a9987c70d18ed5288c39bf92b4661db4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a9987c70d18ed5288c39bf92b4661db4_JaffaCakes118
Size

212KB
MD5

a9987c70d18ed5288c39bf92b4661db4
SHA1

ada139f41b8af40d4f4614cfead768b01a11923d
SHA256

dcbde8c3e9d007c4d93e36a1e2b6fd0b606bbde5d33634f5b320f39e222e7163
SHA512

6592b419553c8d172b32686b335673937b47b6c21d96256fede6f21f4fce544c0f2c0e59fb415cf90ad9110bbbf9a68dc0124d3bb6d85ed50eb145410820d1da
SSDEEP

6144:XeRqqDLd0j+DkYYrlian9saNdPnoR8rJB+i7cOLvzpa:Xesqnd0jnVrMa7XoR8XSOLrpa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a9987c70d18ed5288c39bf92b4661db4_JaffaCakes118

Files

a9987c70d18ed5288c39bf92b4661db4_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a4279c21be6479a4fd442cea08a57aa2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAllocEx
FindClose
Process32FirstW
RemoveDirectoryW
QueryDosDeviceW
WaitForMultipleObjects
Process32NextW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
LocalFree
WriteProcessMemory
SetFileAttributesW
ExpandEnvironmentStringsW
MoveFileExW
GetModuleFileNameW
GetUserDefaultUILanguage
ExitThread
CreateEventW
GetCurrentThreadId
GetNativeSystemInfo
GetVersionExW
ExitProcess
SetEvent
lstrcmpiA
WTSGetActiveConsoleSessionId
TlsGetValue
VirtualProtectEx
TerminateProcess
SetThreadPriority
ResetEvent
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
OpenEventW
GetModuleHandleA
GetThreadContext
SetThreadContext
GetProcessId
GetCommandLineW
SetErrorMode
GetComputerNameW
DuplicateHandle
GetCurrentProcessId
CreateRemoteThread
SetHandleInformation
CreatePipe
GlobalLock
GlobalUnlock
ReadProcessMemory
Sleep
LoadLibraryW
VirtualFreeEx
WideCharToMultiByte
Thread32First
OpenProcess
VirtualQueryEx
SetFileTime
IsBadReadPtr
VirtualAlloc
SetLastError
OpenMutexW
GetFileSizeEx
GetTempPathW
lstrlenW
MultiByteToWideChar
GetTimeZoneInformation
ReadFile
Thread32Next
lstrcpynW
HeapCreate
TlsSetValue
HeapDestroy
GetProcessHeap
VirtualFree
GetCurrentThread
GetTickCount
CreateDirectoryW
HeapFree
GetLogicalDriveStringsW
SetFilePointerEx
GetCurrentProcess
SystemTimeToFileTime
HeapAlloc
CreateProcessW
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
WaitForSingleObject
GetPrivateProfileIntW
FlushFileBuffers
CreateFileW
GetFileAttributesW
WriteFile
GetPrivateProfileStringW
GetModuleHandleW
lstrcmpiW
LoadLibraryA
GetProcAddress
FreeLibrary
CreateThread
GetSystemTime
CloseHandle
GetLocalTime
EnterCriticalSection
GetLastError
LeaveCriticalSection
InitializeCriticalSection
GetFileAttributesExW

