b3b1c3bfe05bb496d71232ecb896623d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b3b1c3bfe05bb496d71232ecb896623d_JaffaCakes118
Size

270KB
MD5

b3b1c3bfe05bb496d71232ecb896623d
SHA1

d12369c8d2c3cfa749134af4888ee99760337c36
SHA256

b416b3ac254aefb8639c7d3942c58a65dc061d4e4c1e68e0184c81d506f194e3
SHA512

004088b1c6e6c732128be524d5e690a43c1f7cd6581c1f6d5ab7d496391e7362913ad9e24cf88134964b5f8aaeae25c55574e112f40092ef0f3c2e1059a6e65d
SSDEEP

6144:N2BRvEm8iIeqZUKRm1J0XhWqoDTUDaBMivO/vG:WRvEm8iIeNWiJ0XhWl0DKaW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b3b1c3bfe05bb496d71232ecb896623d_JaffaCakes118

Files

b3b1c3bfe05bb496d71232ecb896623d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

d039d3a8842974f62a90673d384e57a1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

AgentSvr.pdb

Imports

msvcrt

??3@YAXPAX@Z
_purecall
??2@YAPAXI@Z
wcslen
wcsstr
_ftol
free
malloc
wcsncpy
wcschr
iswspace
_errno
wcstoul
_vsnwprintf
wcsncmp
_wcslwr
_ultow
wcsrchr
wcscmp
_wcsicmp
rand
srand
_endthreadex
_beginthreadex
realloc
wcscpy
_c_exit
_exit
_XcptFilter
_cexit
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_except_handler3

advapi32

RegOpenKeyExA
RegQueryInfoKeyA
RegDeleteValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegQueryValueW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyW
RegCloseKey
GetUserNameW

kernel32

lstrlenA
SetLastError
RaiseException
GlobalFree
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalSize
SetProcessWorkingSetSize
HeapCreate
HeapDestroy
GetCurrentProcess
FreeLibrary
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
GetVersionExW
CloseHandle
CreateFileW
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
WaitForSingleObject
CreateMutexW
GetCurrentThreadId
GetCommandLineW
GetWindowsDirectoryW
ReadFile
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryExW
GetModuleHandleW
GetLocaleInfoA
LockResource
LoadResource
FindResourceExW
FindClose
FindNextFileW
FindFirstFileW
lstrcpynW
lstrlenW
OutputDebugStringW
ResetEvent
WaitForMultipleObjects
SetEvent
CreateEventW
GetSystemDefaultLangID
TerminateThread
CreateThread
IsBadReadPtr
MulDiv
CreateFileA
LCMapStringW
GetModuleFileNameW
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
SizeofResource
lstrcpyW
lstrcatW
FindResourceW
GetStringTypeExW
GetStringTypeExA
InterlockedCompareExchange
LoadLibraryA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
GetStartupInfoW
GetACP
Sleep
GetLastError
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
IsBadWritePtr
DelayLoadFailureHook
GetTickCount

gdi32

FillRgn
GetStockObject
CreateSolidBrush
DeleteObject
FillPath
EndPath
LineTo
MoveToEx
SetPolyFillMode
BeginPath
Ellipse
RoundRect
CreatePen
CreateCompatibleBitmap
SetTextColor
SetBkMode
TranslateCharsetInfo
DeleteDC
CreateCompatibleDC
GetRgnBox
CreateRectRgn
GdiFlush
StretchDIBits
SetStretchBltMode
ExtCreateRegion
GetRegionData
CreateFontW
GetDeviceCaps
CreateFontIndirectW
CombineRgn
SetRectRgn
GetSystemPaletteEntries
CreateDIBSection
CreatePalette
CreateHalftonePalette
SetBkColor
EnumFontFamiliesExW
GetTextAlign
ExtTextOutW
GetTextColor
GetTextExtentPointW
TextOutW
GetTextExtentPoint32W
GetNearestPaletteIndex
FrameRgn
GetPaletteEntries
GetObjectW
SelectPalette
RealizePalette
BitBlt
SetMapMode
SelectObject
SetTextAlign
GetTextMetricsW

user32

SetFocus
FindWindowW
FindWindowExW
GetUpdateRect
GetClientRect
GetSysColorBrush
FrameRect
DrawTextW
CharNextW
GetClassNameW
SetDlgItemTextW
GetDlgItemInt
SetDlgItemInt
DrawIconEx
MessageBeep
CallWindowProcW
IsDlgButtonChecked
SendDlgItemMessageW
CheckDlgButton
CheckRadioButton
GetDlgItem
SystemParametersInfoW
SetWindowTextW
MoveWindow
LoadIconW
CreatePopupMenu
PostMessageW
DestroyWindow
IsWindow
SetRectEmpty
GetSysColor
ReleaseDC
GetDC
IsWindowVisible
SetTimer
UpdateLayeredWindow
FillRect
ScrollDC
InflateRect
CopyRect
UpdateWindow
InvalidateRect
EndPaint
BeginPaint
SetWindowPos
SetRect
GetWindowRect
SetWindowRgn
IsWindowEnabled
ShowWindow
KillTimer
DefWindowProcW
SetWindowLongW
GetWindowLongW
CreateWindowExW
RegisterClassW
LoadCursorW
IsRectEmpty
GetWindowRgn
SetCapture
SendMessageW
AllowSetForegroundWindow
ClientToScreen
GetAsyncKeyState
ReleaseCapture
GetSystemMetrics
ScreenToClient
GetCursorPos
ValidateRect
GetCapture
PeekMessageW
EnableWindow
GetDoubleClickTime
SetCursor
RegisterClassExW
SendMessageTimeoutW
GetKeyboardState
RegisterHotKey
UnregisterHotKey
LoadImageW
GetForegroundWindow
PostQuitMessage
DispatchMessageW
TranslateMessage
IsDialogMessageW
GetMessageW
wsprintfW
GetKeyNameTextW
MapVirtualKeyW
IntersectRect
OffsetRect
PtInRect
WinHelpW
DestroyIcon
GetParent
RegisterWindowMessageW
SendNotifyMessageW
DrawEdge
DestroyMenu
keybd_event
GetKeyboardLayout
AppendMenuW
TrackPopupMenu
SetForegroundWindow
MessageBoxW

ole32

CoRegisterClassObject
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
OleInitialize
OleUninitialize
GetClassFile
CoUnmarshalInterface
CoInitialize
CoUninitialize
CoSuspendClassObjects
CoRegisterMessageFilter
CoMarshalInterface
CreateStreamOnHGlobal
CLSIDFromString
StringFromGUID2
CoFreeUnusedLibraries
CoCreateInstance
CoRevokeClassObject

oleaut32

SysAllocString
SysStringLen
VariantInit
SysFreeString
VariantClear
VariantCopy
VariantChangeType
LoadRegTypeLi
SetErrorInfo
RegisterTypeLi
LoadTypeLi
VarI4FromStr

Sections

.text
Size: 214KB - Virtual size: 213KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d039d3a8842974f62a90673d384e57a1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

gdi32

user32

ole32

oleaut32

Sections

.text Size: 214KB - Virtual size: 213KB

.data Size: 1024B - Virtual size: 3KB

.rsrc Size: 34KB - Virtual size: 34KB

.rdata Size: 20KB - Virtual size: 20KB

.text
Size: 214KB - Virtual size: 213KB

.data
Size: 1024B - Virtual size: 3KB

.rsrc
Size: 34KB - Virtual size: 34KB

.rdata
Size: 20KB - Virtual size: 20KB