a45185ed65864f85d7e1e058f3ebf1dc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a45185ed65864f85d7e1e058f3ebf1dc_JaffaCakes118
Size

340KB
MD5

a45185ed65864f85d7e1e058f3ebf1dc
SHA1

cafdb505c99ed0579b648049546cc67f7ddd3c1b
SHA256

74a0f2cecf77d1b4ae8c024a69c125d3e14c91f5c005ce1bd97005ca062e3216
SHA512

f2fc1dedf116bbac400dcce5b32193d03ebb081ca5c35786e50d8f03522df0cf9699554838e642efc4922ce545fc3d370eb9fd7ad0926100cf9d0a0b7e9f05f7
SSDEEP

6144:0gHUDuClyC2MTR+tJR6bFKpPdTVZPLxp9D04ZTwh2EZHxVS/5EpU:cDjD25tD6Jq1LTxD01hQapU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a45185ed65864f85d7e1e058f3ebf1dc_JaffaCakes118

Files

a45185ed65864f85d7e1e058f3ebf1dc_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6e82991d88e8dfd0c577417dafe8b5b4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumKeyW
RegEnumValueW
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
RegSetValueExW

kernel32

GetVolumeNameForVolumeMountPointW
GlobalAlloc
GlobalFree
GlobalHandle
GlobalLock
GlobalSize
GlobalUnlock
HeapAlloc
HeapDestroy
HeapFree
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalAlloc
LocalFree
LockResource
MapViewOfFile
MapViewOfFileEx
MoveFileW
MulDiv
MultiByteToWideChar
OpenFileMappingA
OutputDebugStringW
PostQueuedCompletionStatus
QueryPerformanceCounter
ReadDirectoryChangesW
ReadFile
ReleaseMutex
RemoveDirectoryW
GetVolumeInformationW
SetEndOfFile
SetEnvironmentVariableW
SetErrorMode
SetEvent
SetFileAttributesW
ExpandEnvironmentStringsW
SetFilePointerEx
SetLastError
SetThreadExecutionState
SetThreadPriority
SetUnhandledExceptionFilter
SizeofResource
Sleep
SleepEx
SystemTimeToTzSpecificLocalTime
TerminateProcess
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrcatW
lstrcmpW
lstrcmpiW
lstrcpyW
lstrcpynA
lstrcpynW
lstrlenA
lstrlenW
GetVersionExW
GetVersion
GetUserDefaultUILanguage
GetUserDefaultLCID
GetTimeFormatW
GetTickCount
GetThreadLocale
GetTempPathW
GetTempFileNameW
GetSystemTimeAsFileTime
GetStartupInfoA
GetShortPathNameW
GetQueuedCompletionStatus
GetProfileIntW
GetProcessHeap
GetProcAddress
GetPrivateProfileStringW
GetPrivateProfileIntW
GetOverlappedResult
GetNumberFormatW
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
GetLongPathNameW
GetLocaleInfoW
GetLastError
GetFullPathNameW
GetFileSizeEx
GetFileSize
GetFileAttributesW
GetFileAttributesExW
GetExitCodeThread
GetDriveTypeW
GetDiskFreeSpaceW
GetDiskFreeSpaceExW
GetDateFormatW
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetCommandLineW
GetACP
FreeResource
FreeLibrary
FormatMessageW
FlushInstructionCache
FindResourceW
FindNextFileW
FindFirstFileW
FindClose
ResetEvent
FileTimeToSystemTime
CloseHandle
CompareFileTime
CompareStringW
CopyFileW
CreateDirectoryW
CreateEventW
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateIoCompletionPort
CreateMutexW
CreateThread
DebugBreak
DeleteCriticalSection
DeleteFileW
DeviceIoControl
EnterCriticalSection
EnumResourceLanguagesW
EnumUILanguagesW
SetFilePointer

gdi32

StretchBlt
SetWindowOrgEx
SetViewportOrgEx
SetTextColor
SetRectRgn
SetROP2
SetMapMode
SetBrushOrgEx
SetBkMode
SetBkColor
SelectObject
SelectClipRgn
SaveDC
RestoreDC
Rectangle
Polygon
PatBlt
MoveToEx
LineTo
LPtoDP
GetTextMetricsW
GetTextExtentPoint32W
GetStockObject
GetObjectW
GetObjectA
GetNearestColor
GetLayout
GetDeviceCaps
GetDIBits
GetCurrentObject
GetClipBox
ExtTextOutW
ExcludeClipRect
DeleteObject
DeleteDC
DPtoLP
CreateSolidBrush
CreateRectRgnIndirect
CreateRectRgn
CreatePen
CreatePatternBrush
CreateFontIndirectW
CreateDIBSection
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
CreateBitmap
CombineRgn
BitBlt
TextOutW

