aa9ed9aab3529cffe3573a371d6d85ae_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

aa9ed9aab3529cffe3573a371d6d85ae_JaffaCakes118
Size

348KB
MD5

aa9ed9aab3529cffe3573a371d6d85ae
SHA1

7089c6910aceed9805dc7a2584ed1d09f65aed9b
SHA256

1581b46aff7e2fb3f1ab6d469837b277ca9ffcbc0456da0b3d59efceed45a2c1
SHA512

85ffa699216541264c12b974e28d4fbfaefe3a40d87968ecd293bc70fb8a45c7c3d21f0b6120ef4ca19191f8a519fd5b92bc4ec32fef4cd191d8ea826291ecfd
SSDEEP

6144:bE13KYjJgfwWhEZ8UgTUUaSPBi19jCW6xk50BecdC9rc/RRr76s4HdLUp:bO3CwWe8UgY1SAAW6xaUjCMRr76s49

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa9ed9aab3529cffe3573a371d6d85ae_JaffaCakes118

Files

aa9ed9aab3529cffe3573a371d6d85ae_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6bfa99aa25fd270d33430f5fb2474531

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MsgWaitForMultipleObjects
GetWindowThreadProcessId
GetKeyboardType
GetActiveWindow
ExitWindowsEx
CharLowerA
DispatchMessageW
CharUpperW
CharUpperA
CharNextW
PeekMessageW
TranslateMessage
SendMessageW
PostMessageW

shlwapi

PathStripToRootW
PathIsRelativeW
PathIsRootW
PathIsUNCW
PathRemoveBackslashW
StrChrW
StrCmpIW
StrCmpW
StrRChrW
StrStrIW
StrToIntExW
UrlGetPartW
UrlCombineW
StrToIntW
PathFindExtensionW

oleaut32

SysFreeString
VariantInit
VariantClear
VarR8FromI1
SysStringLen
SysAllocString

ole32

CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoUninitialize
HMETAFILE_UserFree

advapi32

RegSetValueExW
RegQueryValueExW
RegOpenKeyW
RegOpenKeyExW
RegEnumKeyW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
OpenProcessToken
LsaQueryInformationPolicy
LsaOpenPolicy
LsaNtStatusToWinError
LsaFreeMemory
LsaClose
LookupPrivilegeValueW
IsValidSid
GetTokenInformation
GetSecurityDescriptorOwner
GetSecurityDescriptorDacl
GetLengthSid
FreeSid
EqualSid
CopySid
ConvertStringSecurityDescriptorToSecurityDescriptorW
AllocateAndInitializeSid
AdjustTokenPrivileges
SetNamedSecurityInfoW

kernel32

InterlockedDecrement
InterlockedCompareExchange
InitializeCriticalSection
InterlockedExchange
LoadLibraryExW
HeapAlloc
GlobalFree
InterlockedIncrement
HeapReAlloc
LeaveCriticalSection
lstrlenW
LocalFree
MapViewOfFile
MoveFileW
MultiByteToWideChar
QueryPerformanceCounter
ReadFile
ReleaseMutex
RemoveDirectoryW
ResetEvent
SetEndOfFile
SetEvent
SetFileAttributesW
SetFilePointer
SetFileTime
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
UnhandledExceptionFilter
UnmapViewOfFile
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcmpW
lstrcmpiW
lstrcpynW
HeapFree
GetExitCodeThread
CloseHandle
CompareFileTime
CompareStringA
CompareStringW
CreateDirectoryW
CreateEventW
CreateFileW
CreateMutexW
CreateProcessW
CreateThread
DeleteCriticalSection
DeleteFileW
DisableThreadLibraryCalls
EnterCriticalSection
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileW
FindNextFileW
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDriveTypeW
GetExitCodeProcess
GlobalAlloc
GetFileSize
GetFileTime
GetFileType
GetLocalTime
GetLocaleInfoW
GetPrivateProfileStringW
GetProcAddress
GetProcessHeap
GetSystemDefaultLangID
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetUserDefaultLangID
GetVersionExW
GetVolumeInformationW
lstrlenA

wininet

InternetQueryOptionA
InternetCrackUrlW
InternetGetConnectedState
InternetCanonicalizeUrlW

crypt32

CertGetCertificateContextProperty
CryptHashPublicKeyInfo

setupapi

CM_Get_DevNode_Registry_PropertyW
CM_Get_DevNode_Status
CM_Locate_DevNodeW
SetupCloseFileQueue
SetupCloseInfFile
SetupDiBuildDriverInfoList
SetupDiCreateDeviceInfoList
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiEnumDriverInfoW
SetupDiGetClassDevsW
SetupDiGetDeviceInstallParamsW
SetupDiGetDeviceInstanceIdW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDriverInstallParamsW
SetupDiInstallDriverFiles
SetupDiOpenDevRegKey
SetupDiOpenDeviceInfoW
SetupDiSetDeviceInstallParamsW
SetupDiSetSelectedDriverW
SetupFindFirstLineW
SetupGetStringFieldW
SetupOpenFileQueue
SetupOpenInfFileW
SetupScanFileQueueW

shell32

SHGetFolderPathW
SHGetMalloc
SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW

Sections

.text
Size: 260KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6bfa99aa25fd270d33430f5fb2474531

Headers

File Characteristics

Imports

user32

shlwapi

oleaut32

ole32

advapi32

kernel32

wininet

crypt32

setupapi

shell32

Sections

.text Size: 260KB - Virtual size: 260KB

.rdata Size: 52KB - Virtual size: 52KB

.data Size: 16KB - Virtual size: 140KB

.idata Size: 8KB - Virtual size: 8KB

.rsrc Size: 8KB - Virtual size: 8KB

.text
Size: 260KB - Virtual size: 260KB

.rdata
Size: 52KB - Virtual size: 52KB

.data
Size: 16KB - Virtual size: 140KB

.idata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 8KB - Virtual size: 8KB