user32

GetWindowDC
DefDlgProcW
DefFrameProcA
OpenInputDesktop
BeginPaint
GetUpdateRect
RegisterClassExW
GetClipboardData
GetDCEx
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
DefDlgProcA
DefMDIChildProcA
RegisterClassW
CallWindowProcA
RegisterClassExA
DefFrameProcW
RegisterClassA
GetMessageA
GetWindowRect
GetMessageW
SetCapture
PostMessageW
GetParent
GetWindowInfo
HiliteMenuItem
GetCapture
SetCursorPos
GetAncestor
PeekMessageA
SetWindowPos
IsWindow
GetUpdateRgn
EndPaint
PrintWindow
GetKeyboardState
ToUnicode
MapVirtualKeyW
GetKeyboardLayoutList
GetSystemMetrics
ExitWindowsEx
MessageBoxA
CreateDesktopW
SetProcessWindowStation
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
CloseDesktop
SetThreadDesktop
OpenWindowStationW
RegisterWindowMessageW
GetThreadDesktop
GetMenuItemID
SetKeyboardState
GetSubMenu
OpenDesktopW
MenuItemFromPoint
GetMenu
GetMenuItemRect
SystemParametersInfoW
TrackPopupMenuEx
GetClassNameW
GetMenuState
CallWindowProcW
GetMenuItemCount
ReleaseCapture
SendMessageW
MapWindowPoints
GetUserObjectInformationW
EndMenu
GetShellWindow
FillRect
DrawEdge
IntersectRect
GetMessagePos
GetWindowThreadProcessId
IsRectEmpty
CharLowerBuffA
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharLowerW
CharToOemW
TranslateMessage
GetWindowLongW
CharLowerA
PeekMessageW
ReleaseDC
CharUpperW
PostThreadMessageW
GetClassLongW
EqualRect
SetWindowLongW
SendMessageTimeoutW
GetWindow
DispatchMessageW
DrawIcon
GetIconInfo
GetCursorPos
GetDC
DefWindowProcW

advapi32

CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
ConvertSidToStringSidW
CreateProcessAsUserA
EqualSid
SetSecurityInfo
InitiateSystemShutdownExW
IsWellKnownSid
GetLengthSid
RegCreateKeyW
RegEnumKeyW
RegQueryInfoKeyW
RegEnumKeyExW

shlwapi

PathMatchSpecW
StrStrIW
StrStrIA
PathQuoteSpacesW
PathIsURLW
StrCmpNIW
PathRenameExtensionW
wvnsprintfA
StrCmpNIA
UrlUnescapeA
PathRemoveBackslashW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW

shell32

CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

CoSetProxyBlanket
CoUninitialize
CLSIDFromString
StringFromGUID2
CoInitializeSecurity
CoInitialize
CoInitializeEx
CoCreateInstance

gdi32

GetDeviceCaps
CreateCompatibleBitmap
DeleteObject
GetDIBits
CreateDIBSection
RestoreDC
SaveDC
CreateCompatibleDC
SetRectRgn
SelectObject
GdiFlush
DeleteDC
SetViewportOrgEx

ws2_32

send
closesocket
WSASetLastError
freeaddrinfo
socket
bind
recv
sendto
recvfrom
getpeername
inet_addr
WSASend
gethostbyname
WSAEventSelect
WSAIoctl
listen
accept
shutdown
getsockname
WSAGetLastError
select
getaddrinfo
WSAStartup
WSAAddressToStringW
connect
setsockopt

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData
PFXImportCertStore

wininet

HttpOpenRequestA
HttpAddRequestHeadersA
InternetOpenA
InternetCloseHandle
InternetSetOptionA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpEndRequestW
HttpEndRequestA
InternetSetFilePointer
HttpOpenRequestW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetQueryOptionA
HttpSendRequestA
InternetCrackUrlA
InternetReadFile
HttpQueryInfoA
InternetConnectA
InternetSetStatusCallbackA
InternetQueryOptionW

oleaut32

SysFreeString
VariantInit
SysAllocString
VariantClear

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetInfo

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

winmm

PlaySoundW
waveOutSetVolume
waveOutGetVolume
PlaySoundA

Sections

.text
Size: 199KB - Virtual size: 199KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a4279c21be6479a4fd442cea08a57aa2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

version

winmm

Sections

.text Size: 199KB - Virtual size: 199KB

.data Size: 2KB - Virtual size: 10KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 199KB - Virtual size: 199KB

.data
Size: 2KB - Virtual size: 10KB

.reloc
Size: 8KB - Virtual size: 8KB