ab919b5ea79dd909c21c1218ebf05ef1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ab919b5ea79dd909c21c1218ebf05ef1_JaffaCakes118
Size

138KB
MD5

ab919b5ea79dd909c21c1218ebf05ef1
SHA1

d731637347a156bfcf88b0daee717fa1bbda9802
SHA256

f079d22929cedd963c129393f134ef99b2369a207ff3c767b55537c21b888944
SHA512

15193f3c6207c71fca5b179f50306546e6255ee47c9a5b28221c90950755ff6627701793a723b362d48c6046787b908d38a62b2317dd89410c037f8d2b57dc87
SSDEEP

3072:zo76hxRTWZCohlpOUBegNPPNieGW/qgOLFptU40kZkxd8xO71TQrG:zVh2BpOUIgNPPNieGBRUISdLlQ6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab919b5ea79dd909c21c1218ebf05ef1_JaffaCakes118

Files

ab919b5ea79dd909c21c1218ebf05ef1_JaffaCakes118
.exe windows:5 windows x86 arch:x86

bc8d0c967c504c09954935bacd0f1170

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Thread32First
WideCharToMultiByte
ReadProcessMemory
HeapDestroy
HeapCreate
Thread32Next
ReadFile
GetTimeZoneInformation
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
SetLastError
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
FindClose
LoadLibraryA
RemoveDirectoryW
FindNextFileW
VirtualProtect
WriteProcessMemory
GetFileTime
OpenProcess
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
SetFileAttributesW
CreateThread
GetNativeSystemInfo
WTSGetActiveConsoleSessionId
CreateRemoteThread
Process32FirstW
Process32NextW
GetThreadContext
SetThreadContext
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetProcessId
ResetEvent
GetLocalTime
TlsGetValue
TlsSetValue
TerminateProcess
GlobalLock
GlobalUnlock
LocalFree
GetCurrentProcessId
WriteFile
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetProcessHeap
CreateDirectoryW
HeapFree
SetFilePointerEx
SystemTimeToFileTime
DuplicateHandle
OpenEventW
HeapAlloc
CreateProcessW
SetEndOfFile
FindFirstFileW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
ExpandEnvironmentStringsW
GetPrivateProfileIntW
LoadLibraryW
GetPrivateProfileStringW
FreeLibrary
lstrcmpiA
FileTimeToLocalFileTime
ReleaseMutex
GetFileAttributesExW
WaitForMultipleObjects
GetProcAddress
GetVersionExW
VirtualFreeEx
VirtualFree
GetModuleHandleW
GetComputerNameW
SetErrorMode
GetCommandLineW
ExitProcess
GetSystemTime
GetUserDefaultUILanguage
lstrcmpiW
GetModuleFileNameW
GetFileAttributesW
Sleep
GetTickCount
MoveFileExW
TlsFree
CloseHandle
TlsAlloc
GetCurrentThreadId
CreateEventW
CreateFileMappingW
SetThreadPriority
GetCurrentThread
SetEvent
WaitForSingleObject
UnmapViewOfFile
MapViewOfFile
CreateToolhelp32Snapshot
CreateMutexW

user32

GetWindowLongW
CharLowerA
PeekMessageW
CharUpperW
SetWindowLongW
SendMessageTimeoutW
GetWindow
DispatchMessageW
CharLowerBuffA
GetSystemMetrics
ExitWindowsEx
CharLowerW
CreateDesktopW
SetProcessWindowStation
CloseWindowStation
CreateWindowStationW
TranslateMessage
CloseDesktop
SetThreadDesktop
OpenWindowStationW
RegisterClassExA
RegisterWindowMessageW
GetThreadDesktop
GetMenuItemID
SetCursorPos
GetSubMenu
DefDlgProcW
DefFrameProcA
OpenInputDesktop
OpenDesktopW
GetKeyboardState
ToUnicode
GetCapture
FillRect
DrawEdge
IntersectRect
EqualRect
PrintWindow
EndPaint
GetUpdateRgn
GetWindowDC
BeginPaint
GetUpdateRect
GetClipboardData
GetDCEx
DrawIcon
GetIconInfo
GetMessageA
GetWindowRect
GetMessageW
SetCapture
GetParent
GetWindowInfo
GetAncestor
PeekMessageA
WindowFromPoint
SetWindowPos
GetClassLongW
GetProcessWindowStation
GetCursorPos
CharToOemW
ReleaseCapture
MapWindowPoints
GetShellWindow
RegisterClassA
GetMessagePos
IsRectEmpty
MapVirtualKeyW
PostMessageW
MenuItemFromPoint
GetDC
GetMenu
RegisterClassExW
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
ReleaseDC
GetMenuState
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
GetMenuItemCount
DefDlgProcA
PostThreadMessageW
DefMDIChildProcA
HiliteMenuItem
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
SetKeyboardState
GetWindowThreadProcessId
DefFrameProcW
DefWindowProcW
CallWindowProcW
EndMenu
CallWindowProcA
SendMessageW
GetUserObjectInformationW
RegisterClassW
IsWindow

advapi32

IsWellKnownSid
GetLengthSid
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegSetValueExW
CryptHashData
ConvertSidToStringSidW
EqualSid
InitiateSystemShutdownExW

shlwapi

StrStrIA
PathRenameExtensionW
PathQuoteSpacesW
PathIsURLW
StrCmpNIW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
StrStrIW
PathRemoveBackslashW
PathRemoveFileSpecW

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

RestoreDC
SaveDC
CreateDIBSection
GdiFlush
SetViewportOrgEx
GetDIBits
DeleteDC
GetDeviceCaps
DeleteObject
SelectObject
SetRectRgn
CreateCompatibleBitmap
CreateCompatibleDC

ws2_32

closesocket
WSASetLastError
freeaddrinfo
socket
bind
recv
setsockopt
shutdown
recvfrom
sendto
WSAEventSelect
getpeername
WSASend
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
send
listen
accept
WSAGetLastError
getsockname

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData

wininet

HttpAddRequestHeadersA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetQueryOptionA
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
HttpQueryInfoA
InternetCloseHandle

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bc8d0c967c504c09954935bacd0f1170

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 129KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 129KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB