96982418fce94ebb7667cf4b394dd369_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

96982418fce94ebb7667cf4b394dd369_JaffaCakes118
Size

138KB
MD5

96982418fce94ebb7667cf4b394dd369
SHA1

b39e244e817f6d7c14d02ea45ac17bb13e522ab1
SHA256

d03282a8e9037b1bc52b3cb67716a0cef6119059406b35d6a2d18f33dffa5319
SHA512

e3f4314e581d358dbc0574bb9218e1aea8088c8ffc1cab91f08f07092a19412ce4b6ceb8a25869393d2c0c10137ec2e0275180df5ee985a2293f1918856e0be1
SSDEEP

3072:RKEeb1Z+ChVoNcMWDsYZdyJfPhPsqFe4JXuV4stjEsUKoH/NYgr3053:RK5b1TEEDs6dyJfPho4JQEsu1trM3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
96982418fce94ebb7667cf4b394dd369_JaffaCakes118

Files

96982418fce94ebb7667cf4b394dd369_JaffaCakes118
.exe windows:5 windows x86 arch:x86

71193182acdb286008e45e80b59c71a4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Thread32Next
ReadFile
GetTimeZoneInformation
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
FindClose
LoadLibraryA
RemoveDirectoryW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
GetSystemTime
CreateThread
ExpandEnvironmentStringsW
SetFileAttributesW
GetPrivateProfileStringW
LeaveCriticalSection
GetPrivateProfileIntW
EnterCriticalSection
GetThreadContext
SetThreadContext
GetProcessId
TlsGetValue
TlsSetValue
TerminateProcess
ResetEvent
GetLocalTime
GlobalLock
GlobalUnlock
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
MoveFileExW
GetUserDefaultUILanguage
CreateRemoteThread
Process32FirstW
Process32NextW
WTSGetActiveConsoleSessionId
CreateFileW
HeapCreate
HeapDestroy
ReadProcessMemory
WideCharToMultiByte
Thread32First
OpenProcess
WriteFile
VirtualQueryEx
GetFileAttributesW
LoadLibraryW
SetFileTime
IsBadReadPtr
GetProcessHeap
HeapFree
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
InitializeCriticalSection
GetEnvironmentVariableW
CreateDirectoryW
FreeLibrary
lstrcmpiA
SetThreadPriority
GetCurrentThread
GetCurrentThreadId
SetLastError
GetTickCount
WriteProcessMemory
LocalFree
GetCurrentProcessId
DuplicateHandle
OpenEventW
GetFileAttributesExW
lstrcmpiW
GetProcAddress
GetModuleFileNameW
GetVersionExW
Sleep
VirtualFreeEx
VirtualFree
GetModuleHandleW
SetEvent
GetComputerNameW
SetErrorMode
GetCommandLineW
ExitProcess
CloseHandle
WaitForMultipleObjects
CreateEventW
ReleaseMutex
GetNativeSystemInfo
WaitForSingleObject

user32

CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
OpenWindowStationW
EndPaint
GetUpdateRgn
GetWindowDC
FillRect
DrawEdge
BeginPaint
GetUpdateRect
IntersectRect
GetDCEx
PostThreadMessageW
EqualRect
PrintWindow
DefWindowProcW
OpenDesktopW
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
GetDC
TranslateMessage
DefMDIChildProcA
ReleaseDC
CharUpperW
SetWindowLongW
GetWindow
MapVirtualKeyW
DrawIcon
DefDlgProcA
GetIconInfo
RegisterClassExA
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
GetSubMenu
DefDlgProcW
DefFrameProcA
OpenInputDesktop
MenuItemFromPoint
GetMenu
RegisterClassExW
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
HiliteMenuItem
RegisterClassW
CreateWindowStationW
CallWindowProcA
GetMenuItemCount
CharLowerW
EndMenu
GetProcessWindowStation
DefFrameProcW
RegisterClassA
GetSystemMetrics
ExitWindowsEx
GetShellWindow
GetKeyboardState
GetClipboardData
ToUnicode
DispatchMessageW
CharToOemW
CharLowerBuffA
GetMessageA
GetWindowRect
GetMessageW
SetCapture
PostMessageW
GetParent
GetWindowInfo
GetClassLongW
GetCapture
SetCursorPos
GetWindowLongW
GetAncestor
PeekMessageW
PeekMessageA
SetWindowPos
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CharLowerA
IsRectEmpty
GetWindowThreadProcessId
GetMessagePos
MapWindowPoints
SendMessageW
ReleaseCapture
IsWindow
SendMessageTimeoutW
GetCursorPos
CallWindowProcW

advapi32

IsWellKnownSid
GetLengthSid
EqualSid
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
ConvertSidToStringSidW
RegEnumKeyExW
InitiateSystemShutdownExW

shlwapi

StrCmpNIW
PathRemoveBackslashW
PathQuoteSpacesW
PathIsURLW
StrStrIW
StrStrIA
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathRemoveFileSpecW
PathRenameExtensionW

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

CreateCompatibleDC
SetRectRgn
SaveDC
DeleteDC
SetViewportOrgEx
RestoreDC
CreateDIBSection
GetDeviceCaps
GetDIBits
CreateCompatibleBitmap
GdiFlush
SelectObject
DeleteObject

ws2_32

listen
send
closesocket
WSASetLastError
freeaddrinfo
socket
bind
recv
recvfrom
sendto
getpeername
WSASend
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
shutdown
WSAEventSelect
getsockname
accept
WSAGetLastError
setsockopt

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData

wininet

HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
HttpAddRequestHeadersA
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
HttpQueryInfoA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

71193182acdb286008e45e80b59c71a4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 129KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 129KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB