5f3e8b74312aa5823071423b8ace61ea_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5f3e8b74312aa5823071423b8ace61ea_JaffaCakes118
Size

253KB
MD5

5f3e8b74312aa5823071423b8ace61ea
SHA1

c7c4a3a099892b4a82c65acae5da2d4ff3fe2a64
SHA256

54e57d5891897c6dbeb5e38735afa182e2e05c1e8c42e84c9eb7fab0afd7a96a
SHA512

c20b8b1b1a35d537a45952661d1373d686d45e134f06a051e77ce9bcd0ce76d3173914b73e89865d4375ada265e45c56e85a06d49587cd9b16913e64ad98eab5
SSDEEP

6144:mSE2zRfXrK6b+amoFqkKkOuqV2u1eSa4Dtsq19N:BzEqtm3kOuqDRD6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5f3e8b74312aa5823071423b8ace61ea_JaffaCakes118

Files

5f3e8b74312aa5823071423b8ace61ea_JaffaCakes118
.exe windows:5 windows x86 arch:x86

201ec3c089ffe5745a258d5b5aa8b7ba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLocaleInfoA
GetStringTypeW
GetStringTypeA
CreateFileA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
SetFilePointer
InitializeCriticalSectionAndSpinCount
VirtualAlloc
HeapReAlloc
HeapSize
HeapAlloc
FlushFileBuffers
LoadLibraryA
SetEndOfFile
GetProcessHeap
ReadFile
VirtualFree
HeapFree
HeapCreate
GetTickCount
GetLocalTime
Sleep
GetModuleFileNameA
GetCommandLineA
GetTempPathA
CreateDirectoryA
DeleteFileA
RemoveDirectoryA
MoveFileA
CreateMutexA
GetLastError
lstrcpyA
lstrcatA
lstrlenA
ExpandEnvironmentStringsA
GetFileAttributesExA
CreateThread
WaitForSingleObject
TerminateThread
CloseHandle
WriteFile
HeapDestroy
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
LoadLibraryW
ExitProcess
OutputDebugStringW
GetFileType
WriteConsoleW
OutputDebugStringA
GetStdHandle
DebugBreak
LCMapStringW
LCMapStringA
MultiByteToWideChar
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
SetLastError
TlsFree
GetCurrentThreadId
TlsSetValue
TlsAlloc
GetModuleHandleW
TlsGetValue
GetProcAddress
IsBadReadPtr
HeapValidate
GetStartupInfoA
GetModuleFileNameW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement

user32

GetClassLongA
wsprintfA

advapi32

RegQueryValueExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegOpenKeyExA
RegOpenKeyA

ole32

CoInitialize

shell32

ShellExecuteA

shlwapi

PathFileExistsA
PathIsDirectoryA
PathRemoveBlanksA
PathGetArgsA
PathFindFileNameA

gdi32

CreateICA
GetObjectType
ExtTextOutW
SetTextAlign
GetFontUnicodeRanges
CreateCompatibleBitmap
AddFontResourceW

ws2_32

recv
closesocket
__WSAFDIsSet
select
connect
ioctlsocket
htons
socket
gethostbyname
WSAStartup
send

netapi32

Netbios

comdlg32

GetFileTitleW
FindTextA
ReplaceTextA
GetSaveFileNameW
PrintDlgA
GetSaveFileNameA
CommDlgExtendedError
FindTextW
ChooseColorW
PageSetupDlgA

comsvcs

MTSCreateActivity
CoLeaveServiceDomain

imm32

ImmSimulateHotKey
ImmGetCompositionWindow
ImmGetGuideLineA
ImmInstallIMEW
ImmDisableIME
ImmSetOpenStatus
ImmIsUIMessageW
ImmEscapeA
ImmGetCandidateWindow
ImmAssociateContext
ImmGetCandidateListCountA
ImmAssociateContextEx
ImmGetImeMenuItemsW
ImmDestroyContext
ImmGetIMEFileNameW
ImmGetStatusWindowPos
ImmSetCompositionStringA
ImmGetContext
ImmGetCandidateListA
ImmSetCompositionWindow
ImmUnregisterWordW
ImmGetDescriptionA

msi

ord66
ord203
ord214
ord192
ord275
ord274
ord141
ord168
ord204
ord112
ord104
ord242
ord107
ord267
ord173
ord277
ord229
ord7
ord232
ord41
ord126
ord8
ord205
ord249
ord244
ord224
ord71
ord247
ord82
ord223
ord156
ord215
ord154
ord9
ord248
ord181
ord179
ord39
ord219
ord216
ord83
ord6
ord270
ord202
ord253
ord250
ord180
ord69
ord257
ord38
ord261
ord271
ord87
ord84
ord67
ord5
ord252
ord43
ord213
ord42
ord36
ord265
ord190
ord177

msvfw32

ICDraw
MCIWndCreateW
DrawDibGetBuffer
DrawDibClose
DrawDibBegin
ICCompressorFree
DrawDibEnd
ICSeqCompressFrameEnd
DrawDibOpen
DrawDibStop
ICSendMessage
ICDecompress
ICImageCompress
ICOpenFunction
ICClose
DrawDibTime
ICCompress
ICInfo
MCIWndCreateA
DrawDibStart
ICGetDisplayFormat
ICOpen
ICImageDecompress
ICDrawBegin
DrawDibRealize

mswsock

WSARecvEx
GetAcceptExSockaddrs
TransmitFile

Sections

.text
Size: 167KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

201ec3c089ffe5745a258d5b5aa8b7ba

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

shell32

shlwapi

gdi32

ws2_32

netapi32

comdlg32

comsvcs

imm32

msi

msvfw32

mswsock

Sections

.text Size: 167KB - Virtual size: 167KB

.rdata Size: 63KB - Virtual size: 62KB

.data Size: 4KB - Virtual size: 21KB

.reloc Size: 17KB - Virtual size: 16KB

.text
Size: 167KB - Virtual size: 167KB

.rdata
Size: 63KB - Virtual size: 62KB

.data
Size: 4KB - Virtual size: 21KB

.reloc
Size: 17KB - Virtual size: 16KB