8e34b2c4dedefd35c799a549ab1d3338_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8e34b2c4dedefd35c799a549ab1d3338_JaffaCakes118
Size

306KB
MD5

8e34b2c4dedefd35c799a549ab1d3338
SHA1

66a7d8787c595bc69a2b981fd56d0ab5913a1fba
SHA256

1f093b9844f9ce4abb422cb2df317a7e08a50984ccd1074166a13cbfc27b8fd1
SHA512

fb8f6235513309bc524d3606011abb1dc76cd0f51427e0af299d6410eff07b646f68ad1be31667a9ccd15caa4b1dd7ae59ff92eb7e137c09f0d174d0fb536df1
SSDEEP

3072:+aHb8gb82hotso8ARtAC1rjG5+fUzlTRyVkHxGQdv:vQ+ZARt31XG5v5sVcxGQ5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e34b2c4dedefd35c799a549ab1d3338_JaffaCakes118

Files

8e34b2c4dedefd35c799a549ab1d3338_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f08db7b6512378e999297586336e818a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CertOpenSystemStoreA
CertEnumCertificatesInStore
PFXExportCertStoreEx
CertNameToStrA
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CertGetCertificateContextProperty
CertOpenStore
CertAddCertificateContextToStore
CertCloseStore

ntdll

NtQueryObject
NtDuplicateObject
NtQuerySystemInformation
RtlAdjustPrivilege
NtAllocateVirtualMemory
strncpy
_itoa
strtoul
_strcmpi
RtlCompareUnicodeString
NtQueryInformationProcess
NtQueryInformationThread
NtFreeVirtualMemory
_alldiv
_allmul
isalnum
RtlInitUnicodeString
NtOpenFile
NtCreateSection
NtMapViewOfSection
NtClose
NtQueryInformationFile
sprintf
memmove
LdrFindEntryForAddress
NtReadVirtualMemory
NtWriteVirtualMemory
NtProtectVirtualMemory
sscanf
memcpy
memset
_chkstk
_snprintf
_vsnprintf
wcsstr
strstr
strncmp
_strlwr
NtUnmapViewOfSection
atoi

ws2_32

WSAGetLastError
getpeername
ntohs
inet_ntoa
inet_addr
htons

wininet

InternetSetStatusCallback
InternetQueryOptionA
FindCloseUrlCache
FindNextUrlCacheEntryA
InternetCrackUrlA
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
InternetSetCookieA
InternetSetOptionA
GetUrlCacheEntryInfoW
InternetCanonicalizeUrlA

shlwapi

SHDeleteValueA
SHRegSetUSValueA
StrSpnA
StrCmpNA
StrStrA
StrStrIA
PathCombineA
StrRStrIA
StrCmpNIA
StrPBrkA

kernel32

VirtualQuery
ExitProcess
TerminateProcess
SetErrorMode
OpenThread
lstrcpyW
FindFirstFileW
FindNextFileW
CreateProcessA
CreateEventA
GetTickCount
GetVersionExA
GetUserDefaultLangID
GetModuleHandleA
IsBadWritePtr
SetFileTime
CreateRemoteThread
GetTimeZoneInformation
CreateSemaphoreA
ReleaseSemaphore
VirtualQueryEx
VirtualAllocEx
TryEnterCriticalSection
ResumeThread
FlushInstructionCache
OpenProcess
lstrlenW
GetFileInformationByHandle
GetLocalTime
FileTimeToSystemTime
lstrcpyA
DuplicateHandle
CreateDirectoryW
CreateDirectoryA
LocalFileTimeToFileTime
lstrcmpA
SystemTimeToFileTime
CreateToolhelp32Snapshot
Process32First
lstrcmpiA
Process32Next
GetExitCodeThread
GetCurrentProcessId
LoadLibraryA
GetProcAddress
FreeLibrary
lstrcatA
WideCharToMultiByte
FindResourceExA
LoadResource
OutputDebugStringA
GetCurrentThreadId
GetLastError
CloseHandle
CreateThread
Sleep
HeapFree
HeapValidate
HeapAlloc
GetProcessHeap
TerminateThread
IsBadReadPtr
SetUnhandledExceptionFilter
ReadFile
SetFilePointer
GetFileSize
CreateFileA
LeaveCriticalSection
EnterCriticalSection
GetEnvironmentVariableA
SetEnvironmentVariableA
SuspendThread
SetThreadPriority
WaitForSingleObject
UnmapViewOfFile
MapViewOfFile
GetSystemInfo
CreateFileMappingA
GetModuleFileNameA
InitializeCriticalSection
MultiByteToWideChar
ReadProcessMemory
GetThreadSelectorEntry
GetThreadContext
ExitThread
WriteProcessMemory
VirtualProtectEx
CreateMutexA
SetLastError
HeapReAlloc
lstrlenA
DeleteFileW
SetFileAttributesW
WriteFile
CreateFileW
SetEvent
GetTempFileNameA
OpenMutexA
GetThreadPriority
DisconnectNamedPipe
FlushFileBuffers
RemoveDirectoryA
MoveFileExA
DeleteFileA
ConnectNamedPipe
CreateNamedPipeA
WaitNamedPipeA
FindClose
FindNextFileA
FindFirstFileA
QueryDosDeviceA
GetLogicalDriveStringsA
GetFileAttributesW
SizeofResource

user32

MsgWaitForMultipleObjects
GetKeyboardState
DispatchMessageW
TranslateMessage
PeekMessageW
CharLowerA
wsprintfA
DrawIcon
GetIconInfo
LoadCursorA
EnumWindows
GetWindowThreadProcessId
SetWindowLongA
GetWindowLongA
CallWindowProcA
GetWindowDC
GetWindowRect
GetCursorPos
ReleaseDC
LoadStringW
LoadStringA
ToUnicode

gdi32

CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
BitBlt
DeleteObject
DeleteDC

advapi32

CryptGetKeyParam
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegEnumValueA
RegQueryValueExA
RegOpenKeyExA
CryptDestroyKey
CryptGetUserKey
CryptReleaseContext
CryptAcquireContextW
RegCloseKey

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHGetFolderPathA

ole32

CreateStreamOnHGlobal

Sections

.text
Size: 260KB - Virtual size: 259KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f08db7b6512378e999297586336e818a

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

ntdll

ws2_32

wininet

shlwapi

kernel32

user32

gdi32

advapi32

shell32

ole32

Sections

.text Size: 260KB - Virtual size: 259KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 260KB - Virtual size: 259KB

.reloc
Size: 8KB - Virtual size: 7KB