84652794c57955ff2e2bd69b9e1805c0_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

84652794c57955ff2e2bd69b9e1805c0_JaffaCakes118
Size

496KB
MD5

84652794c57955ff2e2bd69b9e1805c0
SHA1

4cf6863fc65621f0a7ae7df40b6a31f6e97fb0d8
SHA256

0482558cd7e4919166988ac9f2e4073a223636eea37af6d4fe82f88476db3d5f
SHA512

4c878b359208889b99b9aa240b0ec65b063f2e37bb8deed6248925e0552a7131d5794fc73f1f95227f1f413d2fc0e6b8a573d1b487ab6de3e88d629ceba28c1e
SSDEEP

12288:ojQNg4aFWUZcwbpOIWiOcUiN8lqwX/ZVYBQf:tWwUb/KqQZ6BQf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
84652794c57955ff2e2bd69b9e1805c0_JaffaCakes118

Files

84652794c57955ff2e2bd69b9e1805c0_JaffaCakes118
.exe windows:5 windows x86 arch:x86

fa8559fde0066a5d730d48f0b5074068

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

iphlpapi

IcmpCreateFile
IcmpSendEcho
IcmpCloseHandle

ws2_32

connect
setsockopt
WSAAsyncSelect
socket
accept
listen
htons
inet_addr
inet_ntoa
WSAGetLastError
bind
htonl
send
recv
closesocket
WSAStartup
WSAGetOverlappedResult
WSAIoctl
WSASocketA
WSACleanup
ioctlsocket
getsockname
ntohs
getsockopt
WSASetLastError
gethostbyname
select
__WSAFDIsSet
recvfrom
sendto

wldap32

ord200
ord46
ord41
ord27
ord301
ord33
ord79
ord35
ord32
ord30
ord26
ord50
ord60
ord143
ord211
ord22

avicap32

capGetDriverDescriptionA
capCreateCaptureWindowA

dsound

ord12
ord7

netapi32

NetApiBufferFree
NetShareEnum

kernel32

InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
FlushFileBuffers
GetModuleHandleA
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
VirtualFree
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetCPInfo
LCMapStringW
LCMapStringA
SetFilePointer
GetCurrentThreadId
GetStartupInfoA
GetCommandLineA
MoveFileA
GetConsoleMode
GetConsoleCP
GetFileInformationByHandle
SetStdHandle
SetHandleCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FileTimeToLocalFileTime
FileTimeToSystemTime
RemoveDirectoryA
GetTempPathA
GetLastError
SetEvent
ExitThread
LeaveCriticalSection
EnterCriticalSection
lstrlenA
MultiByteToWideChar
InterlockedExchange
CreateThread
CreateEventA
CloseHandle
WaitForSingleObject
FindResourceA
SizeofResource
LockResource
LoadResource
FindResourceExA
DeleteFileA
SetFileAttributesA
InitializeCriticalSection
FindClose
FreeEnvironmentStringsA
FindFirstFileA
Process32Next
TerminateProcess
GetExitCodeProcess
OpenProcess
Process32First
CreateToolhelp32Snapshot
GetCurrentDirectoryA
Sleep
CreateDirectoryA
SetCurrentDirectoryA
GetModuleFileNameA
GetDriveTypeA
GetLogicalDriveStringsA
SetErrorMode
CopyFileA
MoveFileExA
WaitForMultipleObjects
GetComputerNameA
GetSystemDirectoryA
WriteFile
CreateFileA
TerminateThread
ResetEvent
SleepEx
SetLastError
DuplicateHandle
GetCurrentProcess
ReleaseMutex
CreateMutexA
GetExitCodeThread
ReadFile
PeekNamedPipe
GetFileType
GetStdHandle
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
ExpandEnvironmentStringsA
FormatMessageA
GetFullPathNameA
SetEnvironmentVariableA
ExitProcess
GetSystemTimeAsFileTime
GetDateFormatA
GetTimeFormatA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
VirtualProtect
RtlUnwind
GetProcessHeap
HeapSize
CompareStringW
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
RaiseException
DeleteCriticalSection
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
GetLocaleInfoW
CreateProcessA
GetFileAttributesA
SetEndOfFile
CompareStringA
FindNextFileA
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement

user32

IsWindow
RegisterClassExA
PostThreadMessageA
SetTimer
DestroyWindow
PeekMessageA
SendInput
GetClassNameA
GetWindowTextA
GetForegroundWindow
CallNextHookEx
SetWindowsHookExA
DefWindowProcA
PostQuitMessage
CreateWindowExA
DispatchMessageA
TranslateMessage
GetWindowDC
GetDesktopWindow
SetWindowTextA
wsprintfA
SendMessageA
KillTimer
GetMessageA

gdi32

BitBlt
GetDIBits
CreateCompatibleBitmap
GetDeviceCaps
CreateCompatibleDC
SelectObject
SetDIBColorTable
CreateDIBSection
DeleteObject
DeleteDC
GetObjectA

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA

shell32

ShellExecuteA
SHGetFolderPathA

ole32

CoInitializeEx
CoCreateGuid
CoCreateInstance
CoUninitialize

oleaut32

SysAllocString
SysFreeString
SysStringLen

shlwapi

PathFindExtensionW
PathFindExtensionA

gdiplus

GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdiplusShutdown
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipFree
GdipDisposeImage
GdipCloneImage
GdipAlloc

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape

Sections

.text
Size: 419KB - Virtual size: 419KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fa8559fde0066a5d730d48f0b5074068

Headers

DLL Characteristics

File Characteristics

Imports

iphlpapi

ws2_32

wldap32

avicap32

dsound

netapi32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

Exports

Exports

Sections

.text Size: 419KB - Virtual size: 419KB

.rdata Size: 68KB - Virtual size: 67KB

.data Size: 7KB - Virtual size: 17KB

.rsrc Size: 512B - Virtual size: 436B

.text
Size: 419KB - Virtual size: 419KB

.rdata
Size: 68KB - Virtual size: 67KB

.data
Size: 7KB - Virtual size: 17KB

.rsrc
Size: 512B - Virtual size: 436B