a24146e2e20730fc7d38f27f0c5f1c16_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a24146e2e20730fc7d38f27f0c5f1c16_JaffaCakes118
Size

310KB
MD5

a24146e2e20730fc7d38f27f0c5f1c16
SHA1

283effeebf74239c8ea7d9455da23b57237fb60c
SHA256

6a974a1207c10751f337f228d22c1d0f47e1ba2c666982bcd6122256b115d7ad
SHA512

4599c607f928893441a1cf0458b2e41fcf1f00a51f7400ba0cc56a4e1adc4c017960f1af9e8426cd11028874e39d2212f6578fde7d20ea9a0796db630d71f763
SSDEEP

6144:R7P5FZKeY3NphvmulkOvCwmPXMKk35w64nA8FcKJKkVicujMy10P7:R7BFnCNphvmubvCh8Kk3514ASJEayI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a24146e2e20730fc7d38f27f0c5f1c16_JaffaCakes118

Files

a24146e2e20730fc7d38f27f0c5f1c16_JaffaCakes118
.exe windows:6 windows x86 arch:x86

c57b009869a19b0abb8ced07d2fb6aa4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

SndVol.pdb

Imports

gdi32

Rectangle
BeginPath
CreatePen
SetBkMode
EndPath
PathToRegion
Polygon
SetTextColor
SetBkColor
GetStockObject
GetObjectW
GetDeviceCaps
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
CreateFontIndirectW
DeleteObject

user32

AdjustWindowRectEx
MonitorFromRect
GetMonitorInfoW
IsWindowEnabled
SetCursor
OffsetRect
DrawFocusRect
LoadImageW
SystemParametersInfoW
EqualRect
SendMessageW
BringWindowToTop
DefWindowProcW
DestroyWindow
DialogBoxParamW
CreateWindowExW
CallWindowProcW
SetWindowLongW
GetWindowLongW
DialogBoxIndirectParamW
RegisterClassExW
LoadCursorW
GetClassInfoExW
RegisterWindowMessageW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
DestroyAcceleratorTable
GetSysColor
GetWindow
GetFocus
SetFocus
IsChild
EndPaint
FillRect
BeginPaint
GetClientRect
IsWindow
RedrawWindow
SetWindowPos
GetClassNameW
SetRectEmpty
CharNextW
GetDesktopWindow
ReleaseDC
GetDC
CreateAcceleratorTableW
MoveWindow
ClientToScreen
ScreenToClient
DrawEdge
SetClassLongW
GetClassLongW
EnumWindows
IsWindowVisible
InternalGetWindowText
FrameRect
ValidateRect
PrivateExtractIconsW
FindWindowW
SetForegroundWindow
ReleaseCapture
SetCapture
InvalidateRect
InvalidateRgn
GetDlgItem
MapWindowPoints
LoadStringW
GetSysColorBrush
DrawTextW
InflateRect
GetSystemMetrics
DestroyMenu
GetMenuItemInfoW
TrackPopupMenuEx
CheckMenuRadioItem
GetMenuItemCount
InsertMenuItemW
CreatePopupMenu
IntersectRect
MapDialogRect
GetWindowRect
ShowWindow
SendDlgItemMessageW
SetDlgItemTextW
SetWindowContextHelpId
SetWindowRgn
CreateDialogIndirectParamW
PostQuitMessage
GetDlgCtrlID
SubtractRect
PostMessageW
SetProcessDPIAware
SetProcessDefaultLayout
GetActiveWindow
GetParent
GhostWindowFromHungWindow
UnregisterClassA
GetIconInfoExW
SetScrollInfo
GetScrollPos
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
IsDlgButtonChecked
CheckDlgButton
CopyRect
SetRect
EnableWindow
EndDialog
EnumChildWindows
DestroyIcon
KillTimer
SetTimer
CalculatePopupWindowPosition
GetForegroundWindow
GetWindowThreadProcessId
GetDoubleClickTime
LoadIconW
NotifyWinEvent
PtInRect

msvcrt

_CxxThrowException
__CxxFrameHandler3
??_V@YAXPAX@Z
??3@YAXPAX@Z
_purecall
_wtoi
_wcsicmp
??2@YAPAXI@Z
memset
memcpy_s
malloc
free
??_U@YAPAXI@Z
swprintf_s
_ftol2_sse
_vsnwprintf
memmove_s
calloc
_controlfp
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
_errno
realloc
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
iswspace
memcpy
_cexit
__wgetmainargs
_isnan
_resetstkoflw
vswprintf_s
wcstol
_vscwprintf

