89f9702c7729629989d8b4725d731bc8_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

89f9702c7729629989d8b4725d731bc8_JaffaCakes118
Size

328KB
MD5

89f9702c7729629989d8b4725d731bc8
SHA1

35db6175ce67f7b72b0c234c5e9f543961306e53
SHA256

6a0c9421f496a2f988c2f69649bec5523d27c1209c19096901459daeee7f206c
SHA512

a1b5ad3193b1410204d32936b4ed17576ffccb92c9d0779dfcbea2f4d3e1fd3c8314c842e709a24bac24655ee62b873f93cdf8ff24121d2b68d3c3765677f015
SSDEEP

6144:TSWSnNBlM3Qms7ZRRAIElG0Ve2BG9xFaDLwsQQYvw:+WjAbOIceQGkDLwsOvw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
89f9702c7729629989d8b4725d731bc8_JaffaCakes118

Files

89f9702c7729629989d8b4725d731bc8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2cece115f1b99fb4e3ba1e0e02f43003

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winspool.drv

ClosePrinter
OpenPrinterW
GetPrinterW
ord203

winmm

timeGetTime

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

comdlg32

PrintDlgExW
GetSaveFileNameW

ole32

CoCreateGuid
CoCreateInstance
CoInitialize
CoUninitialize
OleInitialize
OleUninitialize
ReleaseStgMedium
RegisterDragDrop
RevokeDragDrop
StringFromGUID2

shell32

CommandLineToArgvW
DragQueryFileW
SHFileOperationW
SHGetFolderPathW
SHGetSpecialFolderPathW
ShellExecuteW
DragFinish

shlwapi

PathFileExistsA
PathFindExtensionW
PathFindFileNameW
PathGetCharTypeW
PathIsUNCA
PathIsUNCW
PathRemoveExtensionW
UrlCreateFromPathA
UrlCreateFromPathW
PathFileExistsW

gdi32

StrokePath
StrokeAndFillPath
StretchDIBits
StartPage
StartDocW
SetWorldTransform
SetTextColor
SetStretchBltMode
SetRectRgn
SetROP2
SetPolyFillMode
SetMiterLimit
SetGraphicsMode
SetDIBits
SetDCPenColor
SetDCBrushColor
SetBrushOrgEx
SetBkMode
AbortPath
AddFontMemResourceEx
BeginPath
BitBlt
CombineRgn
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
CreateDIBSection
CreateFontIndirectW
CreateFontW
CreatePen
CreateRectRgn
CreateRectRgnIndirect
CreateSolidBrush
DeleteDC
DeleteObject
EndDoc
EndPage
EndPath
EnumFontFamiliesExW
ExtCreatePen
ExtTextOutW
GdiFlush
GetCharWidthI
GetCurrentObject
GetDeviceCaps
GetFontData
GetFontUnicodeRanges
GetGlyphIndicesW
GetGlyphOutlineW
GetObjectW
GetOutlineTextMetricsW
GetStockObject
GetStretchBltMode
GetTextColor
GetTextFaceW
GetTextMetricsW
PathToRegion
PolyBezier
Rectangle
RemoveFontMemResourceEx
RestoreDC
SaveDC
SelectClipRgn
SelectObject
SetAbortProc
SetArcDirection
SetBkColor

comctl32

InitCommonControlsEx

advapi32

UnregisterTraceGuids
TraceEvent
SetSecurityDescriptorDacl
RegisterTraceGuidsW
RegQueryValueExW
RegQueryValueExA
RegQueryInfoKeyW
RegOpenKeyExW
RegOpenKeyExA
RegEnumKeyExW
RegCreateKeyExW
RegCloseKey
OpenProcessToken
InitializeSecurityDescriptor
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
GetTokenInformation
GetLengthSid
FreeSid
CopySid
AllocateAndInitializeSid

