72fc1b9ffcee5065659a1e52850ea355_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

72fc1b9ffcee5065659a1e52850ea355_JaffaCakes118
Size

200KB
MD5

72fc1b9ffcee5065659a1e52850ea355
SHA1

3c305cc375831c940889d44be84fd8cd882e082b
SHA256

94bad6575dd2a6e62da56c1914d89204fc26a0dbf0752e3509cd18d3daa75fc5
SHA512

efb8518fdb69abd744c0b85c7356042dc4ec902562a197047b9eb528b363cc5686b2b1d3ec6f2b11febd6789229f2002d8475922b564d29895c0f6e52e4b1471
SSDEEP

3072:og8kmhk4VkW0bYAiykioMMBUmM+uwgSJSb5iaA8vJk70ea1T/8phRcmYeh:5C+JPkXHVufnb5iaA6kaUph3Ys

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
72fc1b9ffcee5065659a1e52850ea355_JaffaCakes118

Files

72fc1b9ffcee5065659a1e52850ea355_JaffaCakes118
.exe windows:4 windows x86 arch:x86

114d7ecf5b38692b2948bf47a711803f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcatA
VirtualAlloc
EnterCriticalSection
FlushInstructionCache
GetCurrentProcess
lstrcpyA
GlobalUnlock
GlobalLock
GlobalAlloc
HeapDestroy
LoadLibraryA
SetCurrentDirectoryA
lstrcmpA
GetProcAddress
InterlockedIncrement
GetTickCount
GetLocalTime
WriteFile
CreateFileA
GetPrivateProfileStringA
FindClose
IsDBCSLeadByte
WideCharToMultiByte
FindFirstFileA
CreateDirectoryA
GetFileAttributesA
SetFileAttributesA
Sleep
CreateEventA
CreateThread
WaitForSingleObject
lstrcpynA
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
GetCommandLineA
GetCurrentThreadId
lstrcmpiA
lstrlenA
CreateMutexA
GetLastError
lstrlenW
GetTimeFormatA
GetCurrentDirectoryA
InterlockedDecrement
WritePrivateProfileStringA
GetStartupInfoA
SetEvent
CloseHandle

user32

OffsetRect
DispatchMessageA
SendMessageA
TranslateMessage
GetMessageA
SetForegroundWindow
GetWindowTextLengthA
PostMessageA
ShowWindow
IsIconic
GetKeyState
wvsprintfA
SetWindowRgn
PtInRect
UnionRect
IsWindowVisible
SetWindowPos
DefWindowProcA
SetWindowLongA
GetWindowLongA
CallWindowProcA
CreateWindowExA
MapWindowPoints
GetClientRect
SystemParametersInfoA
GetWindowRect
GetWindow
GetParent
RegisterClassExA
wsprintfA
LoadCursorA
GetClassInfoExA
DestroyWindow
IsChild
GetFocus
IsWindow
PostQuitMessage
GetDesktopWindow
FillRect
SetFocus
PostThreadMessageA
CharNextA
GetWindowTextA
SetWindowTextA
RegisterWindowMessageA
GetDlgItem
InvalidateRgn
InvalidateRect
SetCapture
ReleaseCapture
CreateAcceleratorTableA
GetClassNameA
RedrawWindow
GetSysColor
GetDC
LoadIconA
BeginPaint
EndPaint
EqualRect
ReleaseDC
IntersectRect

gdi32

CreateRectRgnIndirect
CloseMetaFile
RestoreDC
SetWindowExtEx
SetWindowOrgEx
SaveDC
CreateMetaFileA
GetDeviceCaps
DeleteDC
SetViewportOrgEx
SetMapMode
LPtoDP
CreateDCA
BitBlt
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
DeleteObject
CreateSolidBrush
GetObjectA
GetStockObject
DeleteMetaFile

advapi32

RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyExA
RegDeleteValueA
RegSetValueExA
RegQueryInfoKeyA
RegEnumValueA
RegQueryValueExA

shell32

SHGetSpecialFolderPathA
ShellExecuteExA

ole32

OleInitialize
CoTaskMemAlloc
CoTaskMemRealloc
CreateDataAdviseHolder
CoRegisterClassObject
CoRevokeClassObject
CoCreateInstance
OleLoadFromStream
WriteClassStm
OleSaveToStream
CLSIDFromProgID
CLSIDFromString
StringFromCLSID
OleLockRunning
CreateStreamOnHGlobal
OleUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CreateFileMoniker
CoTaskMemFree
CoInitialize
CoUninitialize

oleaut32

SysStringLen
SysFreeString
SysAllocStringLen
VarUI4FromStr
SysAllocString
LoadTypeLi
RegisterTypeLi
VariantClear
VariantChangeType
SysAllocStringByteLen
SysStringByteLen
LoadRegTypeLi
OleCreateFontIndirect
VariantInit

msvcrt

strcat
realloc
_purecall
_XcptFilter
_exit
__CxxFrameHandler
_mbsstr
_mbsdec
_mbsinc
fopen
fscanf
fgets
exit
_mbsrchr
malloc
free
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
_mbsnbcmp
_mbsnbicmp
strcpy
_mbsicmp
_mbstok
memset
__set_app_type
__p__fmode
memcmp
_controlfp
_onexit
__dllonexit
_except_handler3
_mbscmp
strlen
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln

msvcp60

??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ

Exports

Exports

?COMWndProc@@YGJPAUHWND__@@IIJ@Z

Sections

.text
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.HPCUE
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 116KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

114d7ecf5b38692b2948bf47a711803f

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcrt

msvcp60

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 53KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 8KB - Virtual size: 8KB

.HPCUE Size: 4KB - Virtual size: 4B

.rsrc Size: 116KB - Virtual size: 112KB

.text
Size: 56KB - Virtual size: 53KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 8KB - Virtual size: 8KB

.HPCUE
Size: 4KB - Virtual size: 4B

.rsrc
Size: 116KB - Virtual size: 112KB