af4507413d6107e5826d84c26ebcee7c_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

af4507413d6107e5826d84c26ebcee7c_JaffaCakes118
Size

1.4MB
MD5

af4507413d6107e5826d84c26ebcee7c
SHA1

7da6c12bf66d948f74508eb4f7b63aeb74b4beee
SHA256

e57a4745fafe3a6190afe6b327b53e2fa5c356b87d7f77794b9b53f54ebe1ffb
SHA512

60bdf413d88b4cf48e97c6c5a767570e794c3f5ddd3c0ea3faaa8223a6fe758a54dada418f97f5db1510dd02062e6b122964e1f9ebdc1c91961aadb477628de2
SSDEEP

24576:aCiSH1aEy6dvMeO66umzRIhpRy+6DmjltQ8GuUdqyPCKwiLzuN:a5SVXdvHO66um9ITRFwmjltCuUdqyPbE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af4507413d6107e5826d84c26ebcee7c_JaffaCakes118

Files

af4507413d6107e5826d84c26ebcee7c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

629eec3b04e79aeca1ee81cc6215f243

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17
ImageList_Create
ImageList_Add

setupapi

SetupOpenInfFileA
SetupInstallFromInfSectionA
SetupCloseInfFile
SetupDiOpenClassRegKey

kernel32

VirtualUnlock
DefineDosDeviceA
GetCurrentProcessId
FormatMessageW
VirtualQuery
ReleaseMutex
OpenMutexA
GetVolumeInformationW
QueryPerformanceCounter
QueryPerformanceFrequency
FlushFileBuffers
GetFileSize
GetCurrentProcess
GetModuleHandleA
GetVersionExA
GetCurrentDirectoryA
LockResource
SizeofResource
LoadResource
FindResourceA
GetFileAttributesA
SetFilePointer
GetModuleFileNameW
SetCurrentDirectoryA
UnhandledExceptionFilter
GetSystemInfo
GetFileInformationByHandle
WaitForSingleObject
GetCurrentThread
SetUnhandledExceptionFilter
GetDriveTypeA
GetDiskFreeSpaceA
InterlockedExchangeAdd
InterlockedExchange
SetEvent
ResetEvent
CreateEventA
FindNextFileW
CreateFileW
FindFirstFileW
_lwrite
_lread
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetStartupInfoA
GetProcessWorkingSetSize
GetProcessTimes
GetThreadTimes
GlobalMemoryStatus
GetProcessHeap
InitializeCriticalSection
LocalFree
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetLocaleInfoW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
PeekNamedPipe
GetFullPathNameA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetHandleCount
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InitializeCriticalSectionAndSpinCount
HeapSize
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStdHandle
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateThread
ResumeThread
ExitThread
GetFileType
SetStdHandle
GetSystemTimeAsFileTime
GetFileAttributesW
GetConsoleMode
GetConsoleCP
IsDebuggerPresent
TerminateProcess
HeapAlloc
ExitProcess
GetModuleHandleW
RtlUnwind
RaiseException
HeapFree
FindFirstVolumeW
QueryDosDeviceW
FindNextVolumeW
GetVolumePathNameA
GetVolumeInformationA
GetShortPathNameA
GetTempPathA
CopyFileA
VirtualLock
FindFirstFileA
LoadLibraryA
GetProcAddress
FreeLibrary
FindNextFileA
FindClose
InterlockedCompareExchange
SetFilePointerEx
CreateFileA
GetFileSizeEx
GetFileTime
ReadFile
WriteFile
SetFileTime
SetLastError
FindFirstVolumeA
QueryDosDeviceA
FindNextVolumeA
FindVolumeClose
GetLogicalDrives
GetCommandLineA
GetCommandLineW
GetTickCount
CreateMutexA
Sleep
GetSystemDirectoryA
CreateDirectoryA
DeleteFileA
DeviceIoControl
GetModuleFileNameA
CreateProcessA
CloseHandle
SetProcessShutdownParameters
GetCurrentThreadId
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
InterlockedIncrement
GetLastError
InterlockedDecrement
SetEndOfFile
GetTimeZoneInformation
CompareStringA
CompareStringW
SetEnvironmentVariableA
IsValidLocale