user32

GetProcessDefaultLayout
GetScrollInfo
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMenu
GetSystemMetrics
GetTopWindow
GetWindow
GetWindowDC
GetWindowLongA
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
GetWindowThreadProcessId
InflateRect
InsertMenuW
IntersectRect
InvalidateRect
InvalidateRgn
IsChild
IsDialogMessageW
IsDlgButtonChecked
IsIconic
IsMenu
IsRectEmpty
IsWindow
IsWindowEnabled
IsWindowUnicode
IsWindowVisible
KillTimer
LoadAcceleratorsW
LoadBitmapW
LoadCursorW
LoadIconW
LoadImageW
LoadMenuW
LoadStringA
LoadStringW
MapDialogRect
MapWindowPoints
MessageBeep
MessageBoxW
ModifyMenuW
MonitorFromWindow
MoveWindow
MsgWaitForMultipleObjects
NotifyWinEvent
OffsetRect
PeekMessageW
GetParent
PostQuitMessage
PostThreadMessageW
PtInRect
RedrawWindow
RegisterClassExW
RegisterClipboardFormatW
RegisterWindowMessageW
ReleaseCapture
ReleaseDC
RemoveMenu
ScreenToClient
ScrollWindowEx
SendMessageA
SendMessageW
SetActiveWindow
SetCapture
SetClassLongW
SetCursor
SetDlgItemInt
SetDlgItemTextW
SetFocus
SetForegroundWindow
SetMenu
SetMenuDefaultItem
SetMenuItemInfoW
SetProcessDefaultLayout
SetRect
SetRectEmpty
SetScrollInfo
SetScrollPos
SetTimer
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowRgn
SetWindowTextW
SetWindowsHookExW
ShowWindow
SystemParametersInfoW
TrackMouseEvent
TrackPopupMenu
TrackPopupMenuEx
TranslateAcceleratorW
TranslateMessage
UnhookWindowsHookEx
UnionRect
UnregisterClassW
UpdateLayeredWindow
UpdateWindow
WindowFromPoint
wsprintfW
GetNextDlgTabItem
GetMonitorInfoW
GetMessageW
GetMessageTime
GetMessagePos
GetMenuStringW
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyState
GetIconInfo
GetForegroundWindow
GetFocus
GetDoubleClickTime
GetDlgItemInt
GetDlgItem
GetDlgCtrlID
GetDesktopWindow
GetDC
GetCursorPos
GetClientRect
GetClassNameW
GetClassNameA
GetClassLongW
GetClassInfoExW
GetCapture
GetAsyncKeyState
GetAncestor
GetActiveWindow
FrameRect
FindWindowW
PostMessageW
FindWindowExW
FillRect
EqualRect
EndPaint
EndMenu
EndDialog
EnableWindow
EnableMenuItem
DrawTextW
DrawTextExW
DrawTextA
DrawIcon
DrawFrameControl
DrawFocusRect
DrawEdge
DragDetect
DispatchMessageW
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DestroyAcceleratorTable
DeleteMenu
DefWindowProcW
CreateWindowExW
CreatePopupMenu
CreateDialogParamW
CreateDialogIndirectParamW
CreateAcceleratorTableW
CopyRect
CopyImage
CopyIcon
ClipCursor
ClientToScreen
CheckDlgButton
CharUpperW
CharUpperBuffW
CharNextW
CharLowerW
CallWindowProcW
CallNextHookEx
BringWindowToTop
BeginPaint
AppendMenuW
AdjustWindowRectEx
DialogBoxParamW

comdlg32

GetSaveFileNameW
ChooseColorW
GetOpenFileNameW

shell32

SHPathPrepareForWriteW
DragQueryFileW
SHAddToRecentDocs
SHBrowseForFolderW
SHFileOperationW
SHGetDesktopFolder
SHGetDiskFreeSpaceExW
SHGetFileInfoW
SHGetFolderLocation
SHGetFolderPathW
SHGetMalloc
ShellExecuteW
ShellExecuteExW
ShellAboutW
CommandLineToArgvW
SHGetSpecialFolderPathW
SHGetSettings
SHGetPathFromIDListW

ole32

CoTaskMemAlloc
CoRevokeClassObject
CoResumeClassObjects
CoRegisterClassObject
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoTaskMemFree
CoFreeUnusedLibraries
CoCreateInstance
CoCreateGuid
CLSIDFromString
CLSIDFromProgID
CoUninitialize
CreateOleAdviseHolder
CreateStreamOnHGlobal
DoDragDrop
FreePropVariantArray
GetRunningObjectTable
OleFlushClipboard
OleGetClipboard
OleInitialize
OleIsCurrentClipboard
OleLoadFromStream
OleLockRunning
OleRegEnumVerbs
OleRegGetUserType
OleSaveToStream
OleSetClipboard
OleUninitialize
PropVariantClear
RegisterDragDrop
ReleaseStgMedium
RevokeDragDrop
StgCreateDocfile
StgCreatePropStg
StgIsStorageFile
StgOpenPropStg
StgOpenStorage
StringFromCLSID
StringFromGUID2
WriteClassStm
CoGetInterfaceAndReleaseStream

