b0c995f459b5cad381914339ec3e6c95_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b0c995f459b5cad381914339ec3e6c95_JaffaCakes118
Size

90KB
MD5

b0c995f459b5cad381914339ec3e6c95
SHA1

7d8046d88f6fcdadfe001181e834899ae0216e7e
SHA256

72367ebc09e920ce7aeacce95e921c161dc27dc9bd8e805bc4a467e87130ece4
SHA512

1d8d9528b21bc86b2942144a4d67e65b9b42b69a646fb3bbb848293e416b3bbf94a22a28142d40606c406cda532958ef022d9639f163f373ebc4cf8b039fa8f4
SSDEEP

1536:rmB2tBBbsvk3ijApM1Vh5X78VINjgEzgaHXFFncvVAukHmGi3gU++:rmB2tBB4vgijigVzIVINU2nTcvFkHYgo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b0c995f459b5cad381914339ec3e6c95_JaffaCakes118

Files

b0c995f459b5cad381914339ec3e6c95_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8f99771d34b4e35b82d28ba0a1ec84eb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegDeleteKeyW
RegOpenKeyExA
RegCloseKey
InitializeSecurityDescriptor
FreeSid
RegQueryValueExW
RegCreateKeyExA
GetLengthSid
RegQueryValueExA
GetUserNameW
RegDeleteValueW
RegOpenKeyExW
CreateProcessAsUserW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegSetValueExA
SetSecurityDescriptorDacl
OpenThreadToken
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
AddAccessAllowedAce
AllocateAndInitializeSid
InitializeAcl

shell32

SHFileOperationW

kernel32

GetModuleHandleA
GetCurrentProcessId
CreateMutexW
LoadLibraryExW
lstrcpyW
GetTempFileNameW
CompareFileTime
IsBadReadPtr
lstrlenW
GetDateFormatW
FindClose
DeleteCriticalSection
HeapDestroy
GetProcAddress
SetFileTime
CreateProcessA
HeapCreate
LCMapStringA
TlsFree
VirtualFree
lstrcpynW
FlushFileBuffers
SearchPathW
CreateEventW
DeleteFileW
FindNextFileW
lstrcmpiW
GetPrivateProfileStringW
HeapFree
GetLastError
GlobalSize
GetPrivateProfileIntW
GetCurrentThread
lstrlenA
SetStdHandle
GetEnvironmentStringsW
OpenEventW
GetStringTypeW
TlsAlloc
GetStringTypeExW
SetEvent
InterlockedIncrement
GetStdHandle
CreateProcessW
GetFileType
GetStringTypeA
EnterCriticalSection
SystemTimeToFileTime
SetUnhandledExceptionFilter
GetCurrentThreadId
GetSystemTime
DisableThreadLibraryCalls
GetVolumeInformationA
GetTickCount
Sleep
GetVersionExW
GetCurrentProcess
HeapAlloc
GetFileTime
GetProcessHeap
TlsSetValue
SetCurrentDirectoryW
WideCharToMultiByte
CreateFileW
LoadLibraryExA
FreeLibrary
GetCPInfo
WritePrivateProfileStringA
CreateThread
lstrcatW
WriteFile
FreeEnvironmentStringsA
GetSystemInfo
CreateDirectoryW
GetOEMCP
WaitForSingleObject
QueryPerformanceCounter
GetLocaleInfoA
OpenProcess
VirtualQuery
GlobalReAlloc
VirtualAlloc
lstrcpyA
GlobalHandle
LeaveCriticalSection
GetStartupInfoA
TerminateProcess
ExitProcess
CloseHandle
FindResourceExW
FormatMessageW
GetWindowsDirectoryA
FreeEnvironmentStringsW
GetSystemDirectoryW
lstrcpynA
GetCurrentDirectoryW
MultiByteToWideChar
LoadLibraryW
GlobalLock
SetFileAttributesW
LoadLibraryA
GetModuleFileNameW
MapViewOfFile
GetCommandLineA
GlobalAlloc
ReleaseMutex
TlsGetValue
HeapReAlloc
MulDiv
OutputDebugStringW
OpenFileMappingW
InterlockedExchange
LCMapStringW
GlobalUnlock
GetPrivateProfileStringA
UnhandledExceptionFilter
GetFileAttributesW
GetSystemTimeAsFileTime
GlobalFree
VirtualProtect
lstrcmpA
LocalFree
LocalAlloc
SetHandleCount
lstrcmpW
GetACP
GetTimeFormatW
FindFirstFileW
GetModuleFileNameA
ExpandEnvironmentStringsW
lstrcatA
UnmapViewOfFile
WritePrivateProfileStringW
GetTempPathW
InterlockedDecrement
SetLastError
CreateFileMappingW
GetVersionExA
CopyFileW
GetPrivateProfileSectionW
InitializeCriticalSection
GetFileAttributesA
GetModuleHandleW
SetFilePointer
CompareStringW
Beep
DuplicateHandle
GetEnvironmentStrings

