784d21a2b4818b09e829e20032480873_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

784d21a2b4818b09e829e20032480873_JaffaCakes118
Size

138KB
MD5

784d21a2b4818b09e829e20032480873
SHA1

5be90b5a99cbf9c4f0b57f1e4d877e7700c165c8
SHA256

27814fbe095b184463bd558b2ddf699b2c2db45df0400d42a0b23c84b2d1e048
SHA512

5598beee375cf07590a911c95c50997a46e97d68df0192e87a374c5023456690111fed4adabc1f92ab367b667fdee6a160adde416f567af68d2c932c1d6e211e
SSDEEP

3072:7ta1DOEuKs05uTvsPnvEnHAMS8odEquzS7PCXyudM6n7tQU:7taBns1TvsPnT80EZ27Od9pQU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
784d21a2b4818b09e829e20032480873_JaffaCakes118

Files

784d21a2b4818b09e829e20032480873_JaffaCakes118
.exe windows:5 windows x86 arch:x86

3a010b9e87eedc0d260a4e55fcc8d175

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Thread32Next
ReadFile
GetTimeZoneInformation
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
SetLastError
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
FindClose
LoadLibraryA
RemoveDirectoryW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
FileTimeToDosDateTime
CreateThread
HeapCreate
CreateRemoteThread
Process32FirstW
Process32NextW
GetCommandLineW
SetErrorMode
GetComputerNameW
GetVersionExW
OpenEventW
DuplicateHandle
GetCurrentProcessId
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
GetLocalTime
GetNativeSystemInfo
TlsGetValue
TlsSetValue
TerminateProcess
ResetEvent
GetThreadContext
SetThreadContext
GetProcessId
GetEnvironmentVariableW
ExpandEnvironmentStringsW
HeapDestroy
ReadProcessMemory
VirtualFreeEx
WideCharToMultiByte
Thread32First
OpenProcess
WriteFile
VirtualQueryEx
LocalFree
GetPrivateProfileIntW
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualFree
GetCurrentThread
HeapFree
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
SetThreadPriority
GetTempFileNameW
GetPrivateProfileStringW
GetUserDefaultUILanguage
GetModuleFileNameW
MoveFileExW
WaitForMultipleObjects
CreateEventW
GetCurrentThreadId
GlobalUnlock
GetTickCount
GlobalLock
GetSystemTime
SetFileAttributesW
CloseHandle
WTSGetActiveConsoleSessionId
lstrcmpiA
CreateFileW
GetFileAttributesW
Sleep
LoadLibraryW
SetEvent
WaitForSingleObject
CreateDirectoryW
FreeLibrary
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetFileAttributesExW
lstrcmpiW
GetProcAddress
WriteProcessMemory
GetModuleHandleW

user32

WindowFromPoint
GetWindowLongW
CharLowerA
CharUpperW
SetWindowLongW
SendMessageTimeoutW
GetWindow
DispatchMessageW
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
MsgWaitForMultipleObjects
GetUserObjectInformationW
OpenWindowStationW
GetKeyboardState
ToUnicode
CharLowerW
CharToOemW
EndPaint
TrackPopupMenuEx
GetUpdateRgn
GetMessageW
RegisterClassExA
GetWindowDC
SetCapture
GetWindowRect
GetParent
GetMenuItemRect
GetClassLongW
GetAncestor
SetWindowPos
IsWindow
MapWindowPoints
GetSystemMetrics
DrawIcon
GetIconInfo
FillRect
GetWindowInfo
DrawEdge
IntersectRect
EqualRect
PrintWindow
IsRectEmpty
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
GetSubMenu
MenuItemFromPoint
SystemParametersInfoW
GetClassNameW
GetTopWindow
GetMenuState
GetMenu
SetThreadDesktop
GetMenuItemCount
LoadImageW
HiliteMenuItem
SendMessageW
RegisterClassA
DefFrameProcW
EndMenu
GetWindowThreadProcessId
GetShellWindow
ExitWindowsEx
DefDlgProcW
DefFrameProcA
OpenInputDesktop
BeginPaint
GetUpdateRect
GetDC
GetCapture
TranslateMessage
RegisterClassExW
SetCursorPos
GetClipboardData
PeekMessageW
GetDCEx
PeekMessageA
ReleaseDC
DefWindowProcA
GetCursorPos
DefMDIChildProcW
MapVirtualKeyW
PostMessageW
CharLowerBuffA
GetMessageA
GetMessagePos
DefWindowProcW
CallWindowProcW
CallWindowProcA
RegisterClassW
ReleaseCapture
DefMDIChildProcA
DefDlgProcA
SwitchDesktop
PostThreadMessageW

advapi32

EqualSid
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegSetValueExW
CryptHashData
GetLengthSid
IsWellKnownSid
ConvertSidToStringSidW
InitiateSystemShutdownExW

shlwapi

StrStrIA
StrCmpNIW
PathQuoteSpacesW
PathIsURLW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveBackslashW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
StrStrIW
PathRenameExtensionW
PathRemoveFileSpecW

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

RestoreDC
SaveDC
DeleteDC
GdiFlush
SetViewportOrgEx
SelectObject
CreateCompatibleDC
CreateDIBSection
GetDeviceCaps
GetDIBits
DeleteObject
SetRectRgn
CreateCompatibleBitmap

ws2_32

getsockname
WSAEventSelect
freeaddrinfo
recv
sendto
select
getaddrinfo
recvfrom
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
WSAGetLastError
shutdown
setsockopt
bind
socket
WSASetLastError
accept
getpeername
WSASend
closesocket
send
listen

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
PFXImportCertStore
CryptUnprotectData

wininet

HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpAddRequestHeadersA
InternetQueryOptionA
InternetOpenA
HttpOpenRequestA
InternetSetOptionA
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
InternetCloseHandle
HttpSendRequestA
HttpSendRequestW
InternetReadFile
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpQueryInfoA
HttpSendRequestExA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3a010b9e87eedc0d260a4e55fcc8d175

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 130KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 130KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB