67a2e5db9dd6bf5404378873935dca5c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

67a2e5db9dd6bf5404378873935dca5c_JaffaCakes118
Size

716KB
MD5

67a2e5db9dd6bf5404378873935dca5c
SHA1

258a0647506331c6e97609264b9396d7cf901575
SHA256

43b16d1192b53b152101a9d45f207465d5fa85257f03929caaee0396ef57312b
SHA512

b6f4ae76d0ef9a3b39881a1120e188c015bb576c1b51f4fa4cfdd30d615057427fba9bc408b48de13dad44d5bf34fe41347ec07725df4175ae17be868c613a28
SSDEEP

12288:j8KXkycFkHCjEWv2f6DoMPXaukMJutQV1whL/sYsIcLYSiXit5P0HRdjh:j8KXVce8nv2CjPKuJKQV10FsIcLjiXt9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
67a2e5db9dd6bf5404378873935dca5c_JaffaCakes118

Files

67a2e5db9dd6bf5404378873935dca5c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6ad5c8218383cadf84c45b38acffeaee

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsA
PathAppendA
SHDeleteValueA
SHDeleteKeyA
StrToIntExA

kernel32

GetOEMCP
RtlUnwind
RaiseException
GetSystemTime
LCMapStringA
GetCommandLineA
FindClose
FindFirstFileA
FindNextFileA
SetFilePointer
GetTickCount
CreateFileA
WriteFile
CreateDirectoryA
GetStartupInfoA
CreateProcessA
WaitForSingleObject
CloseHandle
WritePrivateProfileStringA
GetModuleFileNameA
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
LocalAlloc
UnhandledExceptionFilter
CreateThread
TlsFree
QueryPerformanceFrequency
QueryPerformanceCounter
FreeLibrary
GetCurrentProcess
GetVersionExA
GetVersion
DeviceIoControl
GetTimeZoneInformation
GetSystemDefaultLangID
GetLocaleInfoA
ReadFile
Process32Next
Process32First
CreateToolhelp32Snapshot
GlobalFree
GlobalUnlock
GlobalSize
GlobalLock
lstrcpyA
SizeofResource
LockResource
LoadResource
FindResourceA
LoadLibraryExA
GlobalAlloc
MultiByteToWideChar
DeleteFileA
RemoveDirectoryA
SetFileAttributesA
GetFileAttributesA
GetFileSize
GetLastError
GetVolumeInformationA
GetCurrentThreadId
LocalFree
lstrcpynA
RtlFillMemory
lstrlenA
GetProcAddress
LoadLibraryA
VirtualFree
VirtualAlloc
GetModuleHandleA
MoveFileExA
RtlMoveMemory
SetProcessAffinityMask
GetLocalTime
GetDriveTypeA
TerminateProcess
InterlockedExchange
OpenProcess
Module32Next
HeapSize
GetStringTypeA
Module32First
GlobalMemoryStatus
GetTempPathA
GetWindowsDirectoryA
Sleep
CopyFileA
EnumResourceNamesA
GetSystemDirectoryA
GetProfileStringA
SetLastError
WriteProfileStringA
lstrcatA
WinExec
InterlockedIncrement
InterlockedDecrement
GetCPInfo
FileTimeToLocalFileTime
FileTimeToSystemTime
GetProcessVersion
GlobalGetAtomNameA
GlobalAddAtomA
WideCharToMultiByte
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
SetStdHandle
GetUserDefaultLCID
EnumSystemLocalesA
IsValidCodePage
IsValidLocale
IsBadCodePtr
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetFileType
GetStdHandle
SetHandleCount
SetUnhandledExceptionFilter
IsBadWritePtr
HeapCreate
HeapDestroy
GetEnvironmentVariableA
LCMapStringW
GetStringTypeW
GlobalFindAtomA
VerLanguageNameA
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
MulDiv
DuplicateHandle
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFullPathNameA
GetFileTime
InitializeCriticalSection
TlsAlloc
DeleteCriticalSection
GlobalHandle
LeaveCriticalSection
GlobalReAlloc
EnterCriticalSection
TlsSetValue
LocalReAlloc
TlsGetValue
SetErrorMode
GlobalFlags
GetCurrentDirectoryA
GetACP

