70711c0f5158d27f9d4dd12916a7a286_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

70711c0f5158d27f9d4dd12916a7a286_JaffaCakes118
Size

435KB
MD5

70711c0f5158d27f9d4dd12916a7a286
SHA1

8c71b653e24f817aabb60d83aa1c9038c2f359d6
SHA256

15c563d0f366e7a7d83bfce6da148371741d0a93adbef6faec1550c79252b57a
SHA512

440c6a65b988286401aebb399c6697a80ba47489367d84522a269911b8d94f8a5340084440e29923da85e6b15a21bd4e231a35e7e6af5eaa262692a49dbfff93
SSDEEP

12288:HiDsTcZBVb/w5vkI0QoVs4Hct5vjoLHnZ5:/4ZXb/w5T+sEK5v655

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
70711c0f5158d27f9d4dd12916a7a286_JaffaCakes118

Files

70711c0f5158d27f9d4dd12916a7a286_JaffaCakes118
.exe windows:6 windows x86 arch:x86

7e4121731cdd56f2c1b768bc5840de04

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

wloobe.pdb

Imports

advapi32

RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
GetTokenInformation
ConvertSidToStringSidW
DuplicateTokenEx
CryptGenRandom
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextW
CryptReleaseContext
CreateWellKnownSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenProcessToken
SetNamedSecurityInfoW
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
SetSecurityInfo
CopySid
IsValidSid
GetLengthSid
InitializeAcl
AddAce
GetUserNameW

kernel32

CreateProcessW
OpenProcess
GetTempPathA
GetFullPathNameA
DeleteFileA
GetFileInformationByHandle
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetFileAttributesA
InterlockedCompareExchange
GetTempPathW
GetLocalTime
GetFullPathNameW
ReadFile
GetUserDefaultLangID
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CreateMutexW
OpenMutexW
LocalAlloc
SetFileAttributesW
RemoveDirectoryW
MoveFileExW
GetEnvironmentVariableW
GetFileAttributesW
CreateDirectoryW
GetPrivateProfileStringW
ReleaseMutex
CreateFileW
DeviceIoControl
FindNextFileW
FindFirstFileW
FindClose
EnumResourceNamesW
GetSystemInfo
VerSetConditionMask
VerifyVersionInfoW
ExpandEnvironmentStringsW
FindResourceExW
CompareStringA
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
CopyFileW
LoadLibraryW
GetComputerNameW
GetStringTypeW
GetStringTypeA
LCMapStringW
WideCharToMultiByte
LCMapStringA
LoadLibraryA
HeapSize
Sleep
GetOEMCP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
VirtualAlloc
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapCreate
HeapDestroy
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
LockResource
WaitForSingleObject
CompareStringW
CloseHandle
GetModuleHandleW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
HeapSetInformation
GetModuleFileNameW
LoadLibraryExW
lstrcmpiW
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
lstrlenW
FreeLibrary
FormatMessageW
GetLastError
LocalFree
InterlockedDecrement
DeleteCriticalSection
InitializeCriticalSection
RaiseException
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoW
HeapReAlloc
RtlUnwind
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA

user32

GetKeyState
GetFocus
RegisterClassExW
InvalidateRect
PtInRect
UpdateWindow
IsWindowEnabled
KillTimer
NotifyWinEvent
GetNextDlgTabItem
CreateAcceleratorTableW
CharNextW
TranslateAcceleratorW
IsDialogMessageW
TranslateMessage
EnumChildWindows
DestroyAcceleratorTable
GetLayeredWindowAttributes
SetLayeredWindowAttributes
EnableWindow
PostQuitMessage
RegisterWindowMessageW
SetCursor
DefWindowProcW
IsWindowVisible
SetFocus
ShowWindow
GetWindowTextLengthW
GetWindowTextW
GetClassNameW
GetDesktopWindow
SystemParametersInfoW
CopyRect
GetSysColor
MessageBoxIndirectW
BeginPaint
EndPaint
RedrawWindow
MessageBeep
CreateDialogIndirectParamW
DialogBoxIndirectParamW
LoadCursorW
DefDlgProcW
TrackMouseEvent
GetDCEx
SetWindowRgn
GetWindowThreadProcessId
GetShellWindow
SetProcessDefaultLayout
DispatchMessageW
PostMessageW
SetWindowLongW
SetWindowTextW
LoadStringW
GetMessageW
FillRect
InflateRect
GetWindowLongW
AdjustWindowRectEx
SetWindowPos
GetSystemMetrics
DrawTextW
LoadIconW
ReleaseDC
GetDC
EndDialog
GetWindowRect
GetClientRect
GetParent
CreateWindowExW
UnregisterClassA
IsWindow
DestroyWindow
SendMessageW
SetRect

