6170137bea3b9e0c24c89e24428c0621_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6170137bea3b9e0c24c89e24428c0621_JaffaCakes118
Size

327KB
MD5

6170137bea3b9e0c24c89e24428c0621
SHA1

40eae45516de936669cee510439bf82c55bd135c
SHA256

1a6f775c689828c6d9726924dedd923cbc66d823fbe19233fcbe9a6d4315c9ce
SHA512

12dc1daddc4ad7b8ed6cac5c04c8f672002108b2be03d0f04f19fa97fabedef0344dcfbdfffa0debe0a8bf58129d56a65b833d343283afe4dfbaac6b48dd5805
SSDEEP

6144:0Ug3FD2rKRdXzR9Dskgm+HZDMx8V+YCjTasGpJBAZISTN/pfT:/gVJXF9Dskv+HC3i7pJBAD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6170137bea3b9e0c24c89e24428c0621_JaffaCakes118

Files

6170137bea3b9e0c24c89e24428c0621_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e04febe3beda3357a65446026400c3f1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

ws2_32

recvfrom
send
sendto
recv
ntohs
ioctlsocket
inet_ntoa
inet_addr
htons
htonl
getservbyport
getservbyname
gethostbyname
gethostbyaddr
connect
closesocket
bind
accept
WSAStringToAddressA
WSAStartup
WSASetLastError
WSAGetLastError
WSACleanup
WSAAsyncSelect
socket

kernel32

FreeConsole
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetComputerNameW
GetConsoleWindow
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsA
GetEnvironmentStringsW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetFileType
GetLastError
GetLocalTime
GetLocaleInfoA
GetLocaleInfoW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessVersion
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemTime
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetUserDefaultLCID
GetVersion
GetVersionExA
GetVersionExW
GetWindowsDirectoryA
GlobalAddAtomW
GlobalAlloc
GlobalDeleteAtom
GlobalFindAtomW
GlobalFlags
GlobalFree
GlobalGetAtomNameW
GlobalHandle
GlobalLock
GlobalReAlloc
GlobalUnlock
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsBadCodePtr
IsBadReadPtr
IsBadWritePtr
IsValidCodePage
IsValidLocale
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalAlloc
LocalFree
LocalReAlloc
MultiByteToWideChar
RaiseException
ReadFile
ReleaseMutex
RtlUnwind
SetConsoleCtrlHandler
SetEnvironmentVariableA
SetErrorMode
SetEvent
SetFilePointer
FlushFileBuffers
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
WritePrivateProfileStringW
WriteProfileStringW
lstrcatW
lstrcmpA
lstrcmpW
lstrcmpiA
lstrcmpiW
lstrcpyW
lstrcpynW
lstrlenA
lstrlenW
CloseHandle
CompareStringA
CompareStringW
CreateEventA
CreateEventW
SetHandleCount
CreateFileA
CreateMutexA
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
EnumSystemLocalesA
ExitProcess

user32

EnableWindow
EndDeferWindowPos
EnumThreadWindows
EnumWindows
EqualRect
GetActiveWindow
GetCapture
GetClassInfoW
GetClassNameW
GetClientRect
GetCursorPos
GetDC
GetDesktopWindow
GetDlgCtrlID
GetDlgItem
GetFocus
GetForegroundWindow
GetKeyState
GetLastActivePopup
GetMenu
GetMenuCheckMarkDimensions
GetMenuItemCount
GetMenuItemID
GetMenuState
GetMessagePos
GetMessageTime
GetMessageW
GetNextDlgTabItem
GetParent
GetPropW
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMetrics
GetTopWindow
GetWindow
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextW
GrayStringW
InvalidateRect
IsIconic
IsWindow
IsWindowEnabled
IsWindowVisible
KillTimer
LoadAcceleratorsW
LoadBitmapW
LoadCursorW
LoadIconW
LoadMenuW
LoadStringW
MapWindowPoints
EnableMenuItem
ModifyMenuW
PeekMessageW
PostMessageW
PostQuitMessage
PtInRect
RegisterClassW
RegisterWindowMessageW
ReleaseCapture
ReleaseDC
RemovePropW
ReuseDDElParam
ScreenToClient
SendMessageTimeoutW
SendMessageW
SetActiveWindow
SetCursor
SetFocus
SetForegroundWindow
SetMenu
SetMenuItemBitmaps
SetPropW
SetRectEmpty
SetTimer
SetWindowLongW
SetWindowPos
SetWindowTextW
SetWindowsHookExW
ShowOwnedPopups
ShowWindow
SystemParametersInfoW
TabbedTextOutW
TranslateAcceleratorW
TranslateMessage
UnhookWindowsHookEx
UnpackDDElParam
UnregisterClassW
UpdateWindow
ValidateRect
WaitMessage
WinHelpW
wsprintfW
DestroyWindow
DestroyMenu
DeferWindowPos
DefWindowProcW
CreateWindowExW
CopyRect
ClientToScreen
CallWindowProcW
CallNextHookEx
BringWindowToTop
BeginDeferWindowPos
AdjustWindowRectEx
DrawTextW
MessageBoxW
DispatchMessageW
CheckMenuItem

