6588551258d58b06a485872573cb9341_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

6588551258d58b06a485872573cb9341_JaffaCakes118
Size

277KB
MD5

6588551258d58b06a485872573cb9341
SHA1

413e9c1fcf3b2ffe4c49255793885b68fd54149e
SHA256

b08e5c1fe0c73ba2b9c2cca61739fa91cab42b632d3d269d15f9c38622609430
SHA512

65767fc41e45c9d0e2972d067906089c9851daea73fea1420fd6c790c7311a684fc022cf15a0dc1dae0646a7309f6d734a13525666427bf362b821f08385c46c
SSDEEP

6144:GKIZVk+Cx69EcoXVMi302pgCZwkrhJSzFX2XuTtLq:Gfe+Cx20lpgCZnhWl2eTtm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6588551258d58b06a485872573cb9341_JaffaCakes118

Files

6588551258d58b06a485872573cb9341_JaffaCakes118
.exe windows:5 windows x86 arch:x86

1c0aa22e27f26021adb5e4540c6727ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitNamedPipeW
FindResourceA
EnumSystemCodePagesW
UnhandledExceptionFilter
GetCommProperties
DeleteFiber
CreateActCtxW
_hwrite
GetCurrentDirectoryW
GetConsoleTitleA
IsDBCSLeadByte
SetFileShortNameA
WaitForMultipleObjects
SearchPathW
CreateTimerQueueTimer
WideCharToMultiByte
LoadLibraryExW
GlobalMemoryStatusEx
BuildCommDCBAndTimeoutsA
GetSystemDirectoryA
GetNamedPipeHandleStateA
SetupComm
GetCurrentDirectoryA
GetModuleHandleExW
GetTimeZoneInformation
lstrcatA
GlobalReAlloc
CopyFileExW
GetPrivateProfileStringA
OpenMutexW
FatalAppExitW
FlushConsoleInputBuffer
EnumSystemCodePagesA
IsValidLanguageGroup
CommConfigDialogW
SignalObjectAndWait
GetUserDefaultUILanguage
RemoveVectoredExceptionHandler
GetCompressedFileSizeA
GlobalFix
GetOEMCP
ReadConsoleOutputW
SetComputerNameExW
ReplaceFileA
FreeEnvironmentStringsW
WriteFileGather
InitAtomTable
WriteConsoleOutputCharacterW
GetCommModemStatus
DeactivateActCtx
HeapLock
GetVolumeNameForVolumeMountPointA
CreateDirectoryExW
WriteTapemark
SetFirmwareEnvironmentVariableA
OpenSemaphoreW
CreateEventW
SetLastError
EraseTape
SetCurrentDirectoryW
IsBadReadPtr
GetSystemInfo
FreeResource
lstrcmpiW
IsBadHugeWritePtr
GetProfileIntA
DeleteTimerQueueEx
ConvertThreadToFiber
VirtualLock
RemoveDirectoryA
EncodeSystemPointer
IsDBCSLeadByteEx
VirtualFreeEx
GetFullPathNameA
EnumTimeFormatsA
SetErrorMode
DefineDosDeviceW
WriteFileEx
GetUserDefaultLangID
DisableThreadLibraryCalls
IsBadCodePtr
GetCommConfig
RemoveDirectoryW
GetVolumeInformationA
GetSystemWindowsDirectoryW
VerSetConditionMask
CreateDirectoryExA
CreateWaitableTimerA
BackupWrite
GetNamedPipeInfo
FindFirstVolumeMountPointW
FindNextVolumeW
DisconnectNamedPipe
AreFileApisANSI
FindAtomA
WriteConsoleW
GetACP
CreateHardLinkW
GetGeoInfoA
SetConsoleCP
OpenFileMappingA
RequestDeviceWakeup
DebugBreak
HeapCreate
FileTimeToLocalFileTime
GetConsoleSelectionInfo
GetVolumePathNamesForVolumeNameW
GetSystemWow64DirectoryA
AttachConsole
GetConsoleAliasesLengthA
DeleteTimerQueueTimer
CreateTimerQueue
IsBadHugeReadPtr
IsBadWritePtr
GetQueuedCompletionStatus
FlushViewOfFile
GetWindowsDirectoryA
OpenSemaphoreA
CreateFileA
SetTapePosition
SearchPathA
GetModuleHandleA
LoadLibraryA
lstrcmpA
lstrlenA
lstrcmpiA
EnterCriticalSection
LeaveCriticalSection
lstrcpynA
DeleteCriticalSection
GetProcAddress
LoadLibraryW
ScrollConsoleScreenBufferW
GetThreadContext
RegisterWaitForSingleObject
ClearCommError
CreateFiberEx
EndUpdateResourceW
EnumLanguageGroupLocalesA
GetStringTypeA
CreateMailslotA
DefineDosDeviceA
GetProcessHandleCount
GetSystemTime
FindActCtxSectionStringA
GetLogicalProcessorInformation
WritePrivateProfileStringA
GetVersionExW
GetVersionExA
GetModuleHandleW
SetThreadExecutionState
ExitProcess
GetLastError
HeapFree
HeapAlloc
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualFree
VirtualAlloc
HeapReAlloc
Sleep
WriteFile
GetStdHandle
GetModuleFileNameA
CloseHandle
MultiByteToWideChar
ReadFile
SetHandleCount
GetFileType
SetFilePointer
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
GetEnvironmentStringsW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetCPInfo
IsValidCodePage
HeapSize
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
SetEndOfFile
GetProcessHeap
LCMapStringA
LCMapStringW
GetStringTypeW

