b41faf639685708a5b3134c9082f7358_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b41faf639685708a5b3134c9082f7358_JaffaCakes118
Size

294KB
MD5

b41faf639685708a5b3134c9082f7358
SHA1

0a78e48cfd27de7d0820e9024936eaed60a38720
SHA256

aa3207f44af2993e2562b13469350cf0c574978e6dc30065109a5b5c61aea99b
SHA512

b41866b49a07c310ed54fa26765bdbad26d082ab691beaf6a6890317820ccd2cb395faa892316567473a216da3b2f7244f22912c0c43e36bd1df74ed7dfbf99d
SSDEEP

6144:C6K9TBm73F5PfhfGeF+K2kmHBltsMzj5amfXVrBMS2JwX7Dhlyh+Ib/rexZ98kv:C6K9To73F59GeFHMH/SOj5aEXVl42X7D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b41faf639685708a5b3134c9082f7358_JaffaCakes118

Files

b41faf639685708a5b3134c9082f7358_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f7d6b8c9a047bf737e89207fc4a691d5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlUnwind
NtQueryInformationProcess
LdrLoadDll
LdrGetDllHandle

kernel32

CreateEventW
TlsAlloc
TlsFree
lstrcmpiA
lstrcmpiW
VirtualProtect
ReleaseMutex
CreateThread
VirtualQueryEx
ReadProcessMemory
VirtualProtectEx
VirtualAllocEx
WriteProcessMemory
GetCommandLineW
GetDriveTypeW
GetSystemDefaultUILanguage
GetLogicalDrives
GetProcessTimes
GetModuleFileNameW
lstrcmpW
GlobalMemoryStatusEx
GetUserDefaultUILanguage
GetDiskFreeSpaceExW
GetVolumeInformationW
Sleep
TlsGetValue
TlsSetValue
TerminateProcess
ResetEvent
LoadLibraryA
InterlockedIncrement
InterlockedDecrement
QueryPerformanceCounter
ExitProcess
WTSGetActiveConsoleSessionId
FlushFileBuffers
TryEnterCriticalSection
WaitForMultipleObjects
HeapReAlloc
GetProcessHeap
GetExitCodeThread
GetHandleInformation
IsBadReadPtr
OpenMutexW
SetErrorMode
GetComputerNameW
lstrcatW
OpenEventW
DuplicateHandle
GetCurrentProcessId
CreateProcessW
ResumeThread
MoveFileExW
SetEndOfFile
SetFilePointerEx
SetFileTime
GetFileTime
DeleteFileW
GetFileInformationByHandle
UnregisterWait
RegisterWaitForSingleObject
VirtualQuery
GetCurrentProcess
InterlockedCompareExchange
FlushInstructionCache
GetEnvironmentVariableW
OpenProcess
Thread32First
Thread32Next
CreateToolhelp32Snapshot
TerminateThread
CreateRemoteThread
Process32FirstW
Process32NextW
GetVolumeNameForVolumeMountPointW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTempFileNameW
FindFirstFileW
CreateDirectoryW
VirtualFree
WriteFile
GetFileAttributesW
ReadFile
CreateFileW
GetTempPathW
GetFileSizeEx
VirtualAlloc
FindClose
RemoveDirectoryW
FindNextFileW
CloseHandle
SetFileAttributesW
ExpandEnvironmentStringsW
lstrlenA
lstrlenW
LocalFree
HeapAlloc
HeapFree
GetModuleHandleW
InitializeCriticalSection
HeapDestroy
HeapCreate
GetLastError
SetFilePointer
OutputDebugStringA
SetLastError
GetProcAddress
DeleteCriticalSection
FileTimeToDosDateTime
CreateFileMappingW
DosDateTimeToFileTime
lstrcmpA
lstrcpynA
FreeLibrary
LoadLibraryW
FileTimeToLocalFileTime
lstrcpyW
lstrcpyA
GetThreadContext
SetThreadContext
VirtualFreeEx
GetProcessId
GlobalLock
GetTickCount
LeaveCriticalSection
GlobalUnlock
EnterCriticalSection
WideCharToMultiByte
MultiByteToWideChar
GetNativeSystemInfo
GetVersionExW
SystemTimeToFileTime
GetTimeZoneInformation
GetLocalTime
GetSystemTime
WaitForSingleObject
GetCurrentThreadId
GetCurrentThread
SetThreadPriority
CreateMutexW
MapViewOfFile
UnmapViewOfFile
SetEvent

