87873f8b48639dd309c99357ce42a1ec_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

87873f8b48639dd309c99357ce42a1ec_JaffaCakes118
Size

276KB
MD5

87873f8b48639dd309c99357ce42a1ec
SHA1

37f9f1eedb87e187e7b1c177f56fd39d7f65e398
SHA256

4259247b37e45ecd5fcc80f7d578675d9e6de93fcedb3b1898f284131f202cfe
SHA512

ef989c3210efa2cb0d336c477807ef6481f6a900fa8fbecd430e92a9e1ec076a535deda61246de3447a247e460416da989c938216a719f3a9c4c5ec5350757af
SSDEEP

6144:fcMuYB3h9lfKxGungwThh7DNdcEwxYN0NP:fcMuYBRK7gOlpw+N0NP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
87873f8b48639dd309c99357ce42a1ec_JaffaCakes118

Files

87873f8b48639dd309c99357ce42a1ec_JaffaCakes118
.exe windows:4 windows x86 arch:x86

67d80d27f309b0d5b894115850027ba2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

rpcrt4

UuidCreateNil
UuidToStringA
RpcStringFreeA
UuidCreate

ws2_32

gethostbyname
gethostname
accept
inet_addr
WSAGetLastError
recv
WSAStartup
WSALookupServiceEnd
htons
socket
bind
listen
closesocket
WSACleanup
WSAAsyncSelect
select
__WSAFDIsSet
shutdown
WSASetLastError
connect
send
setsockopt
getsockopt
WSAAddressToStringA
WSALookupServiceBeginA
WSALookupServiceNextA

winmm

timeKillEvent
timeEndPeriod
timeSetEvent
timeGetDevCaps
timeBeginPeriod

setupapi

SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdA
SetupDiGetDeviceInterfaceDetailA

kernel32

GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedCompareExchange
VirtualFree
VirtualAlloc
GetStartupInfoA
ExitProcess
VirtualProtect
GetSystemInfo
VirtualQuery
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
SetCommTimeouts
PurgeComm
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
RaiseException
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
CloseHandle
TerminateThread
WaitForSingleObject
CreateThread
lstrlenA
lstrcmpiA
FlushInstructionCache
GetCurrentProcess
SetEvent
GetCurrentThreadId
CreateEventA
IsDBCSLeadByte
GetModuleFileNameA
SetLastError
InterlockedIncrement
InterlockedDecrement
FreeLibrary
LoadLibraryExA
GetModuleHandleA
GetTickCount
GetPrivateProfileSectionA
GetFileAttributesA
lstrcpyA
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InterlockedExchange
GetVersion
DebugBreak
CompareStringA
CompareStringW
lstrcmpiW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetStringTypeExA
GetStringTypeExW
lstrcpynA
DeleteFileA
CreateFileA
WriteFile
GetProcAddress
LoadLibraryA
GetVersionExA
GetTempFileNameA
GetTempPathA
WaitForMultipleObjects
WritePrivateProfileStringA
lstrcatA
lstrcmpA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
CreateDirectoryA
LocalFree
Sleep
GetCommandLineA
ResetEvent
GetProcessHeap
LocalAlloc
SetWaitableTimer
CreateWaitableTimerA
EscapeCommFunction
SetCommState
IsBadCodePtr
OutputDebugStringA
GetCommState
DeviceIoControl
SetupComm
MulDiv
GlobalUnlock
GlobalLock
SetCommMask
ReadFile
FlushFileBuffers
GetOverlappedResult
WaitCommEvent

user32

DestroyIcon
TrackPopupMenu
LoadMenuA
RegisterWindowMessageA
MessageBoxA
CharUpperBuffA
SendMessageA
SetMenuDefaultItem
GetMenuDefaultItem
IsMenu
DestroyMenu
GetSubMenu
PostThreadMessageA
FindWindowA
SetForegroundWindow
PostMessageA
CharUpperW
CharUpperA
CharLowerW
CharLowerA
LoadImageA
wsprintfA
CreateDialogParamA
CreateWindowExA
RegisterClassExA
LoadCursorA
GetClassInfoExA
GetWindow
GetWindowRect
SystemParametersInfoA
GetClientRect
MapWindowPoints
SetWindowPos
GetParent
SendDlgItemMessageA
KillTimer
SetTimer
RedrawWindow
ShowWindow
GetWindowLongA
CallWindowProcA
DefWindowProcA
MsgWaitForMultipleObjects
IsWindowUnicode
GetMessageW
DispatchMessageW
PeekMessageA
CharLowerBuffW
IsWindow
SetWindowLongA
CharNextA
PostQuitMessage
GetMessageA
TranslateMessage
DispatchMessageA
DestroyWindow
GetCursorPos
UnregisterClassA

gdi32

GetStockObject

advapi32

FreeSid
RegDeleteKeyA
RegQueryValueExA
AllocateAndInitializeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA

shell32

Shell_NotifyIconA
ShellExecuteA

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CLSIDFromProgID
CoUninitialize
CoInitialize
CoTaskMemFree
CreateStreamOnHGlobal
CoRevokeClassObject
CoRegisterClassObject
StringFromGUID2
CoGetClassObject
CoLockObjectExternal
GetHGlobalFromStream

oleaut32

VariantClear
VariantInit
SysFreeString
RegisterTypeLi
SafeArrayGetUBound
SafeArrayGetLBound
VariantCopy
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayCopy
VariantChangeType
SafeArrayCreate
SafeArrayRedim
VarUdateFromDate
SysAllocStringLen
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysStringLen
VarUI4FromStr
LoadRegTypeLi
LoadTypeLi
VarBstrCat
VarBstrCmp
OleCreatePropertyFrame
SafeArrayGetVartype
UnRegisterTypeLi

libexpatw

ord40
ord41
ord51
ord18
ord2
ord16
ord31
ord25
ord42
ord44
ord27
ord12
ord21
ord52

Sections

.text
Size: 190KB - Virtual size: 189KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 42KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

67d80d27f309b0d5b894115850027ba2

Headers

File Characteristics

Imports

comctl32

rpcrt4

ws2_32

winmm

setupapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

libexpatw

Sections

.text Size: 190KB - Virtual size: 189KB

.rdata Size: 31KB - Virtual size: 31KB

.data Size: 11KB - Virtual size: 12KB

.rsrc Size: 42KB - Virtual size: 64KB

.text
Size: 190KB - Virtual size: 189KB

.rdata
Size: 31KB - Virtual size: 31KB

.data
Size: 11KB - Virtual size: 12KB

.rsrc
Size: 42KB - Virtual size: 64KB