a7d9931a296f8490b4e8ca56a736eacc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a7d9931a296f8490b4e8ca56a736eacc_JaffaCakes118
Size

364KB
MD5

a7d9931a296f8490b4e8ca56a736eacc
SHA1

39965b150e8f6b2097f7da9f37f0c1249485ad63
SHA256

412e3e61551a062a9f6f4ad212294196277b23415f3023d5d5eae265ce78cec1
SHA512

7c8cb91d587a90897607dccb6f0c852e7bca823f2ac939ab5cdd8dfc95bfb0b5c698ede36c82ddb7ed0159fc258954c4a141d3bee0ca3406d7f5a86612d9c905
SSDEEP

6144:1o2eJRZ2rZburOUNNu56SO2oLzD0hOzu17e7UAirQcRzam2L8cw3IaDsF:fKSrZCOU0iDie8q7UAirw3L+3S

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a7d9931a296f8490b4e8ca56a736eacc_JaffaCakes118

Files

a7d9931a296f8490b4e8ca56a736eacc_JaffaCakes118
.exe windows:5 windows x86 arch:x86

555c3d0176c4b8b8b757294d6c07008c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

WMSDMOE.pdb

Imports

shell32

SHGetFolderPathW
SHChangeNotify
SHGetSpecialFolderLocation
SHGetPathFromIDListW

setupapi

SetupOpenAppendInfFileW
SetupAddInstallSectionToDiskSpaceListW
SetupRemoveInstallSectionFromDiskSpaceListW
SetupAdjustDiskSpaceListW
SetupInstallFromInfSectionW
SetupSetDirectoryIdW
SetupInstallFilesFromInfSectionW

comctl32

CreatePropertySheetPageW

rpcrt4

NdrServerCall2
NdrClientCall2
UuidCreate
RpcBindingFree
RpcMgmtSetCancelTimeout
RpcStringFreeW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcCancelThread

user32

GetDC
SendMessageA
ReleaseDC
CountClipboardFormats
SendMessageW
GetDlgItem
SetDlgItemTextW
GetDesktopWindow
GetDlgItemTextW
TranslateMessage
DestroyWindow
GetClipboardViewer
GetCursor
LoadBitmapA
SystemParametersInfoW
ShowWindow
DefWindowProcW
EnumWindows
GetForegroundWindow
DispatchMessageW
PeekMessageW
PostMessageW
CharNextW
UnregisterClassA
MsgWaitForMultipleObjects
LoadStringW
DefWindowProcA
GetMessageA
MessageBoxW
CheckRadioButton
CreateDialogParamW
DispatchMessageA
GetActiveWindow
EnableWindow
GetDoubleClickTime
SetWindowLongW
GetParent
PostQuitMessage
GetClipboardSequenceNumber
wsprintfW
FindWindowA
EndDialog
GetClipboardOwner
CreateWindowExA
UpdateWindow
LoadIconA
SendDlgItemMessageW
FindWindowExA
DialogBoxParamW

gdi32

SelectObject
AddFontResourceA
SetPixel
DeleteObject
ExtCreatePen
GetPixel
DeleteDC
CreateBrushIndirect
BitBlt
CreateFontIndirectW
GetStockObject
CreateSolidBrush
GetDeviceCaps

advapi32

ChangeServiceConfigW
OpenSCManagerW
GetLengthSid
InitializeSecurityDescriptor
InitializeAcl
AddAccessAllowedAceEx
SetSecurityDescriptorDacl
SetFileSecurityW
FreeSid
LookupAccountNameW
AllocateAndInitializeSid
RegFlushKey
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegEnumValueA
RegSetValueExW
RegNotifyChangeKeyValue
RegQueryValueExW
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegCloseKey
RegQueryInfoKeyA
CreateServiceW
RegEnumKeyExA
OpenServiceW
ControlService
DeleteService
CloseServiceHandle
QueryServiceStatus
StartServiceW
EnumDependentServicesW
CryptReleaseContext
CryptDestroyKey
CryptGenKey
CryptAcquireContextW
QueryServiceConfigW
RegOpenKeyExA
RegQueryValueExA
ChangeServiceConfig2W