user32

SetClipboardData
SetClassLongW
SetCapture
SendInput
ScrollDC
ScreenToClient
ReleaseDC
ReleaseCapture
RegisterWindowMessageW
RegisterClipboardFormatW
RegisterClassExW
RedrawWindow
RealGetWindowClassW
PostQuitMessage
PostMessageW
PeekMessageW
OpenClipboard
MsgWaitForMultipleObjectsEx
MonitorFromWindow
MessageBoxW
MessageBeep
MapWindowPoints
LoadKeyboardLayoutW
LoadImageW
LoadCursorW
KillTimer
IsWindow
IsClipboardFormatAvailable
InvertRect
InvalidateRect
InsertMenuItemW
InflateRect
GetWindowThreadProcessId
GetWindowRect
GetWindowLongW
GetSystemMetrics
GetSysColorBrush
GetSysColor
SetCursor
GetPropW
GetParent
GetMonitorInfoW
GetMessageTime
GetKeyboardLayout
GetKeyState
GetGuiResources
GetForegroundWindow
GetFocus
GetDC
GetCursor
GetClipboardData
GetClassNameW
GetCaretBlinkTime
GetAsyncKeyState
FrameRect
FillRect
EnumThreadWindows
EnumDisplaySettingsW
EnumDisplayMonitors
EmptyClipboard
DrawTextW
DrawIconEx
DrawFrameControl
DrawFocusRect
DrawEdge
DispatchMessageW
DestroyWindow
DestroyIcon
DefWindowProcW
DefWindowProcA
CreateWindowExW
CreatePopupMenu
CreateIconIndirect
CloseClipboard
CallWindowProcW
CallNextHookEx
CallMsgFilterW
SetFocus
SetParent
SetPropW
SetTimer
SetWindowLongA
SetWindowLongW
SetWindowPos
SetWindowRgn
SetWindowsHookExW
TrackMouseEvent
SystemParametersInfoW
TrackPopupMenu
TranslateMessage
UnhookWindowsHookEx
UnregisterClassA
UnregisterClassW
WaitMessage
GetQueueStatus
RemovePropW

crypt32

CertFindChainInStore
CertDuplicateCertificateContext
CertCloseStore
CertFindExtension
CertAddEncodedCertificateToStore
CertAddCertificateContextToStore
CertFreeCertificateChain
CertFreeCertificateContext
CertGetCertificateChain
CertNameToStrW
CertOpenStore
CertOpenSystemStoreW
CertSerializeCertificateStoreElement
CertVerifyCertificateChainPolicy
CryptDecodeObjectEx
CryptHashCertificate
CertAddSerializedElementToStore