gdi32

ScaleViewportExtEx
SaveDC
RestoreDC
TextOutW
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
SetTextColor
SetMapMode
SetBkColor
SelectObject
RectVisible
PtVisible
OffsetViewportOrgEx
GetStockObject
GetObjectW
GetDeviceCaps
GetClipBox
ExtTextOutW
Escape
DeleteObject
DeleteDC
CreateBitmap
ScaleWindowExtEx

winspool.drv

DocumentPropertiesW
ord204
OpenPrinterW
GetPrinterW
GetPrinterDataW
AddPrinterConnectionW
ClosePrinter
DeletePrinterConnectionW
EnumPrintersW
ord203

advapi32

RegDeleteKeyA
CloseServiceHandle
DeregisterEventSource
EqualSid
FreeSid
SetThreadToken
SetSecurityDescriptorDacl
RevertToSelf
ReportEventA
RegisterEventSourceA
RegSetValueExW
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegQueryValueA
RegOpenKeyW
RegOpenKeyExW
RegOpenKeyExA
RegOpenKeyA
RegNotifyChangeKeyValue
RegEnumKeyExA
AllocateAndInitializeSid
RegCreateKeyExW
RegCreateKeyExA
RegCloseKey
QueryServiceStatus
OpenThreadToken
OpenServiceW
OpenSCManagerW
OpenProcessToken
LookupAccountSidW
LookupAccountNameW
IsValidSid
InitializeSecurityDescriptor
GetUserNameW
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority

shell32

DragFinish
DragQueryFileW

comctl32

ord17

Exports

Exports

JgpAlloc
JgpClose
JgpDoTest
JgpFree
JgpGetARTNote
JgpGetImage
JgpGetMask
JgpGetPalette
JgpGetPerformance
JgpGetPosition
JgpGetReport
JgpGetUiHook
JgpGetUiInputHook
JgpGetUiLong
JgpGetUiReportHook
JgpHeartBeat
JgpInputStream
JgpLosslessBlock
JgpLosslessCreate
JgpLosslessDestroy
JgpLosslessPartitionReset
JgpLosslessQuery
JgpLosslessReset
JgpOpen
JgpPausePlay
JgpQueryStream
JgpReAlloc
JgpReleaseSound
JgpResumePlay
JgpResumeSound
JgpSetEOFMark
JgpSetPosition
JgpSetUiHook
JgpSetUiInputHook
JgpSetUiLong
JgpSetUiReportHook
JgpShutDown
JgpStartPlay
JgpStartUp
JgpStopPlay

Sections

.text
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e04febe3beda3357a65446026400c3f1

Headers

File Characteristics

Imports

version

ws2_32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

Exports

Exports

Sections

.text Size: 160KB - Virtual size: 160KB

.rdata Size: 44KB - Virtual size: 44KB

.data Size: 76KB - Virtual size: 1.7MB

.idata Size: 12KB - Virtual size: 12KB

.rsrc Size: 32KB - Virtual size: 32KB

.text
Size: 160KB - Virtual size: 160KB

.rdata
Size: 44KB - Virtual size: 44KB

.data
Size: 76KB - Virtual size: 1.7MB

.idata
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 32KB - Virtual size: 32KB