a384d30d59fd842075c3e939fae9023e_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

a384d30d59fd842075c3e939fae9023e_JaffaCakes118
Size

128KB
MD5

a384d30d59fd842075c3e939fae9023e
SHA1

516a48cfd818c7056606f08021c8bbd1e2441e49
SHA256

efabed3d2b4081eee2f91ff210231dac308cc1a8b56e5d767e963c5fe50aadd5
SHA512

412a8d9ad2e77578f8b1a2104ff62f43ba82e96ebb3ef2c3c1e2a28773d28b9826763cfbb8ef6460b559ab9277b9e2ca01781dbcd4b665fc6a145424c516c889
SSDEEP

1536:XScGRPsfeOIyQ2hfeKb5UbKTm1pVshxiRNJqhqXKp6JRCKrefdMdHJVp:heOIc9Q1pMiLJqhwAaR9JVp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a384d30d59fd842075c3e939fae9023e_JaffaCakes118

Files

a384d30d59fd842075c3e939fae9023e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f93506476d93ce3fc45ff85eee64b055

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
FindClose
FindNextFileA
FindFirstFileA
GetCurrentDirectoryA
GetTickCount
GetSystemDirectoryA
SystemTimeToFileTime
CompareFileTime
FreeLibrary
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetEnvironmentVariableW
GetVersionExA
HeapFree
HeapAlloc
MapViewOfFile
FileTimeToSystemTime
FileTimeToLocalFileTime
VirtualQueryEx
ReadProcessMemory
CreateProcessA
SetLastError
LocalAlloc
LocalFree
FormatMessageA
WideCharToMultiByte
Module32NextW
Module32FirstW
CreateRemoteThread
GetTimeZoneInformation
GetModuleHandleA
UnmapViewOfFile
GetLastError
ExitProcess
GetPrivateProfileStringA
LoadLibraryA
GetProcAddress
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetComputerNameA
lstrlenA
lstrcmpA
lstrcpynA
lstrcpyA
lstrcatA
DeleteFileA
TerminateProcess
MultiByteToWideChar
GetCurrentProcess
GetCurrentProcessId
CreateEventA
DuplicateHandle
lstrcmpiA
DeviceIoControl
GetSystemInfo
IsProcessorFeaturePresent
GlobalMemoryStatus
GetLogicalDriveStringsA
GetDriveTypeA
OpenProcess
CreateThread
Sleep
GlobalAlloc
GlobalLock
WriteFile
GlobalUnlock
GlobalFree
GetWindowsDirectoryA
WritePrivateProfileStringA
GetTempPathA
CreateFileA
GetFileTime
CloseHandle
SetFileTime
GetProcessHeap

user32

IsRectEmpty
ReleaseDC
GetDC
GetSystemMetrics
GetDesktopWindow
GetKeyboardState
wsprintfA
IsCharAlphaNumericA
keybd_event
GetClientRect

gdi32

GetStockObject
SelectPalette
RealizePalette
GetDIBits
CreateDCA
CreateCompatibleDC
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteDC
DeleteObject
GetObjectA

advapi32

CreateProcessAsUserA
QueryServiceConfigA
ChangeServiceConfigA
DeleteService
OpenProcessToken
GetTokenInformation
LookupAccountSidA
RegEnumKeyA
RegQueryInfoKeyA
RegEnumValueA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegSetValueExA
OpenSCManagerA
OpenServiceA
ControlService
StartServiceA
CloseServiceHandle
RegConnectRegistryA
RegCloseKey
CreateServiceA
AdjustTokenPrivileges
LookupPrivilegeValueA
QueryServiceStatus
RegEnumKeyExA
RegDeleteValueA
LogonUserA
RegQueryMultipleValuesA
EnumServicesStatusA

shell32

SHGetSpecialFolderPathA

ole32

CoInitialize
CoCreateInstance
CoTaskMemFree

msvcrt

_itoa
_stricmp
_CxxThrowException
??1type_info@@UAE@XZ
_wcsicmp
_controlfp
sprintf
printf
__CxxFrameHandler
strchr
strstr
atoi
_strlwr
??2@YAPAXI@Z
free
strncpy
malloc
abort
isspace
_except_handler3
mbstowcs
_strupr
_mbscmp
strrchr
atol
fclose
fflush
fprintf
fopen
fgets
realloc
isdigit
strncmp
fread
ftell
fseek
fwrite
_exit
_XcptFilter
exit
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type

netapi32

NetShareEnum
Netbios
NetShareAdd
NetShareDel
NetApiBufferFree
NetQueryDisplayInformation
NetUserEnum
NetScheduleJobAdd
NetRemoteTOD

wsock32

WSACleanup
send
inet_addr
closesocket
gethostbyaddr
ioctlsocket
WSAStartup
shutdown
htonl
select
recv
socket
inet_ntoa
htons
ntohl
connect

psapi

EnumProcesses
EnumProcessModules
GetModuleFileNameExA

setupapi

CM_Connect_MachineA
SetupDiGetDeviceRegistryPropertyA
CM_Disconnect_Machine
CM_Get_Sibling_Ex
SetupDiGetClassDevsA
CM_Locate_DevNode_ExA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
CM_Get_DevNode_Registry_Property_ExA
CM_Get_Child_Ex

rpcrt4

UuidFromStringA

msvcirt

?cerr@@3Vostream_withassign@@A
?cout@@3Vostream_withassign@@A
??6ostream@@QAEAAV0@PBD@Z
?endl@@YAAAVostream@@AAV1@@Z
??6ostream@@QAEAAV0@K@Z

iphlpapi

SendARP

urlmon

URLDownloadToFileA

mpr

WNetCancelConnection2A
WNetAddConnection2A

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

oleaut32

GetErrorInfo

Sections

.text
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f93506476d93ce3fc45ff85eee64b055

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

msvcrt

netapi32

wsock32

psapi

setupapi

rpcrt4

msvcirt

iphlpapi

urlmon

mpr

version

oleaut32

Sections

.text Size: 68KB - Virtual size: 66KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 48KB - Virtual size: 67KB

.text
Size: 68KB - Virtual size: 66KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 48KB - Virtual size: 67KB