8612e1250468477385b1c0a0615f419b_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

8612e1250468477385b1c0a0615f419b_JaffaCakes118
Size

416KB
MD5

8612e1250468477385b1c0a0615f419b
SHA1

ffd61e161a1d2a6671caa71916bcf597713858a4
SHA256

5f9d8a6fe993ebdff7b266d8ee24d720fe6243381dfe7cb66ab11ee73c3563c9
SHA512

41fb9ce45ff8d7c2a5bb9ac0551de7d7a0ff56137390d0d2482e4b96dd2665b7f42d58eda2a173fcbaacd59a793a1327631255dfb303ae1f64abfe5cd35397d1
SSDEEP

12288:nvRFi55LuGwFJQOnAJdWkW0Ht5BmZUQeR3Sc1Vq1Ttj2WAndI:n5FivLuGGJQbXHoA3at6WQd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8612e1250468477385b1c0a0615f419b_JaffaCakes118

Files

8612e1250468477385b1c0a0615f419b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4688f918c8352fed309b56c6dedb55eb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

InitializeSecurityDescriptor
StartServiceCtrlDispatcherA
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegGetKeySecurity
RegOpenKeyExW
RegSetValueExW
BuildImpersonateTrusteeA
ConvertStringSDToSDRootDomainA
CreateRestrictedToken
CreateTraceInstanceId
CryptCreateHash
DuplicateToken
ElfOpenBackupEventLogA
EqualPrefixSid
GetMultipleTrusteeW
LookupSecurityDescriptorPartsA
LsaSetDomainInformationPolicy
ObjectCloseAuditAlarmW
RegFlushKey
RegNotifyChangeKeyValue
RegOpenUserClassesRoot
SystemFunction003
SystemFunction006
SystemFunction021
UnregisterTraceGuids

gdi32

GetViewportExtEx
SetBkMode
AddFontMemResourceEx
ColorMatchToTarget
CreateDCA
CreateHalftonePalette
DeleteColorSpace
DeleteObject
FloodFill
GdiPlayEMF
GetDeviceCaps
GetFontAssocStatus
GetPolyFillMode
GetRegionData
SetICMMode
SetStretchBltMode
TranslateCharsetInfo

kernel32

ExitProcess
VirtualAlloc
CloseHandle
CreateFileW
DeleteFileW
DisableThreadLibraryCalls
EnterCriticalSection
FatalAppExitA
FindClose
FindFirstFileW
FindNextFileW
FreeEnvironmentStringsW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetFileAttributesW
GetLastError
GetProcessHeap
GetSystemTimeAsFileTime
GetTempPathW
GetTickCount
HeapAlloc
HeapFree
InterlockedCompareExchange
InterlockedExchange
InterlockedIncrement
LeaveCriticalSection
QueryPerformanceCounter
RemoveDirectoryW
ResetEvent
SetConsoleScreenBufferSize
SetFileAttributesW
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
UnhandledExceptionFilter
lstrcpy
LoadResource
FindResourceA
CreateFileMappingW
DeleteCriticalSection
FindResourceW
FreeLibrary
GetFileSize
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetSystemInfo
GetVersion
GetVersionExW
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
HeapDestroy
InitializeCriticalSection
InterlockedDecrement
LoadLibraryExW
LoadLibraryW
MapViewOfFile
OutputDebugStringA
SizeofResource
UnmapViewOfFile
VirtualProtect
VirtualQuery
WideCharToMultiByte
lstrcatW
lstrcmpiW
lstrcpyW
lstrcpynW
lstrlenA
lstrlenW
AddConsoleAliasA
BuildCommDCBW
CompareStringW
CreateMutexA
DisconnectNamedPipe
EndUpdateResourceW
FindNextVolumeMountPointA
FlushInstructionCache
FoldStringA
GetDriveTypeA
GetEnvironmentStrings
GetOEMCP
GetPrivateProfileSectionA
GetPrivateProfileStringA
GetStringTypeW
GetTempFileNameW
GetThreadPriority
GetTimeFormatW
GetUserDefaultLangID
IsBadHugeReadPtr
IsValidCodePage
ReadFileScatter
ReplaceFileA
ResetWriteWatch
ScrollConsoleScreenBufferW
SetComputerNameExW
SetConsoleTitleW
SetCriticalSectionSpinCount
SetThreadContext
SetThreadIdealProcessor
SetupComm
UpdateResourceW
lstrcmpi
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
MultiByteToWideChar
HeapSize
RtlUnwind
HeapReAlloc
GetACP
GetCPInfo
LoadLibraryA
IsDebuggerPresent
VirtualFree
HeapCreate
TlsSetValue
TlsGetValue
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
GetStdHandle
WriteFile
GetStartupInfoA
GetVersionExA
GetCommandLineA