urlmon

CreateAsyncBindCtx
CreateURLMoniker
CoInternetGetSession

msi

ord195
ord173
ord203
ord70
ord205
ord113

comctl32

ord413
ord410
ord412
ord17

wintrust

WTHelperGetProvSignerFromChain
WinVerifyTrustEx
WTHelperProvDataFromStateData

userenv

UnloadUserProfile

crypt32

CryptStringToBinaryW
CertVerifyCertificateChainPolicy

uxtheme

SetWindowTheme

shlwapi

PathIsDirectoryW
PathFileExistsW
SHCreateStreamOnFileA
StrRChrW
PathIsRelativeW
PathFindExtensionW
SHCreateStreamOnFileW
PathFindFileNameA
PathFindFileNameW
UrlCreateFromPathW

wininet

InternetCrackUrlW
InternetCreateUrlW
InternetCombineUrlW

gdiplus

GdipDrawImagePointRectI
GdipDrawImageRectI
GdiplusShutdown
GdiplusStartup
GdipDeleteGraphics
GdipGetImageWidth
GdipGetImageHeight
GdipCreateFromHDC
GdipDrawImageRectRectI
GdipFree
GdipAlloc
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipDeleteFont
GdipDisposeImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipDrawImageI
GdipCreateFont
GdipGetLogFontW
GdipCloneImage
GdipDrawImageRectRect
GdipCreateFromHWND

winhttp

WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect

cabinet

ord11
ord14
ord13
ord10

shell32

SHGetFolderPathW
SHFileOperationW
CommandLineToArgvW
SHGetFolderPathAndSubDirW

ole32

CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoInitializeEx
CoCreateFreeThreadedMarshaler
CoSetProxyBlanket
CoUninitialize
CoTaskMemAlloc
CreateStreamOnHGlobal
CoCreateGuid
OleRun
OleLockRunning

oleaut32

VariantChangeType
VariantClear
VariantInit
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
VarUI4FromStr

gdi32

CreateRectRgn
GetClipRgn
IntersectClipRect
CreateSolidBrush
CreatePen
GetTextMetricsW
SetTextColor
DeleteObject
GetObjectW
ExcludeClipRect
BitBlt
DeleteDC
SelectObject
RestoreDC
SetLayout
SetBkColor
SaveDC
GetStockObject
CreateFontIndirectW
CreateCompatibleDC
SetBkMode

Sections

.text
Size: 286KB - Virtual size: 285KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 9KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 102KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7e4121731cdd56f2c1b768bc5840de04

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

urlmon

msi

comctl32

wintrust

userenv

crypt32

uxtheme

shlwapi

wininet

gdiplus

winhttp

cabinet

shell32

ole32

oleaut32

gdi32

Sections

.text Size: 286KB - Virtual size: 285KB

.data Size: 9KB - Virtual size: 21KB

.rsrc Size: 32KB - Virtual size: 31KB

.reloc Size: 102KB - Virtual size: 104KB

.text
Size: 286KB - Virtual size: 285KB

.data
Size: 9KB - Virtual size: 21KB

.rsrc
Size: 32KB - Virtual size: 31KB

.reloc
Size: 102KB - Virtual size: 104KB