9631b37c775616b13e7a1495ed8dfec8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

9631b37c775616b13e7a1495ed8dfec8_JaffaCakes118
Size

203KB
MD5

9631b37c775616b13e7a1495ed8dfec8
SHA1

fdabd9c608be741ac9a450b1990fbdcd42209e14
SHA256

ddc49506c4842f60c258fd6e9bcd83f564110bea030027a7f842d37aa580e7a4
SHA512

709adad23cd65f269f265db5526a879b0cf9ddb57d271d19ecd9693166915b058fb387a64d7546fa8158a10ef6f27c5bf393e8930d22766233e68e89af6db4b9
SSDEEP

6144:IVw1I10tG4BrfrkW1zfdSLPWJHap9yy3Py468+5tyyA:IVctGErfrD1z2WdaffPy468+5O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9631b37c775616b13e7a1495ed8dfec8_JaffaCakes118

Files

9631b37c775616b13e7a1495ed8dfec8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0bd111e7b066b4450775ba267b0213dc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

gdi32

CreateDIBitmap

shell32

SHGetSpecialFolderPathW
SHGetSpecialFolderPathA

user32

RegisterWindowMessageA
DispatchMessageA
GetQueueStatus
MsgWaitForMultipleObjects
GetDC
GetDesktopWindow
ShowWindow
RealGetWindowClassA
ReleaseDC
PeekMessageA
PostThreadMessageA
wsprintfA
DestroyWindow
CreateDialogParamA
wvsprintfA

wininet

InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenA

advapi32

CryptHashData
CryptAcquireContextA
CryptEncrypt
RegDeleteValueA
CryptImportKey
GetUserNameA
RegEnumKeyExA
RegEnumValueA
CryptDestroyKey
RegOpenKeyExA
CryptGetHashParam
RegQueryValueExA
CryptDestroyHash
CryptReleaseContext
RegCreateKeyExA
CryptCreateHash
RegSetValueExA
RegCloseKey

iphlpapi

GetAdaptersInfo
GetBestInterface
SendARP

winmm

timeGetTime
timeSetEvent

setupapi

SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

kernel32

LocalFree
GetCurrentProcessId
DeviceIoControl
InitializeCriticalSection
GetFileAttributesA
GlobalMemoryStatus
QueryPerformanceCounter
CreateProcessA
_llseek
InterlockedDecrement
GetComputerNameA
WaitForMultipleObjects
CreateFiberEx
InterlockedExchange
OutputDebugStringA
SetEvent
TerminateJobObject
LoadLibraryExA
GetSystemDirectoryA
CreateDirectoryA
VirtualFree
IsBadReadPtr
GetWindowsDirectoryA
GetLocalTime
GetVersionExA
LoadLibraryA
GetModuleHandleA
DeleteFileA
WriteFile
FreeLibrary
SetLastError
GetModuleFileNameA
GetTickCount
VirtualAlloc
ResetEvent
EnumResourceNamesW
DefineDosDeviceA
LeaveCriticalSection
FlushInstructionCache
ReadFile
GetACP
GetCurrentThread
QueryDosDeviceA
GetVersion
CreateMutexA
Sleep
CompareStringA
InterlockedIncrement
GetCurrentThreadId
CloseHandle
DeleteCriticalSection
VirtualQuery
lstrlenA
GetSystemTime
FlushFileBuffers
GetSystemInfo
GetLocaleInfoA
CreateFileA
IsBadWritePtr
LocalAlloc
GetThreadPriority
CreateSemaphoreA
GetLastError
CreateThread
GetPrivateProfileStringA
WaitForSingleObject
EnterCriticalSection
GetTempPathA
SetThreadPriority
GetDiskFreeSpaceA
CreateEventA
ReleaseMutex

ole32

StgCreateDocfile
CoTaskMemAlloc
StgIsStorageFile
BindMoniker
CreateItemMoniker
CoCreateInstance
CoUninitialize
GetRunningObjectTable
CoTaskMemFree
StgOpenStorage
CreateBindCtx
StringFromGUID2
CoInitialize

Sections

.text
Size: 177KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0bd111e7b066b4450775ba267b0213dc

Headers

File Characteristics

Imports

gdi32

shell32

user32

wininet

advapi32

iphlpapi

winmm

setupapi

kernel32

ole32

Sections

.text Size: 177KB - Virtual size: 176KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 20KB - Virtual size: 20KB

.tls Size: 512B - Virtual size: 224KB

.text
Size: 177KB - Virtual size: 176KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 20KB - Virtual size: 20KB

.tls
Size: 512B - Virtual size: 224KB