gdi32

GetDCOrgEx
ScaleViewportExtEx
SetTextAlign
GetObjectW
PolylineTo
SetDIBitsToDevice
GetClipRgn
CreatePenIndirect
AngleArc
CreateDCA
PolyTextOutW
CombineTransform
SetTextCharacterExtra
DPtoLP
OffsetWindowOrgEx
GetMetaFileBitsEx
BitBlt
GetPath
GetTextExtentExPointW
CreateDiscardableBitmap
GetFontUnicodeRanges
GetWorldTransform
PolyPolyline
GetDCBrushColor
RemoveFontResourceExA
GetColorSpace
EnumFontsA
AddFontMemResourceEx
CreateICA
GetLogColorSpaceW
GetPolyFillMode
GetBitmapBits
CreateBitmapIndirect
TextOutA
GetTextMetricsA
GetTextExtentPointW
SetPaletteEntries
GetFontData
ScaleWindowExtEx
CopyMetaFileA
LPtoDP
GetTextMetricsW
CreateDIBSection
GetKerningPairsW
PolyBezier
GetStockObject
GetGlyphIndicesW
GetCharWidthI
DeleteEnhMetaFile
StartPage
GetOutlineTextMetricsW
GetGlyphOutlineA
EndPage
LineDDA
OffsetRgn
PlgBlt
DeleteObject
GetAspectRatioFilterEx
PlayMetaFile
CreateColorSpaceW
GetObjectType
GetMetaFileW
SetRectRgn
CreateBitmap
GetMetaFileA
SetWinMetaFileBits
EnumMetaFile
CloseEnhMetaFile
CreateDIBitmap
GetDIBColorTable
GetSystemPaletteEntries
CreateScalableFontResourceW
GetMiterLimit
GetRegionData
GetMapMode
Polyline
CreatePatternBrush
RemoveFontResourceW
EnumFontFamiliesExW
SetViewportOrgEx
GetDCPenColor
SetBrushOrgEx
GetGlyphOutlineW
WidenPath
GetDeviceCaps
GetKerningPairsA
EnumObjects
SetICMProfileA
CreateMetaFileW
IntersectClipRect
GetTextFaceW
CreatePen
CreateRectRgn
SetColorSpace
SetColorAdjustment
GetClipBox
CreatePalette
ResetDCW
TranslateCharsetInfo
SetStretchBltMode
GetCharacterPlacementW
DrawEscape
StrokePath
GetTextExtentPointI
PolyDraw
GetPaletteEntries
RealizePalette
SetLayout
OffsetClipRgn
GetRgnBox
GetICMProfileW
LineTo
GetCharABCWidthsFloatW
OffsetViewportOrgEx
CreateDIBPatternBrushPt
ColorMatchToTarget
GdiGradientFill
CreateBrushIndirect
GetViewportOrgEx
SetPolyFillMode
CreateFontIndirectExW
SetPixelFormat
SetICMMode
AbortDoc
CreateHatchBrush
GdiFlush
CreateEllipticRgnIndirect
GetCharWidthA
StretchBlt
GetNearestColor
GetEnhMetaFileHeader
RoundRect
SetBkMode
StartDocA
GetMetaRgn
AbortPath
ExtTextOutA
CreateRectRgnIndirect
AddFontResourceExA
GetCharWidthFloatW
GetBkColor
GetObjectA
PatBlt
CreateSolidBrush
ExtTextOutW
GetCharWidthW
GetTextCharset
SelectClipPath
EnumFontsW
GetTextCharsetInfo
EnumICMProfilesA
ColorCorrectPalette
ModifyWorldTransform
SetMapMode
RectVisible
Chord
StretchDIBits
GetFontLanguageInfo
GetTextExtentPoint32A
GetRasterizerCaps
GetBrushOrgEx
CreateRoundRectRgn
FillPath
GetCurrentPositionEx
SetWorldTransform
DeleteColorSpace
ExtCreatePen
ChoosePixelFormat
ResetDCA
CopyEnhMetaFileA
CreateCompatibleDC
GetWindowExtEx
SetBkColor
GetCharABCWidthsW
GetEnhMetaFileBits

