afbd09d932d01e04c802cf5932a7cce0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

afbd09d932d01e04c802cf5932a7cce0_JaffaCakes118
Size

374KB
MD5

afbd09d932d01e04c802cf5932a7cce0
SHA1

7503a575815d4845c0dfa53ffa2463dee6d3af0d
SHA256

e3b07ee43581a606a0c6e2a683dc0bbc784502d44fad6ddd735e74428c3814e1
SHA512

0bf06348014daf023c89df883737a43079c37cbdc9af40e8d9fa6ce34b17bc3e0faccb60c4a2a8c9207dee5a48a68cabac000549ffb7ebe04cfcc09e6a279009
SSDEEP

6144:F83HiAOshk/XAzkXB+clWOw5dDR13ewh41+FomQ0v8QnlqPWCZ9gatDF1tFyG:oHiAOsyYzkR+cPeR1Oui2owGV9NtRX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
afbd09d932d01e04c802cf5932a7cce0_JaffaCakes118

Files

afbd09d932d01e04c802cf5932a7cce0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

54fb682e12a5c7460163114e90fe0886

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mpr

WNetCancelConnection2W
WNetEnumResourceW
WNetOpenEnumW
WNetGetConnectionW
WNetCloseEnum
WNetAddConnection3W

ole32

CoGetInterfaceAndReleaseStream
CoInitialize
CoCreateFreeThreadedMarshaler
CoInitializeEx
CreateBindCtx
CoUninitialize
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
CoTaskMemFree
ReleaseStgMedium

advapi32

RegCreateKeyExW
OpenServiceW
LookupAccountSidW
IsValidSid
LookupAccountNameW
FreeSid
GetLengthSid
RegQueryValueExA
LsaStorePrivateData
CloseServiceHandle
EqualSid
CreateProcessWithLogonW
RegCloseKey
LsaClose
RegEnumKeyW
CopySid
QueryServiceStatus
RegQueryValueExW
RegSetValueExW
OpenProcessToken
OpenSCManagerW
GetTokenInformation
CheckTokenMembership
OpenThreadToken
LsaOpenPolicy
RegOpenKeyExA
AllocateAndInitializeSid
RegDeleteValueW
RegOpenKeyExW

msvcrt

_except_handler3
wcschr

urlmon

URLDownloadToCacheFileW

netapi32

NetUnjoinDomain
NetRenameMachineInDomain
NetUserAdd
NetUserSetInfo
NetUserGetLocalGroups
NetJoinDomain
NetLocalGroupEnum
NetApiBufferFree
NetLocalGroupDelMembers
DsRoleGetPrimaryDomainInformation
NetUserGetInfo
DsGetDcNameW
NetLocalGroupAddMembers
NetUserDel
NetValidateName
NetLocalGroupGetMembers
DsRoleFreeMemory

shell32

SHBindToParent
SHGetDesktopFolder
SHGetFileInfoW
ShellExecuteExW
SHBrowseForFolderW
SHParseDisplayName
SHCreateShellItem
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHGetSpecialFolderLocation

ntdll

NtAllocateVirtualMemory
RtlLargeIntegerShiftRight
RtlGetNtProductType
RtlRunDecodeUnicodeString

secur32

TranslateNameW

shlwapi

PathFindFileNameW
StrChrW
PathAppendW
AssocQueryStringW
PathFindExtensionW
UrlGetPartW
PathMatchSpecW
StrToIntW
StrToIntExW
PathIsUNCW
StrCatBuffW
StrRetToBufW
PathRenameExtensionW
PathRemoveBackslashW
PathIsUNCServerW
StrCmpNIW
SHRegGetBoolUSValueW
PathCombineW
StrCmpW
SHStrDupW
SHGetValueW
PathGetDriveNumberW
UrlCombineW
wnsprintfW
PathRemoveFileSpecW
PathParseIconLocationW
StrCpyNW
StrDupW
SHSetValueW
StrCmpIW

ntdsapi

DsCrackNamesW
DsFreeNameResultW

gdi32

SetBkColor
SetTextColor
ExtTextOutW
GetObjectW
CreateFontIndirectW
GetDeviceCaps
GetTextMetricsW
DeleteObject
SelectObject

kernel32

GlobalLock
SetEvent
GetVersionExA
DosDateTimeToFileTime
GetCurrentProcess
InterlockedCompareExchange
QueryPerformanceCounter
ExitProcess
ResetEvent
InterlockedDecrement
lstrcpyW
GetCurrentProcessId
GetLocaleInfoW
lstrlenW
GetCurrentThreadId
GetUserGeoID
FormatMessageW
GetSystemDefaultLCID
lstrcpynW
GetModuleFileNameW
TerminateProcess
FreeLibrary
GetWindowsDirectoryW
OpenEventW
SetUnhandledExceptionFilter
GetUserDefaultLCID
MulDiv
LoadLibraryW
DelayLoadFailureHook
GetModuleHandleW
GetGeoInfoW
DnsHostnameToComputerNameW
LocalAlloc
GetDriveTypeW
WaitForSingleObject
LocalFree
GlobalUnlock
GetLastError
SetComputerNameExW
GetComputerNameW
GetProcAddress
ExpandEnvironmentStringsW
UnhandledExceptionFilter
GetCurrentThread
lstrcmpiW
CreateProcessW
GetSystemTimeAsFileTime
InterlockedIncrement
CreateEventW
CreateThread
lstrcmpiA
GetACP
WideCharToMultiByte
GetUserDefaultLangID
MultiByteToWideChar
GetTickCount
LoadLibraryA

user32

SetWindowLongW
ReleaseDC
LoadCursorW
MapWindowPoints
LoadIconW
PostMessageW
IsWindowVisible
GetWindowTextLengthW
MessageBoxW
IsWindow
SystemParametersInfoW
LoadStringW
GetSysColor
DrawFocusRect
CharLowerBuffW
EndDialog
CheckDlgButton
SetWindowTextW
GetParent
DialogBoxParamW
SetForegroundWindow
DestroyIcon
FindWindowW
RegisterClipboardFormatW
EnableWindow
SendMessageW
GetDlgCtrlID
GetDesktopWindow
SetDlgItemTextW
RegisterWindowMessageW
MoveWindow
OffsetRect
ShowWindow
GetWindowRect
GetDC
GetDlgItem
LoadImageW
RedrawWindow
SetCursor
DrawTextExW
CheckRadioButton
GetWindowTextW
SetWindowPos
SetTimer
GetWindowLongW
KillTimer
IsWindowEnabled
GetDlgItemTextW
GetWindowLongA
IsDlgButtonChecked
CharNextW
GetSystemMetrics
GetClientRect
WinHelpW
GetDialogBaseUnits
SetFocus
SendDlgItemMessageW

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 230KB - Virtual size: 620KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

54fb682e12a5c7460163114e90fe0886

Headers

File Characteristics

Imports

mpr

ole32

advapi32

msvcrt

urlmon

netapi32

shell32

ntdll

secur32

shlwapi

ntdsapi

gdi32

kernel32

user32

Sections

.text Size: 11KB - Virtual size: 10KB

.data Size: 230KB - Virtual size: 620KB

.rdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 128KB - Virtual size: 127KB

.text
Size: 11KB - Virtual size: 10KB

.data
Size: 230KB - Virtual size: 620KB

.rdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 128KB - Virtual size: 127KB