user32

GetKeyState
EnumChildWindows
GetDlgCtrlID
GetClassNameA
LoadCursorA
SetCursor
DefDlgProcA
UnregisterClassA
LoadIconA
RegisterClassA
GetUpdateRect
BeginPaint
DestroyWindow
EndPaint
GetClipboardViewer
GetWindowTextW
GetClientRect
GetSystemMetrics
GetWindowInfo
MoveWindow
SetWindowPos
GetDC
ReleaseDC
MessageBoxA
GetActiveWindow
PeekMessageA
GetMessagePos
SetLayeredWindowAttributes
CreateWindowExA
RegisterClassExA
TrackMouseEvent
GetSystemMenu
SystemParametersInfoW
SendMessageTimeoutA
wsprintfA
DrawTextA
GetClassInfoA
UnhookWindowsHookEx
CallNextHookEx
GetCaretPos
GetQueueStatus
GetOpenClipboardWindow
GetProcessWindowStation
GetMessageTime
GetInputState
GetFocus
GetDialogBaseUnits
DefWindowProcA
GetDesktopWindow
wsprintfW
UnregisterHotKey
GetClipboardOwner
GetCapture
SetWindowsHookExA
CallWindowProcA
EnumWindows
GetWindowLongA
RegisterWindowMessageA
IsWindowEnabled
SystemParametersInfoA
DrawMenuBar
PostMessageA
GetCursorPos
MessageBeep
SetWindowLongA
SetMenuItemInfoW
IsDlgButtonChecked
CheckDlgButton
LoadBitmapA
GetDlgItemInt
CreatePopupMenu
GetWindowRect
TrackPopupMenu
DestroyMenu
SetDlgItemInt
GetMenu
EnableMenuItem
SetForegroundWindow
LoadImageA
DestroyIcon
GetDlgItemTextA
SetDlgItemTextA
SendDlgItemMessageA
SetFocus
SendDlgItemMessageW
GetKeyboardLayout
LoadKeyboardLayoutA
MessageBoxW
DialogBoxParamW
InvalidateRect
ShowWindow
GetWindowTextA
AppendMenuW
AppendMenuA
SetWindowTextA
GetWindowTextLengthA
GetMessageA
TranslateMessage
DispatchMessageA
PostThreadMessageA
GetParent
EnableWindow
SetTimer
SetWindowTextW
GetWindowTextLengthW
KillTimer
EndDialog
GetAsyncKeyState
GetDlgItem
SendMessageA
SendMessageW
RegisterHotKey

gdi32

MoveToEx
LineTo
GetCurrentObject
GetObjectA
CreateCompatibleBitmap
SetStretchBltMode
CreatePen
DeleteDC
BitBlt
CreateCompatibleDC
SetMapMode
GetDeviceCaps
SelectObject
GetTextExtentPoint32W
GetTextMetricsA
GetStockObject
CreateFontIndirectW
StretchBlt
DeleteObject

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

ReportEventA
RegDeleteValueA
RegCreateKeyExA
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetTokenInformation
IsWellKnownSid
QueryServiceStatus
ControlService
StartServiceA
RegOpenKeyExA
OpenProcessToken
RegQueryValueExA
RegSetValueExA
ChangeServiceConfigA
OpenSCManagerA
CreateServiceA
ChangeServiceConfig2A
OpenServiceA
DeleteService
RegCloseKey
CloseServiceHandle
StartServiceCtrlDispatcherA
SetServiceStatus
DeregisterEventSource
RegisterEventSourceA
RegisterServiceCtrlHandlerA

shell32

ord680
SHGetFileInfoA
ShellExecuteA
SHGetMalloc
SHBrowseForFolderW
SHGetPathFromIDListA
CommandLineToArgvW
SHChangeNotify
SHGetFolderPathA
DragAcceptFiles
DragQueryFileA
DragFinish
Shell_NotifyIconA
Shell_NotifyIconW
ShellExecuteW

ole32

CoCreateInstance
StringFromGUID2
CoInitialize
CoUninitialize
CoRegisterClassObject
CoRevokeClassObject
CoGetObject

oleaut32

SysStringByteLen
SysAllocStringLen
SysFreeString
SysAllocStringByteLen

Sections

.text
Size: 520KB - Virtual size: 520KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 19KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 703KB - Virtual size: 702KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.trdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

629eec3b04e79aeca1ee81cc6215f243

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

setupapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 520KB - Virtual size: 520KB

.rdata Size: 131KB - Virtual size: 131KB

.data Size: 19KB - Virtual size: 213KB

.rsrc Size: 703KB - Virtual size: 702KB

.trdata Size: 76KB - Virtual size: 76KB

.text
Size: 520KB - Virtual size: 520KB

.rdata
Size: 131KB - Virtual size: 131KB

.data
Size: 19KB - Virtual size: 213KB

.rsrc
Size: 703KB - Virtual size: 702KB

.trdata
Size: 76KB - Virtual size: 76KB