ole32

StgPropertyLengthAsVariant
StgCreatePropSetStg
ReadStringStream
PropSysFreeString
OleRegEnumFormatEtc
OleMetafilePictFromIconAndLabel
OleCreateEx
HMETAFILEPICT_UserUnmarshal
HGLOBAL_UserSize
CreateBindCtx
CoRegisterMallocSpy
CoInitializeWOW
CoFreeUnusedLibraries
CoCreateFreeThreadedMarshaler
CreateStreamOnHGlobal
CoTaskMemFree
StringFromGUID2
CoUninitialize
CoSetProxyBlanket
CoCreateInstance
CoCreateGuid
CoTaskMemRealloc

oleaut32

VarI2FromDisp
VarI4FromR8
VarR4CmpR8
VarUI1FromI1
VarUI1FromI2
BstrFromVector
LPSAFEARRAY_UserSize
LoadTypeLi
OleCreatePropertyFrameIndirect
OleLoadPicture
OleTranslateColor
SafeArrayCreateVectorEx
SafeArraySetRecordInfo
SafeArrayUnlock
VarBstrFromCy
VarCyFromBool
VarCyFromI1
VarDateFromStr
BSTR_UserFree

rpcrt4

NdrRpcSmClientAllocate
NdrServerContextUnmarshall
RpcBindingSetAuthInfoW
RpcMgmtInqDefaultProtectLevel
RpcMgmtInqServerPrincNameW
RpcServerRegisterIf2
RpcServerUseProtseqA
RpcServerUseProtseqIfA
RpcSmClientFree
UuidFromStringA
UuidHash
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
MesDecodeBufferHandleCreate
MesHandleFree
NDRCContextUnmarshall
NdrComplexArrayUnmarshall
NdrComplexStructFree
NdrConformantVaryingStructFree
NdrInterfacePointerMemorySize
NdrNonConformantStringBufferSize
NdrNonConformantStringUnmarshall
I_RpcSsDontSerializeContext
NdrNonEncapsulatedUnionUnmarshall

user32

ChildWindowFromPointEx
CreateAcceleratorTableA
CreateDialogIndirectParamA
CreateIconIndirect
DdeCreateStringHandleA
DdeCreateStringHandleW
DdeQueryConvInfo
DdeQueryStringW
ChangeDisplaySettingsW
DrawAnimatedRects
DrawEdge
DrawFrameControl
EnumDisplayDevicesA
EnumDisplaySettingsA
GetClipboardFormatNameW
GetClipboardSequenceNumber
GetFocus
GetKBCodePage
DestroyIcon
GetMenuItemInfoW
GetMenuStringW
GetMessageW
GetSysColor
GetWindowRgn
GrayStringA
IntersectRect
LoadStringW
LockWindowUpdate
MessageBoxA
MessageBoxIndirectA
OpenDesktopA
RegisterClipboardFormatW
RegisterWindowMessageW
ReuseDDElParam
ScrollDC
SendDlgItemMessageA
SendIMEMessageExW
SendMessageCallbackA
SetClassLongW
SetClipboardData
SetClipboardViewer
SetMenuContextHelpId
SetPropA
SetUserObjectInformationA
ShowWindowAsync
UnhookWinEvent
UpdateLayeredWindow
WinHelpW
CopyIcon
CharPrevW
CharNextW
TranslateMessage
SetCursorPos
PeekMessageW
MsgWaitForMultipleObjects
GetWindowPlacement
ExitWindowsEx
DispatchMessageW
DdeUnaccessData
CharUpperBuffW
GetKeyState
DestroyWindow

Sections

.text
Size: 128KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 268KB - Virtual size: 271KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4688f918c8352fed309b56c6dedb55eb

Headers

File Characteristics

Imports

advapi32

gdi32

kernel32

ole32

oleaut32

rpcrt4

user32

Sections

.text Size: 128KB - Virtual size: 126KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 268KB - Virtual size: 271KB

.text
Size: 128KB - Virtual size: 126KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 268KB - Virtual size: 271KB