a183f0b85ff04990618cde6687b12c1f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a183f0b85ff04990618cde6687b12c1f_JaffaCakes118
Size

206KB
MD5

a183f0b85ff04990618cde6687b12c1f
SHA1

0d8552c4af0dfd55690955972fe293c81a6c64d2
SHA256

ea9384ad724afb0f50619ce372fa4abf49014c5e3bdf76d2814add18f5d5c050
SHA512

82ffb24d0e1ca99e445adc7c22c477f90f7abd803afaf3e921fd47d8d67465b4cac6d7382f8418f37058ade9dc83d00b34e637bd3c583355cd379e7a3cb1ba23
SSDEEP

3072:MAdMqqED0I1ttnjX28Nyd8cfsG4GlkVeqrhUTYgLmu+7mHHxqr7Y:MAuqqED0IpnC81Y549Ves7gQ7mHHa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a183f0b85ff04990618cde6687b12c1f_JaffaCakes118

Files

a183f0b85ff04990618cde6687b12c1f_JaffaCakes118
.exe windows:6 windows x86 arch:x86

4b0349cb5dde091c2fb0e50a02be5440

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

dwm.pdb

Imports

gdi32

GetDeviceCaps
D3DKMTSetProcessSchedulingPriorityClass
GetRandomRgn
GetStockObject
CreateCompatibleBitmap
DeleteObject
GetDIBits
BitBlt
DeleteDC
GetRgnBox
SelectObject
SelectClipRgn
CreateCompatibleDC
CombineRgn
OffsetRgn
GdiAlphaBlend
CreateRectRgn
CreateDIBSection

user32

GetClassNameW
UpdateWindow
SetWindowTextW
DestroyIcon
GetWindowThreadProcessId
GetWindowRect
OffsetRect
SetClassLongW
MonitorFromWindow
AdjustWindowRectEx
GetMonitorInfoW
EnumDisplayDevicesW
EnumDisplaySettingsW
GetSystemMetrics
MsgWaitForMultipleObjectsEx
PostMessageW
RegisterErrorReportingDialog
RegisterGhostWindow
HungWindowFromGhostWindow
InternalGetWindowIcon
GhostWindowFromHungWindow
RegisterFrostWindow
OpenThreadDesktop
GetWindow
CloseDesktop
GetPropW
UnregisterSessionPort
RegisterSessionPort
CheckDesktopByThreadId
DwmStopRedirection
DwmStartRedirection
SetForegroundWindow
IsHungAppWindow
MessageBeep
IsWindowEnabled
EnumWindows
FlashWindowEx
SendMessageTimeoutW
IsWindow
GetCaretBlinkTime
EndTask
OpenDesktopW
IsDialogMessageW
GetAncestor
SetThreadDesktop
EndPaint
ClientToScreen
InternalGetWindowText
GetUpdateRgn
SetTimer
IsIconic
FillRect
KillTimer
IsZoomed
GetTitleBarInfo
GetWindowInfo
LogicalToPhysicalPoint
GetClientRect
BeginPaint
ChangeWindowMessageFilterEx
InvalidateRect
GetWindowLongW
GetWindowTextW
GetDCEx
SetWindowLongW
ShowWindow
GetSysColorBrush
CreateDialogParamW
PostThreadMessageW
IsWindowVisible
GetGuiResources
SetWindowPos
LoadStringW
LoadIconW
RegisterWindowMessageW
DispatchMessageW
TranslateMessage
PeekMessageW
RegisterPowerSettingNotification
ReleaseDC
GetDC
PostQuitMessage
DestroyWindow
UnregisterPowerSettingNotification
DefWindowProcW
CreateWindowExW
RegisterClassExW
GetThreadDesktop
GetUserObjectInformationW
SystemParametersInfoW
SendMessageW

msvcrt

memset
_unlock
__dllonexit
_wcsnicmp
_onexit
_except_handler4_common
_CIsqrt
memcpy
_wcsupr_s
wcschr
wcsncpy_s
wcsrchr
??_U@YAPAXI@Z
??_V@YAXPAX@Z
rand
srand
_wcsicmp
_purecall
_lock
_vsnwprintf
_controlfp
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
memmove
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_amsg_exit
_ftol2

ntdll

DbgPrompt
NtQuerySystemInformation
DbgPrintEx
RtlCaptureStackBackTrace
WinSqmAddToStreamEx
WinSqmIsOptedIn
NtAcceptConnectPort
NtCompleteConnectPort
NtReplyWaitReceivePort
NtRequestPort
NtConnectPort
NtRequestWaitReplyPort
RtlUpcaseUnicodeChar
WinSqmIncrementDWORD
RtlNtStatusToDosError
EtwEventWriteNoRegistration
NtClose
NtWaitForSingleObject
NtOpenEvent
RtlFreeSid
NtAlpcSendWaitReceivePort
NtAlpcConnectPort
RtlAllocateAndInitializeSid
NtQueryInformationProcess
NtReplyPort
NtCreateWaitablePort
RtlInitUnicodeString
RtlInsertElementGenericTable
RtlIsGenericTableEmpty
RtlLookupElementGenericTable
RtlInitializeGenericTable
EtwEventEnabled
EtwEventRegister
EtwEventUnregister
RtlEnumerateGenericTableWithoutSplaying
RtlDeleteElementGenericTable
WinSqmAddToStream
EtwEventWrite

uxtheme

CloseThemeData
OpenThemeData

imm32

ImmDisableIME

dwmredir

DwmRedirectionManagerLockMemoryAllocations
DwmRedirectionManagerEnableMMCSS
DwmRedirectionManagerPlayingVideo
DwmInitializeTransport
DwmShutdownTransport
DwmRedirectionManagerShutdown
DwmRedirectionManagerShouldRemainOnHibernate
DwmRedirectionManagerDispatchMessage
DwmRedirectionManagerFailMessage
DwmRedirectionManagerWaitForMultipleObjects
DwmVersionCheck

dwmcore

MilChannel_CommitChannel
MilComposition_WaitForNextMessage
MilCompositionEngine_UpdateSchedulerSettings
MilResource_SendCommand
MilChannel_GetMarshalType
MilConnection_CreateChannel
MilConnection_HandleSfmEventOnPartition
MilConnection_ClearSfmEventOnPartition
MilConnection_DestroyChannel
MilComposition_PeekNextMessage

kernel32

InterlockedExchange
GetStartupInfoA
GetModuleHandleA
LocalAlloc
LocalFree
ResumeThread
DuplicateHandle
InterlockedDecrement
InterlockedIncrement
lstrcmpiW
WaitForMultipleObjectsEx
IsWow64Process
RegSetValueExW
RegCreateKeyExW
QueryPerformanceCounter
SetThreadPriority
CreateThread
OpenProcess
ReleaseMutex
CreateMutexW
SetEvent
OpenEventW
SignalObjectAndWait
UnhandledExceptionFilter
GetCurrentThread
TerminateThread
TerminateProcess
DebugBreak
GetProcessHeap
HeapReAlloc
HeapAlloc
HeapFree
IsDebuggerPresent
GetModuleHandleW
LoadLibraryExA
InterlockedCompareExchange
FreeLibrary
DelayLoadFailureHook
Sleep
GetUserDefaultLangID
FormatMessageW
GetExitCodeThread
WaitForSingleObject
RegisterWaitForSingleObject
GetThreadId
GetTickCount
ProcessIdToSessionId
CreateEventW
GetCurrentProcessId
SetProcessWorkingSetSize
GetSystemTimeAsFileTime
RegGetValueW
GetSystemInfo
GetCurrentProcess
GetProcAddress
LoadLibraryW
SetErrorMode
QueryFullProcessImageNameW
ExitProcess
GetCurrentThreadId
SetProcessShutdownParameters
SetUnhandledExceptionFilter
HeapSetInformation
WerSetFlags
SetLastError
CloseHandle
GetLastError
GetTickCount64
DeleteCriticalSection
InitializeCriticalSection
QueueUserWorkItem
LeaveCriticalSection
EnterCriticalSection

Sections

.text
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

dqlonav
Size: 58KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

lgsvvda
Size: 31KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4b0349cb5dde091c2fb0e50a02be5440

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdi32

user32

msvcrt

ntdll

uxtheme

imm32

dwmredir

dwmcore

kernel32

Sections

.text Size: 75KB - Virtual size: 75KB

.data Size: 4KB - Virtual size: 10KB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 30KB - Virtual size: 32KB

dqlonav Size: 58KB - Virtual size: 60KB

lgsvvda Size: 31KB - Virtual size: 32KB

.text
Size: 75KB - Virtual size: 75KB

.data
Size: 4KB - Virtual size: 10KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 30KB - Virtual size: 32KB

dqlonav
Size: 58KB - Virtual size: 60KB

lgsvvda
Size: 31KB - Virtual size: 32KB