netapi32

NetGetJoinInformation
DsGetDcNameW
NetApiBufferFree

kernel32

FormatMessageW
CreateMutexA
GetWindowsDirectoryW
GetProcessHeap
CloseHandle
FindAtomA
WriteFile
SetFilePointer
GetTempFileNameA
InterlockedIncrement
CreateFileW
GetModuleFileNameA
GetLocalTime
GetSystemWindowsDirectoryW
TlsGetValue
OpenSemaphoreW
TlsSetValue
LoadLibraryW
LoadLibraryA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetSystemDefaultLangID
GetCurrentThreadId
HeapFree
FindNextFileA
InterlockedCompareExchange
AreFileApisANSI
QueryPerformanceCounter
GlobalAlloc
GetSystemDefaultLCID
InterlockedDecrement
OpenSemaphoreA
SetLastError
CreateThread
OpenEventW
LCMapStringW
GetVersionExA
SetCurrentDirectoryA
AddAtomA
GetTickCount
GetSystemDefaultUILanguage
HeapAlloc
WaitForSingleObjectEx
GetExitCodeThread
InitializeCriticalSection
GetCommandLineW
GetConsoleOutputCP
DeleteCriticalSection
GetCommandLineA
TlsAlloc
DeleteFileA
LeaveCriticalSection
EnterCriticalSection
GetThreadLocale
GetLastError
HeapDestroy
GetPrivateProfileStringW
GetModuleHandleA
FindResourceExA
GetProcAddress
CreateFileA
FreeLibrary
MultiByteToWideChar
IsDebuggerPresent
lstrlenW
Sleep
SetEvent
CompareStringW
GetSystemDirectoryW
GetComputerNameExW
GetComputerNameW
WideCharToMultiByte
RemoveDirectoryW
CreateSemaphoreW
WaitForSingleObject
ResetEvent
CreateEventW
ReadFile
TlsFree
WritePrivateProfileStringW
InterlockedExchange
FindResourceExW
VirtualAlloc
SetCurrentDirectoryW
GetConsoleCP
lstrlenA
LocalAlloc
FindClose
FindNextFileW
DeleteFileW
SetFileAttributesW
OpenMutexW
GetACP
FindFirstFileW
FindResourceA
CreateDirectoryW
PulseEvent
GetVersionExW
GetExitCodeProcess
CreateMutexW
CreateProcessW
LocalFree
GetAtomNameA
GetUserDefaultUILanguage
TerminateThread

ole32

OleRun
CoCreateInstance
CoUninitialize
CoInitialize
CoInitializeEx

wsock32

MigrateWinsockConfiguration

msvcrt

strchr
fwscanf
strlen
_wfopen
wcschr
_except_handler3
iswspace
_wcsdup
_wtoi
wcsncat
_itow
wcsstr
_vsnwprintf
malloc
fclose
wcsncmp
_initterm
_adjust_fdiv
??1type_info@@UAE@XZ
__dllonexit
memcpy
_onexit
?terminate@@YAXXZ
wcslen
__CxxFrameHandler
??1exception@@UAE@XZ
_purecall
?what@exception@@UBEPBDXZ
wcsrchr
wcscpy
wcscmp
_CxxThrowException
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
swprintf
_snwprintf
memmove
free
wcscat
_wcsicmp

msvcp60

??1bad_alloc@std@@UAE@XZ
??0bad_alloc@std@@QAE@PBD@Z
??0bad_alloc@std@@QAE@ABV01@@Z

Sections

.text
Size: 111KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 215KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 749B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

555c3d0176c4b8b8b757294d6c07008c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shell32

setupapi

comctl32

rpcrt4

user32

gdi32

advapi32

netapi32

kernel32

ole32

wsock32

msvcrt

msvcp60

Sections

.text Size: 111KB - Virtual size: 108KB

.data Size: 215KB - Virtual size: 222KB

.bss Size: - Virtual size: 64KB

.tls Size: 1024B - Virtual size: 749B

.rsrc Size: 30KB - Virtual size: 30KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 111KB - Virtual size: 108KB

.data
Size: 215KB - Virtual size: 222KB

.bss
Size: - Virtual size: 64KB

.tls
Size: 1024B - Virtual size: 749B

.rsrc
Size: 30KB - Virtual size: 30KB

.reloc
Size: 5KB - Virtual size: 5KB