oleaut32

VariantClear
VariantCopy
VariantInit
VariantChangeType
SysStringLen
SysStringByteLen
SysFreeString
SysAllocString
SysAllocStringLen
SysAllocStringByteLen
DispCallFunc
LoadRegTypeLi
LoadTypeLi
OleCreateFontIndirect
OleCreatePropertyFrame
RegisterTypeLi
RevokeActiveObject
SafeArrayCopy
SafeArrayCreateVector
SafeArrayDestroy
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayPutElement
VariantChangeTypeEx

comctl32

_TrackMouseEvent
PropertySheetW
InitCommonControlsEx
ImageList_ReplaceIcon
ImageList_Remove
ImageList_LoadImageW
ImageList_GetImageCount
ImageList_GetIconSize
ImageList_GetIcon
ImageList_DrawIndirect
ImageList_Draw
ImageList_Destroy
ImageList_Create
ImageList_AddMasked
ImageList_Add
DestroyPropertySheetPage
CreateStatusWindowW
CreatePropertySheetPageW
ord8

shlwapi

SHAutoComplete
PathStripToRootW
PathSkipRootW
PathRemoveFileSpecW
PathIsURLW
PathIsRelativeW
PathFindNextComponentW
PathFindFileNameW
PathFindExtensionW
PathCompactPathExW
PathAddBackslashW
StrRetToStrW
UrlGetPartW
UrlIsW
PathCanonicalizeW

winmm

waveOutOpen
waveOutGetNumDevs
waveOutClose
timeGetTime
mixerSetControlDetails
mixerOpen
mixerGetNumDevs
mixerGetLineInfoW
mixerGetLineControlsW
mixerGetID
mixerGetDevCapsW
mixerClose
mixerGetControlDetailsW

rpcrt4

UuidToStringW
UuidToStringA
UuidFromStringW
UuidEqual
UuidCreate
RpcStringFreeW
RpcStringFreeA

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

crypt32

CryptUnprotectData
CryptProtectData

wininet

InternetWriteFile
InternetReadFile
FtpCreateDirectoryW
FtpSetCurrentDirectoryW
HttpAddRequestHeadersW
HttpEndRequestW
HttpOpenRequestW
HttpSendRequestExW
HttpSendRequestW
InternetAttemptConnect
InternetAutodial
InternetCheckConnectionW
InternetCloseHandle
InternetConnectW
InternetGetConnectedState
InternetGetLastResponseInfoW
InternetGoOnlineW
InternetOpenUrlW
InternetOpenW

Exports

Exports

SqmAddToAverage
SqmAddToStream
SqmAddToStreamDWord
SqmAddToStreamString
SqmAddToStreamV
SqmCleanup
SqmClearFlags
SqmCreateNewId
SqmEndSession
SqmFlushSession
SqmGetEnabled
SqmGetFlags
SqmGetMachineId
SqmGetSession
SqmGetSessionStartTime
SqmGetUserId
SqmIncrement
SqmIsWindowsOptedIn
SqmReadSharedMachineId
SqmReadSharedUserId
SqmSet
SqmSetAppId
SqmSetAppVersion
SqmSetBits
SqmSetBool
SqmSetCurrentTimeAsUploadTime
SqmSetEnabled
SqmSetFlags
SqmSetIfMax
SqmSetIfMin
SqmSetMachineId
SqmSetString
SqmSetUserId
SqmStartSession
SqmStartUpload
SqmSysprepGeneralize
SqmSysprepSpecialize
SqmTimerAccumulate
SqmTimerAddToAverage
SqmTimerRecord
SqmTimerStart
SqmUnattendedSetup
SqmWaitForUploadComplete
SqmWriteSharedMachineId
SqmWriteSharedUserId

Sections

.text
Size: 228KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6e82991d88e8dfd0c577417dafe8b5b4

Headers

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

comdlg32

shell32

ole32

oleaut32

comctl32

shlwapi

winmm

rpcrt4

version

crypt32

wininet

Exports

Exports

Sections

.text Size: 228KB - Virtual size: 228KB

.rdata Size: 44KB - Virtual size: 44KB

.data Size: 24KB - Virtual size: 1.7MB

.idata Size: 16KB - Virtual size: 16KB

.rsrc Size: 24KB - Virtual size: 24KB

.text
Size: 228KB - Virtual size: 228KB

.rdata
Size: 44KB - Virtual size: 44KB

.data
Size: 24KB - Virtual size: 1.7MB

.idata
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 24KB - Virtual size: 24KB