comdlg32

GetOpenFileNameA
GetSaveFileNameW
FindTextW
ChooseFontW
PrintDlgW
GetFileTitleW
ChooseFontA

activeds

ord20
ord21
ord29
ord15
ord18
ord23
ord3
ord30
ord19
ord5
ord7
ord4

crypt32

CertOpenStore
CryptMemAlloc
CertDuplicateCRLContext
CertUnregisterSystemStore
CryptDecodeObjectEx
CertIsValidCRLForCertificate
CryptMsgUpdate
CryptFindOIDInfo
CryptVerifyCertificateSignature
CertDeleteCTLFromStore
CertFindSubjectInCTL
CryptSignCertificate
CryptUnregisterOIDInfo
CryptSignMessage
CryptRegisterDefaultOIDFunction
CryptMsgClose
CertFreeCertificateChainEngine
CryptBinaryToStringW
CryptMsgCountersign
CertVerifyRevocation
CryptGetMessageSignerCount
CryptDecryptAndVerifyMessageSignature
CryptVerifyMessageSignature
CryptCreateAsyncHandle
CryptUnprotectData
CryptMsgGetAndVerifySigner
CertVerifyCertificateChainPolicy
CertRemoveStoreFromCollection
PFXExportCertStore
CryptEncodeObject
CertEnumCTLsInStore
CertAddEncodedCertificateToStore
CryptMsgDuplicate
CertSaveStore
CryptFindCertificateKeyProvInfo
CryptVerifyDetachedMessageHash
CryptGetDefaultOIDDllList
CryptStringToBinaryW
CertEnumSystemStore
CertGetCTLContextProperty
CertFindAttribute
CertSerializeCertificateStoreElement
CryptMsgCalculateEncodedLength
CryptVerifyDetachedMessageSignature
CertVerifySubjectCertificateContext
CertIsRDNAttrsInCertificateName
CertRegisterSystemStore
CertFreeCertificateContext
CertFreeCertificateChain
CertCreateCTLContext
CryptHashMessage
CertSetCertificateContextProperty
CertGetIntendedKeyUsage
CertGetCertificateChain
CertEnumSystemStoreLocation
CryptGetAsyncParam
CertAddEncodedCertificateToSystemStoreA
PFXExportCertStoreEx
CertGetValidUsages
CryptExportPKCS8
CertSerializeCTLStoreElement
CryptMemFree
CertAddEnhancedKeyUsageIdentifier
CertAddCRLContextToStore
CertFindRDNAttr
CertOpenSystemStoreW
CryptDecodeMessage
CertCloseStore
CertEnumCertificatesInStore
CryptGetOIDFunctionAddress
CertFreeCTLContext
CertStrToNameW
CertStrToNameA
CertGetPublicKeyLength
PFXIsPFXBlob
PFXVerifyPassword
CertOIDToAlgId
CertFindCRLInStore
CertAddCertificateLinkToStore
CryptBinaryToStringA
CryptMsgOpenToDecode
CertRDNValueToStrA
CryptInitOIDFunctionSet
CryptFreeOIDFunctionAddress
CertGetCRLContextProperty
CryptSetKeyIdentifierProperty
CryptStringToBinaryA
CryptSignAndEncryptMessage
CryptEncryptMessage
CertGetCRLFromStore
CertVerifyCRLTimeValidity

imm32

ImmGetCompositionFontA
ImmSimulateHotKey
ImmEscapeA
ImmGetCompositionStringW
ImmGetDescriptionW
ImmGetDescriptionA
ImmConfigureIMEW
ImmUnregisterWordW
ImmSetCompositionFontW
ImmGetOpenStatus
ImmDisableIME
ImmRegisterWordW
ImmEnumInputContext
ImmGetImeMenuItemsW
ImmGetStatusWindowPos
ImmGetCandidateWindow
ImmGetRegisterWordStyleA
ImmIsIME
ImmGetConversionStatus
ImmGetDefaultIMEWnd

msimg32

GradientFill
AlphaBlend

Sections

.text
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 192KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1c0aa22e27f26021adb5e4540c6727ae

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

gdi32

comdlg32

activeds

crypt32

imm32

msimg32

Sections

.text Size: 57KB - Virtual size: 56KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 192KB - Virtual size: 199KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 57KB - Virtual size: 56KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 192KB - Virtual size: 199KB

.reloc
Size: 6KB - Virtual size: 6KB