6710d4d26180f56b1fb1dc0d8f9803e0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6710d4d26180f56b1fb1dc0d8f9803e0_JaffaCakes118
Size

138KB
MD5

6710d4d26180f56b1fb1dc0d8f9803e0
SHA1

028713658d52c6fbc61c84835ed333c3d17fde73
SHA256

47142495afb4a8ec9241d5bdd8f55b65e374be700cd65d3e31eb68cc9edf4a58
SHA512

7c6addd198f8fe3f6f2d58a4404a0657790ff7f9bc80d313857560c2b6d6a6f672c27a0f2a1d931b7daaa7dc9f67242e130a1cc8f458b65e5951ea8c9682a706
SSDEEP

3072:H27RcegLZKQOH+fCnBsNNaMeIVkl+MO0iVsDlDEUCE8iR/Qf:H27RSLVOuNNaQw+MO0iWE284Qf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6710d4d26180f56b1fb1dc0d8f9803e0_JaffaCakes118

Files

6710d4d26180f56b1fb1dc0d8f9803e0_JaffaCakes118
.exe windows:5 windows x86 arch:x86

0b51f51a8fc67f4fe595330b1aa2a888

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FlushFileBuffers
GetEnvironmentVariableW
FileTimeToDosDateTime
GetTempFileNameW
HeapReAlloc
FindFirstFileW
SetEndOfFile
CreateProcessW
HeapAlloc
SystemTimeToFileTime
SetFilePointerEx
HeapFree
VirtualFree
GetProcessHeap
IsBadReadPtr
SetFileTime
VirtualQueryEx
Thread32First
WideCharToMultiByte
ReadProcessMemory
HeapDestroy
HeapCreate
Thread32Next
ReadFile
GetTimeZoneInformation
GetVersionExW
MultiByteToWideChar
WriteFile
GetFileSizeEx
OpenMutexW
GetLastError
VirtualProtectEx
VirtualAllocEx
FindClose
RemoveDirectoryW
WaitForMultipleObjects
FindNextFileW
VirtualProtect
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
WriteProcessMemory
GlobalLock
GlobalUnlock
GetCommandLineW
SetErrorMode
GetComputerNameW
OpenEventW
DuplicateHandle
GetCurrentProcessId
GetNativeSystemInfo
ResetEvent
LoadLibraryA
SetLastError
GetProcessId
VirtualAlloc
SetThreadContext
GetThreadContext
GetPrivateProfileIntW
GetPrivateProfileStringW
CreateToolhelp32Snapshot
SetThreadPriority
TerminateProcess
Process32NextW
Process32FirstW
VirtualFreeEx
OpenProcess
CreateRemoteThread
ReleaseMutex
TlsFree
TlsAlloc
GetCurrentThreadId
CreateEventW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
CreateMutexW
GetTempPathW
LocalFree
TlsSetValue
GetCurrentThread
TlsGetValue
CreateThread
GetSystemTime
GetLocalTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
SetFileAttributesW
CloseHandle
WTSGetActiveConsoleSessionId
lstrcmpiA
CreateFileW
LoadLibraryW
SetEvent
CreateDirectoryW
FreeLibrary
ExitProcess
GetFileAttributesExW
GetProcAddress
GetModuleHandleW
GetUserDefaultUILanguage
GetModuleFileNameW
GetFileAttributesW
Sleep
GetTickCount
WaitForSingleObject
MoveFileExW
ExpandEnvironmentStringsW
lstrcmpiW

user32

GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
GetMenuItemCount
HiliteMenuItem
GetUserObjectInformationW
EndMenu
GetWindowThreadProcessId
GetShellWindow
FillRect
PostMessageW
GetWindowInfo
DrawEdge
IntersectRect
MenuItemFromPoint
EqualRect
PrintWindow
SendMessageW
IsRectEmpty
CharToOemW
EndPaint
GetMessageA
MapVirtualKeyW
GetMessageW
RegisterClassExA
GetWindowDC
SetCapture
DefDlgProcW
GetKeyboardState
ToUnicode
GetIconInfo
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharLowerA
CharUpperW
SetWindowLongW
GetWindow
DispatchMessageW
CreateDesktopW
SetProcessWindowStation
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
CloseDesktop
SetThreadDesktop
OpenWindowStationW
CharLowerW
GetWindowRect
GetParent
GetSubMenu
GetClassLongW
DrawIcon
PostThreadMessageW
GetWindowLongW
OpenDesktopW
SetWindowPos
SendMessageTimeoutW
ExitWindowsEx
RegisterClassA
IsWindow
MapWindowPoints
CharLowerBuffA
GetSystemMetrics
DefFrameProcA
OpenInputDesktop
BeginPaint
GetUpdateRect
GetDC
GetCapture
TranslateMessage
RegisterClassExW
SetCursorPos
GetClipboardData
PeekMessageW
GetDCEx
PeekMessageA
ReleaseDC
DefWindowProcA
GetCursorPos
DefMDIChildProcW
SwitchDesktop
RegisterWindowMessageW
GetThreadDesktop
GetMenuItemID
SetKeyboardState
GetUpdateRgn
DefFrameProcW
GetMessagePos
DefWindowProcW
CallWindowProcW
CallWindowProcA
RegisterClassW
ReleaseCapture
DefMDIChildProcA
DefDlgProcA
GetAncestor

advapi32

InitiateSystemShutdownExW
EqualSid
ConvertSidToStringSidW
GetLengthSid
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegSetValueExW
CryptHashData
IsWellKnownSid

shlwapi

StrCmpNIW
PathRemoveFileSpecW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveBackslashW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathQuoteSpacesW
StrStrIW
StrStrIA
PathRenameExtensionW
PathIsURLW

shell32

SHGetFolderPathW
ShellExecuteW
CommandLineToArgvW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

GetDeviceCaps
CreateCompatibleBitmap
CreateDIBSection
SetViewportOrgEx
DeleteDC
GdiFlush
DeleteObject
SelectObject
SetRectRgn
CreateCompatibleDC
GetDIBits
RestoreDC
SaveDC

ws2_32

freeaddrinfo
recv
sendto
getsockname
select
getaddrinfo
recvfrom
accept
WSAEventSelect
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
shutdown
setsockopt
bind
socket
WSASetLastError
getpeername
WSAGetLastError
WSASend
closesocket
send
listen

crypt32

CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData
PFXImportCertStore
PFXExportCertStoreEx

wininet

HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
InternetQueryOptionA
InternetSetOptionA
InternetQueryOptionW
InternetOpenA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetCrackUrlA
InternetConnectA
HttpSendRequestA
HttpSendRequestW
InternetReadFile
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpQueryInfoA
HttpSendRequestExA
InternetCloseHandle

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0b51f51a8fc67f4fe595330b1aa2a888

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 130KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 130KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB