a1d9f729ba0a93ca92686b0db80ceb5a_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

a1d9f729ba0a93ca92686b0db80ceb5a_JaffaCakes118
Size

553KB
MD5

a1d9f729ba0a93ca92686b0db80ceb5a
SHA1

6835e4b44a748d067fbb9fcc1d7f4ad7d2cf61d5
SHA256

e866ce1a165219488a44eab3ae217e8f849951f5c8859f0f848768c909609406
SHA512

45c35f44c73ff3cff81b7c31737257b37c809cd063a25c6cdb1986b71a5508e4ecae9a7afa0228514a41f448f975e8aa1a84771b1e3b0ae996637d5ef892480f
SSDEEP

6144:7mCNnDzCA1x4X3PXrPJAVcD8LPhSiWofQr2k5l8Xb4ZFFpt0bowi/EH1:7zBRUfXacD8pellob4zKo//EH1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a1d9f729ba0a93ca92686b0db80ceb5a_JaffaCakes118

Files

a1d9f729ba0a93ca92686b0db80ceb5a_JaffaCakes118
.exe windows:6 windows x86 arch:x86

6636fb2637141ace119521d0a717ed26

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

psr.pdb

Imports

advapi32

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
RegGetValueW
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
RegGetValueA
RegOpenKeyW
RegQueryValueExW
CloseTrace
ProcessTrace
OpenTraceW

kernel32

GetProcAddress
LoadLibraryExW
GetSystemTime
SystemTimeToTzSpecificLocalTime
CopyFileW
WideCharToMultiByte
HeapAlloc
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
SetLastError
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
lstrcmpW
GetSystemTimeAsFileTime
FormatMessageW
Sleep
MultiByteToWideChar
LockResource
LoadResource
FindResourceW
InitializeCriticalSection
RaiseException
DeleteCriticalSection
GetCurrentThreadId
UnregisterWait
GetCurrentProcess
IsWow64Process
HeapSetInformation
GetModuleHandleW
RegisterWaitForSingleObject
CreateMutexW
VirtualProtect
GetSystemInfo
LocalAlloc
VirtualQuery
FindNextFileA
FindFirstFileA
GetDriveTypeA
GetFileAttributesExW
SetFileAttributesW
GetFileInformationByHandle
SetFilePointer
ReplaceFileW
GetFileAttributesExA
lstrcmpA
GlobalReAlloc
FileTimeToDosDateTime
SetEvent
CreateFileA
lstrlenA
TlsGetValue
TlsFree
GlobalFree
GlobalHandle
TlsSetValue
TlsAlloc
OpenEventW
GetFullPathNameW
LocalFree
CloseHandle
GetSystemDirectoryW
GetCommandLineW
Wow64DisableWow64FsRedirection
GetModuleFileNameW
CreateFileMappingW
ReadFile
SizeofResource
WriteFile
UnmapViewOfFile
MapViewOfFile
GetFileSize
GetDateFormatW
DeleteFileA
SetCurrentDirectoryW
GetCurrentDirectoryW
FileTimeToLocalFileTime
OpenProcess
CreateFileW
GetTimeFormatW
FileTimeToSystemTime
GetProductInfo
GetVersionExW
FindClose
FindFirstFileW
FreeLibrary
OutputDebugStringA
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
InterlockedPushEntrySList
LoadLibraryExA
DecodePointer
VirtualAlloc
FlushInstructionCache
IsProcessorFeaturePresent
InterlockedPopEntrySList
VirtualFree
HeapFree
EncodePointer
lstrcmpiW
lstrcmpiA
MoveFileExW
DeleteFileW
WaitForSingleObject
CreateEventW
GetCurrentProcessId
ExpandEnvironmentStringsW
GetFileAttributesW
CreateDirectoryW
GetLastError
IsDBCSLeadByte

gdi32

CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
BitBlt
DeleteDC
GetStockObject
GetObjectW
GetDeviceCaps

user32

GetClassInfoExW
RedrawWindow
SetWindowPos
CreateWindowExW
DestroyWindow
CreateAcceleratorTableW
ClientToScreen
GetParent
ScreenToClient
MoveWindow
SetCapture
GetSysColor
CharUpperBuffA
CharPrevA
ReleaseCapture
FillRect
GetClientRect
InvalidateRgn
CallWindowProcW
InvalidateRect
GetDC
ReleaseDC
GetDesktopWindow
DestroyAcceleratorTable
GetWindowLongW
SetWindowLongW
DefWindowProcW
LoadCursorW
RegisterClassExW
CharUpperW
SetWindowTextW
CharToOemBuffA
OemToCharBuffA
CharNextA
DispatchMessageA
PeekMessageA
PostQuitMessage
LoadAcceleratorsW
GetMessageW
GetClassNameW
PostThreadMessageW
DispatchMessageW
TranslateMessage
MapDialogRect
SetWindowContextHelpId
TranslateAcceleratorW
PostMessageW
TrackPopupMenu
EnableMenuItem
DestroyMenu
GetSubMenu
LoadMenuW
MapWindowPoints
DestroyIcon
GetDlgItemTextW
GetDlgItemInt
EndDialog
SetDlgItemTextW
EnableWindow
SetDlgItemInt
SendDlgItemMessageW
DialogBoxParamW
LoadIconW
SetForegroundWindow
UnregisterHotKey
GetKeyState
UnregisterClassW
KillTimer
SetTimer
IsWindowVisible
GetWindowRect
AdjustWindowRect
GetProcessDefaultLayout
RegisterHotKey
UpdateWindow
ShowWindow
SystemParametersInfoW
GetSysColorBrush
GetSystemMetrics
LoadStringW
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
BeginPaint
EndPaint
IsChild
GetFocus
SetFocus
GetWindow
GetDlgItem
SendMessageW
IsWindow
UnregisterClassA
CharLowerA
MessageBoxW
CharNextW

msvcrt

wcscat_s
mbstowcs_s
memcpy_s
swprintf_s
malloc
calloc
_wcsupr
wcsstr
wcstoul
_wcstoui64
wcstol
wcsrchr
_itow_s
_vsnprintf
strstr
_mktemp
free
_vscwprintf
_snwscanf_s
wcschr
_callnewh
memset
qsort
memmove
time
gmtime
localtime
strncmp
_getdrive
memcpy
wcscpy_s
wcsncpy_s
_vsnwprintf
_wtoi
_wcsicmp
_CxxThrowException
__CxxFrameHandler3
_ftol2
_XcptFilter
__p__commode
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
__p__fmode
__setusermatherr
_initterm
_wcmdln
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UAE@XZ
_errno
_controlfp
_except_handler4_common
realloc
memcmp

comctl32

ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_Destroy
InitCommonControlsEx
ImageList_Create
ord381

oleaut32

VarBstrCmp
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
OleCreateFontIndirect
SysFreeString
VariantClear
VariantInit
SysAllocStringLen
LoadRegTypeLi
RegisterTypeLi
SysStringByteLen

ole32

CoGetClassObject
CoCreateGuid
StringFromGUID2
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
OleLockRunning
CoTaskMemAlloc

shell32

SHFileOperationW
ShellExecuteExW
ord171
ShellAboutW
SHCreateItemInKnownFolder
CommandLineToArgvW

shlwapi

PathGetArgsW
PathFindExtensionW
PathRemoveExtensionW
PathFindFileNameW
PathCombineW
PathRemoveFileSpecW
PathFileExistsW
SHAutoComplete
PathAppendW
ord216
PathRemoveBlanksW
SHCreateStreamOnFileEx
PathFindExtensionA
PathMatchSpecExA
PathIsSameRootW
ord218

ntdll

EtwEventWriteNoRegistration

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Sections

.text
Size: 163KB - Virtual size: 163KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 366KB - Virtual size: 366KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6636fb2637141ace119521d0a717ed26

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

oleaut32

ole32

shell32

shlwapi

ntdll

version

Sections

.text Size: 163KB - Virtual size: 163KB

.data Size: 2KB - Virtual size: 24KB

.idata Size: 9KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 12B

.rsrc Size: 366KB - Virtual size: 366KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 163KB - Virtual size: 163KB

.data
Size: 2KB - Virtual size: 24KB

.idata
Size: 9KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 12B

.rsrc
Size: 366KB - Virtual size: 366KB

.reloc
Size: 10KB - Virtual size: 9KB