832f2f8fcdfc5b9566a2758d4d475aa0_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

832f2f8fcdfc5b9566a2758d4d475aa0_JaffaCakes118
Size

340KB
MD5

832f2f8fcdfc5b9566a2758d4d475aa0
SHA1

f5f42607681f8ccd9e1108341ed7310de7edd57f
SHA256

1bb3b051ffdfd0e91032946acc88d0770b6e149fa2f2f7648c23460da5718d8f
SHA512

c447fbea7a499d934f44c643237cf4a79726f2ff4a8cbc2889555dbeaee8140893ebbb3b24bbd54b739d436bc43c9e624d190c878b21eacfe484b2499788e7b6
SSDEEP

6144:FQrxLR6th6aZXf2EyScxqYMWvMhw/piZBmPtbS0mydiLNBRp1LozSYrDGU+:J4aZXf2acxFMW1wZBmlriXdo2YrDGU+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
832f2f8fcdfc5b9566a2758d4d475aa0_JaffaCakes118

Files

832f2f8fcdfc5b9566a2758d4d475aa0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bdc78b384b41303d3118b444d4deec69

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

netapi32

NetMessageBufferSend

kernel32

GetEnvironmentVariableA
GetExitCodeProcess
GetFileAttributesW
GetFileSize
GetFileTime
GetFileType
GetLastError
GetLocalTime
GetLocaleInfoA
GetLocaleInfoW
GetLogicalDrives
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetPrivateProfileSectionW
GetPrivateProfileStringW
GetProcAddress
GetProcessHeap
GetShortPathNameW
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemTime
GetSystemTimeAsFileTime
GetTempFileNameW
GetTempPathW
GetTickCount
GetTimeFormatA
GetTimeFormatW
GetTimeZoneInformation
GetVersion
GetVersionExA
GetVersionExW
GetWindowsDirectoryW
GlobalMemoryStatus
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsBadCodePtr
GetEnvironmentStringsW
IsBadWritePtr
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalAlloc
LocalFree
MapViewOfFile
MoveFileExW
MoveFileW
MultiByteToWideChar
OpenFileMappingW
OpenMutexW
OpenProcess
QueryDosDeviceW
ReadFile
ReadProcessMemory
ReleaseMutex
ResetEvent
RtlUnwind
GetEnvironmentStringsA
SetEnvironmentVariableA
SetEvent
SetFileAttributesW
SetFilePointer
SetHandleCount
SetLastError
SetStdHandle
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
TerminateThread
TlsAlloc
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
WritePrivateProfileSectionW
WritePrivateProfileStringW
lstrcmpA
lstrlenA
lstrlenW
GetDriveTypeW
GetDiskFreeSpaceW
GetDateFormatW
GetDateFormatA
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetComputerNameW
GetComputerNameA
GetCommandLineA
GetCPInfo
GetACP
FreeLibrary
FreeEnvironmentStringsW
FreeEnvironmentStringsA
FlushFileBuffers
FindNextFileW
FindFirstFileW
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
ExpandEnvironmentStringsW
ExitProcess
EnterCriticalSection
DuplicateHandle
DeviceIoControl
DeleteFileW
DeleteCriticalSection
CreateThread
CreateProcessW
CreateMutexW
CreateFileW
CreateFileMappingW
CreateFileA
CreateEventW
CreateDirectoryW
CopyFileW
CompareStringW
CompareStringA
CompareFileTime
CloseHandle
IsBadReadPtr
SetEndOfFile

user32

wsprintfW
TranslateMessage
SetTimer
SendMessageW
RegisterClassW
PostMessageW
PeekMessageW
MsgWaitForMultipleObjects
LoadStringW
KillTimer
GetMessageW
DispatchMessageW
CreateWindowExW
DefWindowProcW

advapi32

RegOpenKeyExW
RegOpenKeyA
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
QueryServiceStatus
OpenThreadToken
OpenServiceW
OpenSCManagerW
OpenProcessToken
LookupAccountSidW
IsValidSid
InitializeSecurityDescriptor
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
GetSecurityDescriptorDacl
GetKernelObjectSecurity
FreeSid
EqualSid
DuplicateTokenEx
DuplicateToken
DeleteService
CreateServiceW
CreateProcessAsUserW
ControlService
CloseServiceHandle
AllocateAndInitializeSid
RegQueryInfoKeyW
RegQueryValueExA
RegQueryValueExW
RegSetValueExW
RegisterServiceCtrlHandlerW
RevertToSelf
SetKernelObjectSecurity
SetSecurityDescriptorDacl
SetServiceStatus
SetThreadToken
StartServiceCtrlDispatcherW
StartServiceW
RegEnumKeyExW
RegEnumKeyW
RegEnumValueW
RegDeleteValueW

wsock32

WSASetLastError
WSAGetLastError
__WSAFDIsSet
closesocket
connect
gethostbyname
htons
ioctlsocket
inet_ntoa
recv
select
send
setsockopt
socket
WSACleanup
WSAStartup

ole32

CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

VariantClear
SysFreeString
SysAllocString

Exports

Exports

adler32
compress
compress2
compressBound
crc32
deflate
deflateBound
deflateCopy
deflateEnd
deflateInit2_
deflateInit_
deflateParams
deflatePrime
deflateReset
deflateSetDictionary
get_crc_table
gzclearerr
gzclose
gzdopen
gzeof
gzerror
gzflush
gzgetc
gzgets
gzopen
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzsetparams
gztell
gzungetc
gzwrite
inflate
inflateBack
inflateBackEnd
inflateBackInit_
inflateCopy
inflateEnd
inflateInit2_
inflateInit_
inflateReset
inflateSetDictionary
inflateSync
inflateSyncPoint
uncompress
zError
zlibCompileFlags
zlibVersion

Sections

.text
Size: 232KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bdc78b384b41303d3118b444d4deec69

Headers

File Characteristics

Imports

netapi32

kernel32

user32

advapi32

wsock32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 232KB - Virtual size: 232KB

.rdata Size: 44KB - Virtual size: 44KB

.data Size: 24KB - Virtual size: 1.7MB

.idata Size: 8KB - Virtual size: 8KB

.rsrc Size: 28KB - Virtual size: 28KB

.text
Size: 232KB - Virtual size: 232KB

.rdata
Size: 44KB - Virtual size: 44KB

.data
Size: 24KB - Virtual size: 1.7MB

.idata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 28KB - Virtual size: 28KB