gdi32

GetStockObject
GetDIBits
DeleteDC
GetDeviceCaps
CreatePalette
SetStretchBltMode
CreateDIBitmap
UnrealizeObject
GetObjectA
RealizePalette
CreateCompatibleDC
StretchBlt
SelectPalette
SelectObject
DeleteObject

ole32

CoUninitialize
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoInitialize

cmutil

CmStrCatAllocW
CmWinHelp
CmMalloc
CmStrCpyAllocW
IsLogonAsSystem
CmStrStrA
CmParsePathW
GetOSBuildNumber
CmLoadIconW
SzToWzWithAlloc
CmStrCpyAllocA
CmStrStrW
CmIsSpaceW
GetOSVersion
CmLoadSmallIconW
CmStripFileNameW
CmIsDigitW
CmLoadStringW
CmStrtokW
CmStrTrimW
GetOSMajorVersion
CmFmtMsgW
CmStrrchrW
CmStrCatAllocA
CmStrchrW
CmAtolW
WzToSzWithAlloc
WzToSz
CmStripPathAndExtW
CmFree
CmConvertRelativePathW
CmBuildFullPathFromRelativeW
CmRealloc

ntdll

RtlUnwind

cmpbk32

PhoneBookGetPhoneDescA
PhoneBookCopyFilter
PhoneBookGetCountryNameW
PhoneBookGetPhoneNonCanonicalA
PhoneBookGetPhoneCanonicalA
PhoneBookEnumCountries
PhoneBookGetPhoneDispA
PhoneBookGetPhoneType
PhoneBookEnumNumbersWithRegionsZero
PhoneBookEnumRegions
PhoneBookMatchFilter
PhoneBookParseInfoA
PhoneBookHasPhoneType
PhoneBookFreeFilter
PhoneBookGetPhoneDUNA
PhoneBookGetCountryNameA
PhoneBookGetCountryId
PhoneBookUnload
PhoneBookEnumNumbers
PhoneBookGetRegionNameA
PhoneBookLoad
PhoneBookGetCurrentCountryId

activeds

FreeADsMem

urlmon

CopyBindInfo

user32

InvalidateRect
DispatchMessageW
GetWindowRect
SendMessageA
MoveWindow
PostThreadMessageW
ShowWindow
DeleteMenu
PeekMessageW
FindWindowExW
WinHelpW
SetDlgItemInt
LoadCursorW
IsDlgButtonChecked
SetForegroundWindow
EndPaint
SetFocus
KillTimer
RegisterClassExA
GetFocus
GetClientRect
CharPrevW
IsWindow
PostMessageW
CallWindowProcW
SetCursor
ScreenToClient
GetWindowTextW
GetClassLongW
LoadImageW
UnregisterClassW
SendDlgItemMessageW
GetClassInfoExA
UpdateWindow
ChildWindowFromPointEx
ReleaseDC
MsgWaitForMultipleObjects
SendDlgItemMessageA
EndDialog
GetMessageW
BeginPaint
GetParent
DestroyWindow
ChildWindowFromPoint
CharNextW
EnumWindows
LoadStringA
GetWindowTextLengthW
GetWindowThreadProcessId
MessageBoxExW
ShowWindowAsync
CreateWindowExW
GetWindowLongW
SetWindowTextW
InsertMenuW
RegisterWindowMessageW
TranslateMessage
GetDlgItemInt
SetDlgItemTextA
IsWindowEnabled
wvsprintfW
CheckDlgButton
CreateDialogParamW
ShowCursor
wsprintfA
DefWindowProcW
GetThreadDesktop
SetDlgItemTextW
SetActiveWindow
GetDlgCtrlID
EnableMenuItem
GetDlgItemTextW
SetWindowPos
EnableWindow
GetCursor
SetWindowLongW
SystemParametersInfoA
IsWindowVisible
IsDialogMessageW
SetTimer
MapWindowPoints
LoadIconW
RegisterClassExW
wsprintfW
GetSystemMenu
DialogBoxParamW
ExitWindowsEx
PostQuitMessage
GetDC
LoadStringW
LoadMenuW
MessageBoxW
CharLowerW
GetUserObjectInformationW
GetDlgItem
CharUpperW
SendMessageW
GetWindowTextA

Sections

.textbss
Size: - Virtual size: 448KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 512B - Virtual size: 428B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8f99771d34b4e35b82d28ba0a1ec84eb

Headers

File Characteristics

Imports

advapi32

shell32

kernel32

gdi32

ole32

cmutil

ntdll

cmpbk32

activeds

urlmon

user32

Sections

.textbss Size: - Virtual size: 448KB

.idata Size: 9KB - Virtual size: 9KB

.text Size: 512B - Virtual size: 428B

.reloc Size: 53KB - Virtual size: 52KB

.rsrc Size: 26KB - Virtual size: 26KB

.textbss
Size: - Virtual size: 448KB

.idata
Size: 9KB - Virtual size: 9KB

.text
Size: 512B - Virtual size: 428B

.reloc
Size: 53KB - Virtual size: 52KB

.rsrc
Size: 26KB - Virtual size: 26KB