9feb50c2bccd325781f75ec15d342501_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

9feb50c2bccd325781f75ec15d342501_JaffaCakes118
Size

187KB
MD5

9feb50c2bccd325781f75ec15d342501
SHA1

3795f90c90047026aa16b632ca7376bdafcc9371
SHA256

1a9d4ec83b52f03973eded8f41c42dec2a0f4a5ab600ff74871da3ca5cf941ef
SHA512

c859c4ad37b762d21372e52451f551f8199b66a35e3eca2db1c04d76fd2984513823be2d5018f64fc06a54d55cd13614d4dcae1779b9e03c73fefcd2e2ee5490
SSDEEP

3072:LLDkECxzYvy7EANiAm1vH9LPewj9MxVCkCn28k/ciGlHoOMzvsLTcZ//:LLPClYvyQANbm1fl2wj9MnCkC22roSLG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9feb50c2bccd325781f75ec15d342501_JaffaCakes118

Files

9feb50c2bccd325781f75ec15d342501_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e47a7459459da3e52785ec87f154f6e5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsBadReadPtr
SetFileTime
VirtualQueryEx
OpenProcess
Thread32First
WideCharToMultiByte
ReadProcessMemory
HeapDestroy
HeapCreate
lstrcpynW
Thread32Next
GetTimeZoneInformation
MultiByteToWideChar
lstrlenW
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
VirtualProtectEx
VirtualAllocEx
FindClose
RemoveDirectoryW
QueryDosDeviceW
WaitForMultipleObjects
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
GetProcessHeap
SetFileAttributesW
GetCommandLineW
SetErrorMode
GetComputerNameW
GetModuleFileNameW
CreateEventW
GetModuleHandleA
OpenEventW
DuplicateHandle
GetCurrentProcessId
CreateRemoteThread
Process32FirstW
Process32NextW
lstrcmpiA
WTSGetActiveConsoleSessionId
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
GlobalLock
GlobalUnlock
MoveFileExW
GetUserDefaultUILanguage
GetLocalTime
FlushFileBuffers
CreateFileW
GetFileAttributesW
GetModuleHandleW
Sleep
GetSystemTime
GetFileAttributesExW
GetProcessId
EnterCriticalSection
CreateDirectoryW
HeapFree
GetLogicalDriveStringsW
SetFilePointerEx
GetCurrentProcess
SystemTimeToFileTime
HeapAlloc
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
VirtualFree
WriteProcessMemory
CreateThread
VirtualAlloc
LeaveCriticalSection
VirtualFreeEx
InitializeCriticalSection
SetThreadContext
GetThreadContext
ExitProcess
CloseHandle
CreatePipe
ExitThread
ReadFile
WriteFile
SetHandleInformation
CreateProcessW
ReleaseMutex
GetCurrentThreadId
SetLastError
GetTickCount
ResetEvent
SetThreadPriority
FreeLibrary
TerminateProcess
TlsSetValue
GetCurrentThread
SetEvent
WaitForSingleObject
TlsGetValue
GetVersionExW
GetNativeSystemInfo
lstrcmpiW
LoadLibraryA
ExpandEnvironmentStringsW
LocalFree
GetProcAddress
GetPrivateProfileIntW
LoadLibraryW
GetPrivateProfileStringW
GetFileTime

user32

GetClipboardData
GetKeyboardState
GetSystemMetrics
MsgWaitForMultipleObjects
WindowFromPoint
CharToOemW
TranslateMessage
CharLowerA
CharUpperW
SetWindowLongW
GetWindow
DispatchMessageW
CharLowerBuffA
CharLowerW
CreateDesktopW
SetProcessWindowStation
ToUnicode
CloseWindowStation
CreateWindowStationW
OpenDesktopW
CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
OpenWindowStationW
MapVirtualKeyW
GetMessageA
GetWindowRect
MessageBoxA
GetParent
GetClassLongW
GetCapture
SetCursorPos
GetWindowLongW
GetAncestor
PeekMessageW
PeekMessageA
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
GetSubMenu
DefDlgProcW
DefFrameProcA
MenuItemFromPoint
GetMenu
RegisterClassExW
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
GetMenuItemCount
DefDlgProcA
DefMDIChildProcA
HiliteMenuItem
RegisterClassW
CallWindowProcA
EndMenu
CallWindowProcW
DefFrameProcW
RegisterClassA
GetShellWindow
RegisterClassExA
DestroyWindow
LoadCursorW
OpenInputDesktop
GetThreadDesktop
LoadIconW
SetWindowPos
SendMessageTimeoutW
IsWindow
CreateWindowExA
ShowWindow
UpdateWindow
ReleaseCapture
MapWindowPoints
GetMessagePos
GetWindowThreadProcessId
EndPaint
GetUpdateRgn
GetMessageW
GetWindowDC
FillRect
PostMessageW
GetWindowInfo
DrawEdge
BeginPaint
GetUpdateRect
GetDC
IntersectRect
GetDCEx
ReleaseDC
PostThreadMessageW
GetKeyboardLayoutList
ExitWindowsEx
GetTopWindow
SetCapture
LoadImageW
EqualRect
PrintWindow
SendMessageW
DefWindowProcW
IsRectEmpty
DrawIcon
GetIconInfo
GetCursorPos
GetProcessWindowStation

advapi32

RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
ConvertSidToStringSidW
CreateProcessAsUserA
CreateProcessAsUserW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
GetSecurityDescriptorSacl
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegSetValueExW
CryptHashData
InitiateSystemShutdownExW
IsWellKnownSid
GetLengthSid
EqualSid

shlwapi

PathAddExtensionW
StrCmpNIW
PathRenameExtensionW
PathIsURLW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveBackslashW
PathUnquoteSpacesW
StrStrIA
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathQuoteSpacesW
StrStrIW
PathRemoveFileSpecW

shell32

CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

CLSIDFromString
StringFromGUID2
CoInitializeEx
CoUninitialize
CoCreateInstance

gdi32

RestoreDC
CreateCompatibleDC
SetRectRgn
SelectObject
DeleteObject
GdiFlush
DeleteDC
SetViewportOrgEx
CreateCompatibleBitmap
GetDIBits
GetDeviceCaps
CreateDIBSection
GetStockObject
SaveDC

ws2_32

recvfrom
getpeername
accept
listen
send
closesocket
WSASetLastError
socket
inet_addr
WSASend
gethostbyname
WSAEventSelect
getaddrinfo
select
getsockname
sendto
recv
freeaddrinfo
setsockopt
shutdown
WSAGetLastError
WSAStartup
WSAAddressToStringW
WSAIoctl
connect
bind

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData

wininet

HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA
InternetOpenA
InternetSetOptionA
HttpOpenRequestW
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetQueryOptionA
InternetCrackUrlA
InternetReadFile
InternetQueryOptionW
HttpQueryInfoA
InternetConnectA
InternetCloseHandle

oleaut32

SysFreeString
VariantInit
SysAllocString
VariantClear

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetInfo

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

winmm

PlaySoundW
waveOutSetVolume
waveOutGetVolume
PlaySoundA

Sections

.text
Size: 176KB - Virtual size: 175KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e47a7459459da3e52785ec87f154f6e5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

version

winmm

Sections

.text Size: 176KB - Virtual size: 175KB

.data Size: 2KB - Virtual size: 10KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 176KB - Virtual size: 175KB

.data
Size: 2KB - Virtual size: 10KB

.reloc
Size: 7KB - Virtual size: 7KB