequestA
HttpSendRequestW
InternetReadFile
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpQueryInfoA
HttpSendRequestExA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 131KB - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

084c8360397098fdd906023ddc432a05

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 131KB - Virtual size: 132KB

.data Size: 1024B - Virtual size: 12KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 131KB - Virtual size: 132KB

.data
Size: 1024B - Virtual size: 12KB

.reloc
Size: 6KB - Virtual size: 5KB