kernel32

LoadResource
LocalAlloc
LocalFileTimeToFileTime
LocalFree
LockFile
LockFileEx
LockResource
MapViewOfFile
MoveFileA
MoveFileExW
MultiByteToWideChar
OpenThread
OutputDebugStringA
PeekNamedPipe
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
QueueUserWorkItem
RaiseException
SetUnhandledExceptionFilter
SizeofResource
Sleep
SuspendThread
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnlockFile
UnmapViewOfFile
UnregisterWaitEx
VirtualAlloc
VirtualFree
VirtualProtect
WaitForSingleObject
WideCharToMultiByte
WriteConsoleA
WriteConsoleW
WriteFile
lstrcmpiA
LoadLibraryW
LoadLibraryExW
LoadLibraryA
LeaveCriticalSection
LCMapStringW
LCMapStringA
IsValidLocale
IsValidCodePage
IsDebuggerPresent
IsBadWritePtr
InterlockedIncrement
InterlockedExchangeAdd
InterlockedExchange
InterlockedDecrement
InterlockedCompareExchange
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
HeapSize
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GlobalUnlock
GlobalSize
GlobalMemoryStatusEx
GlobalMemoryStatus
GlobalLock
GlobalFree
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomW
GetWindowsDirectoryW
GetVolumeInformationA
GetVersionExW
GetVersionExA
GetUserDefaultLangID
GetUserDefaultLCID
GetTimeZoneInformation
GetTimeFormatW
GetTickCount
GetThreadTimes
GetThreadLocale
GetThreadContext
GetTempPathW
GetTempPathA
GetTempFileNameW
GetTempFileNameA
GetSystemTimeAsFileTime
GetSystemTime
GetSystemInfo
GetSystemDirectoryW
GetSystemDirectoryA
GetStringTypeW
GetStringTypeA
GetStdHandle
GetStartupInfoA
GetQueuedCompletionStatus
GetProcessHeap
GetProcAddress
GetPrivateProfileStringW
GetOEMCP
GetNumberFormatW
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
GetModuleFileNameA
GetLongPathNameW
GetLogicalDrives
GetLogicalDriveStringsW
GetLocaleInfoW
ReadFile
GetLocaleInfoA
GetLastError
GetFullPathNameW
GetFullPathNameA
GetFileType
GetFileSizeEx
GetFileSize
GetFileInformationByHandle
GetFileAttributesW
GetFileAttributesExW
GetFileAttributesA
GetEnvironmentStringsW
GetEnvironmentStringsA
GetDriveTypeW
GetDriveTypeA
GetDiskFreeSpaceW
GetDiskFreeSpaceExW
GetDiskFreeSpaceA
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCurrentDirectoryW
GetCurrentDirectoryA
SetThreadPriority
SetStdHandle
SetLastError
SetHandleCount
SetFilePointerEx
SetFilePointer
SetFileAttributesA
SetEvent
SetEnvironmentVariableA
SetEndOfFile
SetCurrentDirectoryW
RtlUnwind
ResumeThread
ResetEvent
RemoveDirectoryW
ReleaseSemaphore
ReleaseMutex
RegisterWaitForSingleObject
AreFileApisANSI
CancelIo
CloseHandle
CompareStringA
CompareStringW
CreateDirectoryA
CreateDirectoryW
CreateEventW
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateIoCompletionPort
CreateMutexW
CreateProcessW
CreateSemaphoreA
CreateSemaphoreW
CreateThread
DeleteCriticalSection
DeleteFileA
DeleteFileW
DuplicateHandle
EnterCriticalSection
EnumSystemLocalesA
ExitProcess
ExitThread
ExpandEnvironmentStringsW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileW
FindResourceW
FlushFileBuffers
FormatMessageA
FormatMessageW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetComputerNameA
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCurrencyFormatW

Exports

Exports

cef_browser_create
cef_browser_create_sync
cef_bsupports_mime_type
cef_clear_htmlcache
cef_delete_all_cookies
cef_delete_cookie
cef_do_message_loop_work
cef_initialize
cef_post_data_create
cef_post_data_element_create
cef_register_extension
cef_register_plugin
cef_register_scheme
cef_request_create
cef_set_cookie
cef_shutdown
cef_stream_reader_create_for_data
cef_stream_reader_create_for_file
cef_stream_reader_create_for_handler
cef_stream_writer_create_for_file
cef_stream_writer_create_for_handler
cef_string_alloc
cef_string_alloc_length
cef_string_free
cef_string_length
cef_string_list_alloc
cef_string_list_append
cef_string_list_clear
cef_string_list_free
cef_string_list_size
cef_string_list_value
cef_string_map_alloc
cef_string_map_append
cef_string_map_clear
cef_string_map_find
cef_string_map_free
cef_string_map_key
cef_string_map_size
cef_string_map_value
cef_string_realloc
cef_string_realloc_length
cef_v8value_create_array
cef_v8value_create_bool
cef_v8value_create_double
cef_v8value_create_function
cef_v8value_create_int
cef_v8value_create_null
cef_v8value_create_object
cef_v8value_create_string
cef_v8value_create_undefined

Sections

.text
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 80KB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2cece115f1b99fb4e3ba1e0e02f43003

Headers

File Characteristics

Imports

winspool.drv

winmm

version

comdlg32

ole32

shell32

shlwapi

gdi32

comctl32

advapi32

user32

crypt32

kernel32

Exports

Exports

Sections

.text Size: 96KB - Virtual size: 96KB

.rdata Size: 112KB - Virtual size: 112KB

.data Size: 80KB - Virtual size: 1.6MB

.idata Size: 16KB - Virtual size: 16KB

.rsrc Size: 20KB - Virtual size: 20KB

.text
Size: 96KB - Virtual size: 96KB

.rdata
Size: 112KB - Virtual size: 112KB

.data
Size: 80KB - Virtual size: 1.6MB

.idata
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 20KB - Virtual size: 20KB