8eccc8b29680fe599c338269a8cee3b8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8eccc8b29680fe599c338269a8cee3b8_JaffaCakes118
Size

132KB
MD5

8eccc8b29680fe599c338269a8cee3b8
SHA1

4470dd6c9e6ec9e2b35ea41c4c9d988f80ee34d6
SHA256

ae3c25ccb537380e26092bffdbdb6239c0f7d56a09f85e858ba63ea14744efe1
SHA512

1e199c8c980c0252a58a4741ce60573958929660cc6bde42d8d897bd459042f8682d5d8cedf0210c8461eb4290886183839e7fda209e3eb7dea347c2602cfe69
SSDEEP

3072:MDj8cXTW7YiP73nTY9tuXhVeA1KefzLjCKCsQsLVDDw:MH8iTW7Ysnq8hZfHj/BDw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8eccc8b29680fe599c338269a8cee3b8_JaffaCakes118

Files

8eccc8b29680fe599c338269a8cee3b8_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a74ffdca41fedcb15ba431330d22f301

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempPathW
GetFileSizeEx
OpenMutexW
GetProcAddress
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
FindClose
LoadLibraryA
RemoveDirectoryW
WaitForMultipleObjects
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
LocalFree
GetSystemTime
WriteProcessMemory
SetFileAttributesW
CreateThread
ExpandEnvironmentStringsW
GetCurrentThreadId
GetPrivateProfileStringW
GetPrivateProfileIntW
OpenProcess
GetCommandLineW
SetErrorMode
GetComputerNameW
FlushFileBuffers
GetFileAttributesExW
OpenEventW
DuplicateHandle
GetCurrentProcessId
TlsGetValue
TlsSetValue
TerminateProcess
GlobalLock
GlobalUnlock
GetThreadContext
SetThreadContext
GetProcessId
lstrcmpiA
WTSGetActiveConsoleSessionId
GetNativeSystemInfo
CreateRemoteThread
Process32FirstW
Process32NextW
GetLocalTime
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
WriteFile
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualFree
GetModuleHandleW
CreateDirectoryW
HeapFree
MultiByteToWideChar
CreateFileW
GetTimeZoneInformation
ReadFile
Thread32Next
HeapCreate
HeapDestroy
ReadProcessMemory
LoadLibraryW
VirtualFreeEx
WideCharToMultiByte
GetVersionExW
Thread32First
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
FreeLibrary
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
GetUserDefaultUILanguage
lstrcmpiW
GetModuleFileNameW
GetFileAttributesW
GetTickCount
MoveFileExW
CloseHandle
WaitForSingleObject
CreateEventW
ResetEvent
SetLastError
GetLastError
SetEvent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
SetThreadPriority
Sleep
GetCurrentThread
ExitProcess

user32

CreateDesktopW
GetSystemMetrics
RegisterClassA
GetKeyboardState
GetClipboardData
ToUnicode
MapVirtualKeyW
EndPaint
GetUpdateRgn
GetWindowDC
FillRect
DrawEdge
BeginPaint
GetUpdateRect
IntersectRect
PostThreadMessageW
SetProcessWindowStation
PrintWindow
DefWindowProcW
ExitWindowsEx
GetMessageA
GetWindowRect
GetMessageW
SetCapture
PostMessageW
DefWindowProcA
GetWindowInfo
GetClassLongW
GetCapture
SetCursorPos
GetAncestor
PeekMessageA
SetWindowPos
GetCursorPos
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
CloseDesktop
SetThreadDesktop
OpenWindowStationW
RegisterWindowMessageW
GetThreadDesktop
GetMenuItemID
SetKeyboardState
GetSubMenu
OpenDesktopW
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
GetMenuItemCount
HiliteMenuItem
GetUserObjectInformationW
EndMenu
GetShellWindow
CharLowerBuffA
CharLowerW
DrawIcon
GetIconInfo
DefDlgProcW
RegisterClassExA
DefFrameProcA
OpenInputDesktop
EqualRect
RegisterClassExW
DefMDIChildProcW
SwitchDesktop
DefDlgProcA
DefMDIChildProcA
RegisterClassW
CallWindowProcA
IsWindow
ReleaseCapture
SendMessageW
MapWindowPoints
GetMessagePos
GetWindowThreadProcessId
IsRectEmpty
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharToOemW
GetDC
TranslateMessage
GetWindowLongW
CharLowerA
CallWindowProcW
GetParent
DefFrameProcW
PeekMessageW
ReleaseDC
CharUpperW
SetWindowLongW
SendMessageTimeoutW
GetWindow
DispatchMessageW
GetDCEx

advapi32

CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
IsWellKnownSid
GetLengthSid
RegEnumKeyExW
EqualSid
ConvertSidToStringSidW
InitiateSystemShutdownExW

shlwapi

PathUnquoteSpacesW
PathIsURLW
StrCmpNIW
StrStrIW
StrStrIA
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveBackslashW
PathQuoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathRenameExtensionW
PathRemoveFileSpecW

shell32

ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

CoUninitialize
CoCreateInstance
CLSIDFromString
StringFromGUID2
CoInitializeEx

gdi32

DeleteObject
GetDIBits
GetDeviceCaps
CreateDIBSection
RestoreDC
SaveDC
CreateCompatibleDC
SetRectRgn
SelectObject
GdiFlush
DeleteDC
SetViewportOrgEx
CreateCompatibleBitmap

ws2_32

getaddrinfo
recvfrom
getsockname
getpeername
send
closesocket
WSASend
accept
WSAEventSelect
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
WSAGetLastError
shutdown
setsockopt
bind
socket
WSASetLastError
listen
select
sendto
recv
freeaddrinfo

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
PFXImportCertStore

wininet

InternetReadFileExA
InternetQueryOptionA
InternetOpenA
HttpOpenRequestA
InternetSetOptionA
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
InternetCloseHandle
HttpSendRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFile
InternetQueryDataAvailable
HttpSendRequestExW
HttpQueryInfoA
HttpSendRequestExA

oleaut32

SysFreeString
VariantInit
SysAllocString
VariantClear

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetInfo

Sections

.text
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a74ffdca41fedcb15ba431330d22f301

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 124KB - Virtual size: 124KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 124KB - Virtual size: 124KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 5KB - Virtual size: 5KB