user32

DestroyWindow
DefMDIChildProcA
SetCursor
TrackMouseEvent
DestroyIcon
SetWindowLongA
UnhookWindowsHookEx
CreateWindowExA
EndDialog
CallNextHookEx
GetClassLongA
GetClientRect
DefWindowProcA
GetAsyncKeyState
GetWindowLongA
GetDlgItem
IsWindow
GetClassNameA
SetFocus
GetFocus
GetWindowRect
InvalidateRect
ValidateRect
UpdateWindow
GetParent
ScreenToClient
SendMessageA
PostQuitMessage
CallWindowProcA
LoadIconA
SetWindowsHookExA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
SetMenuDefaultItem
SetMenuItemBitmaps
SetMenuItemInfoA
CheckMenuItem
RemoveMenu
MenuItemFromPoint
GetMenuDefaultItem
GetMenuInfo
GetMenuState
GetMenuItemRect
GetMenuItemInfoA
GetMenuStringA
TrackPopupMenu
SetForegroundWindow
CheckMenuRadioItem
GetMenuItemID
GetSubMenu
SetMenuInfo
InsertMenuA
GetMenuItemCount
AppendMenuA
DestroyMenu
LoadMenuA
GetSystemMenu
CreatePopupMenu
CreateMenu
GetDialogBaseUnits
SendDlgItemMessageA
SetDlgItemTextA
GetDlgItemTextA
SetDlgItemInt
GetDlgItemInt
CreateDialogParamA
DialogBoxParamA
IsDialogMessageA
GetWindowPlacement
GetForegroundWindow
GetMessagePos
GetMessageTime
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
AdjustWindowRectEx
MapWindowPoints
LoadCursorA
GetSysColorBrush
CharUpperA
GrayStringA
DrawTextA
TabbedTextOutA
ClientToScreen
GetMenuCheckMarkDimensions
ModifyMenuA
EnableMenuItem
GetNextDlgTabItem
GetActiveWindow
GetKeyState
GetLastActivePopup
WindowFromPoint
GetWindow
PtInRect
EnumWindows
FindWindowExA
IsRectEmpty
GetCursorPos
SystemParametersInfoA
ChangeDisplaySettingsA
EnumDisplaySettingsA
SendMessageTimeoutA
FindWindowA
GetWindowThreadProcessId
SetCursorPos
mouse_event
keybd_event
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetDesktopWindow
ReleaseCapture
SetCapture
LoadImageA
VkKeyScanExA
GetDC
ReleaseDC
GetKeyboardLayout
GetDlgCtrlID
LoadStringA
UnregisterClassA
SetActiveWindow
CreateDialogIndirectParamA
LoadBitmapA
GetKeyboardState
RegisterClassExA
GetClassInfoExA
RegisterWindowMessageA
DrawMenuBar
SetMenu
GetMenu
GetSystemMetrics
IsZoomed
IsIconic
GetSysColor
FillRect
SetClassLongA
SetWindowRgn
RemovePropA
GetPropA
SetPropA
MessageBoxA
SetWindowTextA
GetWindowTextA
GetWindowTextLengthA
EnableWindow
IsWindowEnabled
ShowWindow
IsWindowVisible
SetParent
PostMessageA
MoveWindow
SetWindowPos

gdi32

SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetMapMode
ScaleWindowExtEx
GetClipBox
PtVisible
RectVisible
TextOutA
ExtTextOutA
RestoreDC
SaveDC
CreateBitmap
SelectPalette
RealizePalette
GetDIBits
CreateDCA
CreateCompatibleBitmap
GetPixel
GetDeviceCaps
RemoveFontResourceA
AddFontResourceA
EnumFontFamiliesExA
Escape
DeleteObject
GetStockObject
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
GetObjectA
StretchBlt
CreateSolidBrush
CreatePatternBrush
CreateRoundRectRgn
SetTextColor
SetBkColor
SetWindowExtEx

shell32

DragQueryFileA
SHEmptyRecycleBinA
SHChangeNotify
DragFinish
Shell_NotifyIconA
DragAcceptFiles
ShellExecuteA
SHGetSpecialFolderPathA

comctl32

InitCommonControlsEx
ord17

wininet

FtpPutFileA
FtpGetFileA
InternetFindNextFileA
FtpFindFirstFileA
FtpSetCurrentDirectoryA
FtpRemoveDirectoryA
InternetGetConnectedState
InternetOpenA
InternetOpenUrlA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
FtpGetCurrentDirectoryA
HttpSendRequestA
HttpOpenRequestA
InternetCrackUrlA
InternetSetOptionA
InternetCanonicalizeUrlA
DeleteUrlCacheEntry
FindNextUrlCacheEntryA
FindFirstUrlCacheEntryA
FtpRenameFileA
FtpDeleteFileA
InternetConnectA
FtpCreateDirectoryA

iphlpapi

SendARP
GetAdaptersInfo

ntdll

RtlCompareMemory

mpr

WNetCancelConnection2A
WNetCloseEnum
WNetEnumResourceA
WNetOpenEnumA
WNetAddConnection2A

winmm

mciSendStringA
waveOutGetDevCapsA
waveOutGetNumDevs

ws2_32

gethostbyname
gethostname
inet_ntoa
send
WSASetLastError
setsockopt
sendto
recv
select
socket
htons
connect
closesocket
WSACleanup
gethostbyaddr
WSAStartup
inet_addr

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

comdlg32

GetFileTitleA
PrintDlgA

winspool.drv

SetPrinterA
ClosePrinter
DocumentPropertiesA
EnumPrintersA
OpenPrinterA
GetPrinterA

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryValueExA
RegOpenKeyA
RegEnumKeyA
RegQueryInfoKeyA
RegSetKeySecurity
RegOpenKeyExA
CopySid
GetLengthSid
GetTokenInformation
OpenProcessToken
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
AddAce
InitializeAcl
FreeSid
AllocateAndInitializeSid
RegGetKeySecurity
RegSetValueExA
RegCreateKeyExA
GetUserNameA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyA
RegCloseKey

ole32

CoCreateInstance
CoCreateGuid

rasapi32

RasDialA
RasHangUpA
RasEnumConnectionsA
RasEnumEntriesA
RasGetEntryDialParamsA
RasGetConnectStatusA

Sections

.text
Size: 456KB - Virtual size: 455KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 516KB - Virtual size: 584KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 160KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6ad5c8218383cadf84c45b38acffeaee

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

gdi32

shell32

comctl32

wininet

iphlpapi

ntdll

mpr

winmm

ws2_32

version

comdlg32

winspool.drv

advapi32

ole32

rasapi32

Sections

.text Size: 456KB - Virtual size: 455KB

.rdata Size: 68KB - Virtual size: 64KB

.data Size: 516KB - Virtual size: 584KB

.rsrc Size: 160KB - Virtual size: 158KB

.text
Size: 456KB - Virtual size: 455KB

.rdata
Size: 68KB - Virtual size: 64KB

.data
Size: 516KB - Virtual size: 584KB

.rsrc
Size: 160KB - Virtual size: 158KB