api-ms-win-core-localregistry-l1-1-0

RegGetValueW
RegCreateKeyExW
RegSetValueExW
RegCloseKey

comctl32

ImageList_ReplaceIcon
ord17
ImageList_Destroy
ImageList_SetBkColor
ImageList_Create
ord381
ImageList_Draw
ImageList_Remove

ole32

StringFromGUID2
OleLockRunning
CLSIDFromString
PropVariantClear
CLSIDFromProgID
CoGetClassObject
OleInitialize
CreateStreamOnHGlobal
OleUninitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoInitialize
CoCreateGuid
CoUninitialize

oleaut32

SysAllocString
VariantInit
VariantClear
SysAllocStringLen
SysStringLen
SysStringByteLen
OleCreateFontIndirect
VarBstrCmp
LoadRegTypeLi
LoadTypeLi
SysFreeString

shell32

CommandLineToArgvW
ShellExecuteW
SHGetFileInfoW
Shell_NotifyIconGetRect

gdiplus

GdipCreateSolidFill
GdiplusStartup
GdiplusShutdown
GdipFree
GdipAlloc
GdipCreateLineBrush
GdipCreatePen1
GdipDeletePen
GdipCloneBrush
GdipFillPath
GdipFillRectangle
GdipDrawLine
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipAddPathLine
GdipDeletePath
GdipCreatePath
GdipDeleteBrush

ntdll

EtwEventWrite
EtwTraceMessage
EtwEventUnregister
EtwEventRegister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags

uxtheme

DrawThemeTextEx
BufferedPaintSetAlpha
BeginBufferedPaint
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
DrawThemeParentBackground
DrawThemeParentBackgroundEx
GetThemeTextExtent
SetWindowTheme
IsThemeActive
OpenThemeData
DrawThemeBackground
DrawThemeText
CloseThemeData
BufferedPaintUnInit
BufferedPaintInit
GetThemeColor
EndBufferedPaint

dwmapi

DwmRegisterThumbnail
DwmUpdateThumbnailProperties
DwmUnregisterThumbnail
DwmIsCompositionEnabled
DwmSetWindowAttribute
DwmQueryThumbnailSourceSize

shlwapi

PathParseIconLocationW
ord487
StrTrimW
PathFindExtensionW
PathFindFileNameW
ord348

kernel32

GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
VirtualAlloc
VirtualFree
LoadLibraryA
InterlockedExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
LoadLibraryExA
InterlockedCompareExchange
FreeLibrary
GetProcAddress
DelayLoadFailureHook
QueryFullProcessImageNameW
GetTickCount
OpenProcess
GetExitCodeProcess
RegisterWaitForSingleObject
QueueUserWorkItem
FormatMessageW
LocalFree
SetEvent
WaitForSingleObject
ResetEvent
CreateThread
SetThreadPriority
CreateEventW
GetCurrentProcessId
CreateProcessW
QueryPerformanceCounter
FindResourceExW
SizeofResource
lstrlenA
MultiByteToWideChar
Sleep
LeaveCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
GetModuleFileNameW
MulDiv
lstrcmpW
lstrlenW
GlobalLock
GlobalUnlock
FindResourceW
GlobalAlloc
LoadResource
LockResource
GlobalHandle
EnterCriticalSection
GetCurrentProcess
FlushInstructionCache
RaiseException
GetCurrentThreadId
SetLastError
CreateMutexW
GetLastError
CloseHandle
HeapSetInformation
GlobalFree
ExpandEnvironmentStringsW
FreeResource
LoadLibraryExW
GetUserDefaultUILanguage
GetLocaleInfoW
EnumUILanguagesW
OutputDebugStringA
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
UnregisterWaitEx

Sections

.text
Size: 229KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c57b009869a19b0abb8ced07d2fb6aa4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdi32

user32

msvcrt

api-ms-win-core-localregistry-l1-1-0

comctl32

ole32

oleaut32

shell32

gdiplus

ntdll

uxtheme

dwmapi

shlwapi

kernel32

Sections

.text Size: 229KB - Virtual size: 228KB

.data Size: 1KB - Virtual size: 4KB

.rsrc Size: 65KB - Virtual size: 65KB

.reloc Size: 13KB - Virtual size: 16KB

.text
Size: 229KB - Virtual size: 228KB

.data
Size: 1KB - Virtual size: 4KB

.rsrc
Size: 65KB - Virtual size: 65KB

.reloc
Size: 13KB - Virtual size: 16KB