62684ada5c234698b450cfc3c6e4ed16_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

62684ada5c234698b450cfc3c6e4ed16_JaffaCakes118
Size

4.1MB
MD5

62684ada5c234698b450cfc3c6e4ed16
SHA1

30750e80f0ba954332b8ee6edc15de8161223f18
SHA256

d1e068099ddd5971aed70fb24380c46660bf3a8086858ad00cad552cb856196b
SHA512

86fd0ad8a7065e658d06fb7b5e45b7b738ce976f85a1ad84ce2240296cd7322ca4b1522830ca9b2abcf1a69ad77bf415606368a600c9d0ffebf5948442903907
SSDEEP

49152:qP16sE0rP1NDDdBzb0GB9QGWbRJn5sZJb2EzgAuqSjyXWI:qcsE0rPTDDdBzqbRJrI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
62684ada5c234698b450cfc3c6e4ed16_JaffaCakes118

Files

62684ada5c234698b450cfc3c6e4ed16_JaffaCakes118
.exe windows:4 windows x86 arch:x86

adea51ff391ba2ddad9aeee8b23287bf

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

dsound

ord1

kernel32

CreateToolhelp32Snapshot
GetCurrentProcessId
GetFileSize
GetSystemDirectoryA
FindNextFileA
FindClose
GetComputerNameA
WriteFile
SetFilePointer
GetLocalTime
SuspendThread
ResumeThread
GetCurrentThreadId
CreateDirectoryA
CopyFileA
DeleteCriticalSection
TerminateThread
GetExitCodeThread
WaitForSingleObject
SetThreadPriority
_lwrite
_lclose
_lcreat
CompareFileTime
GlobalFree
GlobalAlloc
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
FreeLibrary
GetProcAddress
LoadLibraryA
IsDBCSLeadByte
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
TerminateProcess
LocalFree
LocalAlloc
GetLastError
SetEndOfFile
SetEnvironmentVariableA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
IsBadReadPtr
QueryPerformanceCounter
GetSystemInfo
Module32First
lstrcatA
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetTimeZoneInformation
LCMapStringW
LCMapStringA
GetCPInfo
GetOEMCP
GetFileType
GetStdHandle
SetHandleCount
HeapSize
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
SetUnhandledExceptionFilter
ExitProcess
GetCommandLineA
GetStartupInfoA
GetSystemTimeAsFileTime
HeapReAlloc
RtlUnwind
HeapFree
HeapAlloc
RaiseException
VirtualQuery
GetSystemDefaultLangID
GetCurrentProcess
GetModuleHandleA
ResetEvent
CreateEventA
SetEvent
GetModuleFileNameA
FindFirstFileA
CreateFileA
ReadFile
CloseHandle
Module32Next
InitializeCriticalSection
GetCurrentThread
GetTickCount
Sleep
EnterCriticalSection
LeaveCriticalSection
ExitThread
lstrlenA
lstrcmpiA
CompareStringW
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetLocaleInfoA
DeleteFileA
OutputDebugStringA
lstrcmpA
VirtualProtect
lstrcpyA
InterlockedExchange
GetACP
GetEnvironmentStringsW
CreateThread
CompareStringA

user32

SendMessageA
SetWindowTextA
DefWindowProcA
PostMessageA
SetForegroundWindow
PostQuitMessage
SetFocus
GetForegroundWindow
ReleaseDC
GetWindowTextA
GetDC
DispatchMessageA
TranslateMessage
PeekMessageA
DrawTextA
SetWindowLongA
ShowCursor
UpdateWindow
ShowWindow
CreateWindowExA
LoadBitmapA
CallWindowProcA
RegisterClassA
LoadCursorA
LoadIconA
GetSystemMetrics
GetClassNameA
EnumWindows
FindWindowA
wsprintfA
CharLowerA
SetTimer
OffsetRect
ClientToScreen
GetClientRect
MessageBoxA
GetWindowRect
GetDesktopWindow

gdi32

GetStockObject
CreateDCA
GetObjectA
GetDIBits
CreateCompatibleBitmap
DeleteObject
CreateCompatibleDC
BitBlt
DeleteDC
TextOutA
CreateFontA
SelectObject
SetBkMode
SetTextColor

advapi32

RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegCloseKey

shell32

ShellExecuteA

ole32

CoCreateInstance
CoUninitialize
CoInitialize

handes

?DecryptFunc@@YGHPAD0@Z

ddraw

DirectDrawCreate

winmm

mixerSetControlDetails
timeEndPeriod
timeKillEvent
timeSetEvent
timeBeginPeriod
mmioClose
mmioAscend
mmioRead
mmioDescend
mmioOpenA
mmioSeek
mmioSetInfo
mmioAdvance
mmioGetInfo
mixerClose
mixerOpen
mixerGetDevCapsA
mixerGetControlDetailsA
mixerGetLineControlsA
mixerGetLineInfoA
timeGetTime

shlwapi

PathFileExistsA

wininet

HttpQueryInfoA
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetQueryDataAvailable

imm32

ImmSetConversionStatus
ImmGetContext
ImmSetOpenStatus

wsock32

WSACleanup
getsockname
accept
setsockopt
inet_addr
gethostbyname
closesocket
WSAGetLastError
recv
inet_ntoa
htons
send
WSAAsyncSelect
connect
ioctlsocket
socket
WSAStartup

Exports

Exports

SetExtChangeZip
UnZipData
UnZipDataToDirectory
UnZipDataToFile
UnZipFile
ZipData
ZipFile
_CloseD3d@0
_InitD3D@4
_smPlayD3D@24
fcEXP

Sections

.text
Size: 1.7MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 207KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.0MB - Virtual size: 62.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 163KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_exp
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

KPTTrans
Size: 1024KB - Virtual size: 1024KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

adea51ff391ba2ddad9aeee8b23287bf

Headers

File Characteristics

Imports

dsound

kernel32

user32

gdi32

advapi32

shell32

ole32

handes

ddraw

winmm

shlwapi

wininet

imm32

wsock32

Exports

Exports

Sections

.text Size: 1.7MB - Virtual size: 1.8MB

.rdata Size: 207KB - Virtual size: 208KB

.data Size: 1.0MB - Virtual size: 62.2MB

.rsrc Size: 163KB - Virtual size: 164KB

_exp Size: 1KB - Virtual size: 4KB

KPTTrans Size: 1024KB - Virtual size: 1024KB

.text
Size: 1.7MB - Virtual size: 1.8MB

.rdata
Size: 207KB - Virtual size: 208KB

.data
Size: 1.0MB - Virtual size: 62.2MB

.rsrc
Size: 163KB - Virtual size: 164KB

_exp
Size: 1KB - Virtual size: 4KB

KPTTrans
Size: 1024KB - Virtual size: 1024KB