user32

SetKeyboardState
GetSubMenu
DefDlgProcW
DefFrameProcA
OpenInputDesktop
OpenDesktopW
MenuItemFromPoint
GetMenu
RegisterClassExW
GetMenuItemRect
TrackPopupMenuEx
GetClassNameW
GetMenuState
DefWindowProcA
DefMDIChildProcW
CloseDesktop
GetProcessWindowStation
CreateWindowStationW
CloseWindowStation
SetProcessWindowStation
CreateDesktopW
GetSystemMetrics
PostMessageW
MapVirtualKeyW
FillRect
GetMenuItemID
CharUpperW
IsRectEmpty
PrintWindow
EqualRect
GetDCEx
IntersectRect
GetUpdateRect
BeginPaint
GetWindowRect
GetParent
GetClassLongW
GetWindowInfo
SetWindowPos
IsWindow
MapWindowPoints
ExitWindowsEx
MsgWaitForMultipleObjects
DispatchMessageW
DrawIcon
GetIconInfo
CharToOemW
GetMessageA
SetCapture
GetCapture
SetCursorPos
GetThreadDesktop
RegisterWindowMessageW
RegisterClassExA
OpenWindowStationW
GetLastInputInfo
SwitchDesktop
GetMenuItemCount
DefDlgProcA
PostThreadMessageW
DefMDIChildProcA
HiliteMenuItem
PeekMessageW
PeekMessageA
GetCursorPos
ReleaseCapture
RegisterClassW
GetUserObjectInformationW
SendMessageW
CallWindowProcA
EndMenu
CallWindowProcW
DefWindowProcW
DefFrameProcW
GetWindowThreadProcessId
RegisterClassA
GetShellWindow
GetTopWindow
LoadImageW
WindowFromPoint
GetDC
GetWindowLongW
ReleaseDC
SetWindowLongW
GetMessagePos
CharLowerW
EndPaint
GetUpdateRgn
GetMessageW
GetWindowDC
SetThreadDesktop
SendMessageTimeoutW
GetWindow
TranslateMessage
GetKeyboardState
GetClipboardData
ToUnicode
CharLowerA
DrawEdge
SystemParametersInfoW
GetAncestor

advapi32

LookupPrivilegeValueW
CryptAcquireContextW
CryptReleaseContext
CryptCreateHash
CryptDestroyHash
CryptHashData
GetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptVerifySignatureW
CryptGetKeyParam
CryptImportKey
CryptDestroyKey
EqualSid
IsWellKnownSid
GetLengthSid
ConvertSidToStringSidW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
OpenProcessToken
GetSidSubAuthority
InitiateSystemShutdownExW
AdjustTokenPrivileges
CryptGetHashParam
CreateProcessAsUserW
GetSidSubAuthorityCount
OpenThreadToken

shlwapi

PathAddBackslashW
PathIsURLW
ord14
SHDeleteKeyW
SHDeleteValueW
UrlUnescapeA
PathMatchSpecW
PathRemoveExtensionW
PathFindExtensionW
PathQuoteSpacesW
PathGetDriveNumberW
StrCmpNIA
StrChrA
StrCmpNW
StrCmpNIW
StrChrW
StrCmpIW
StrRChrA
StrCmpNA
PathAddExtensionW
PathRemoveFileSpecW
PathIsDirectoryW
PathFindFileNameW
wvnsprintfA
wvnsprintfW
PathUnquoteSpacesW
PathSkipRootW
PathRemoveBackslashW

shell32

ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW

secur32

EncryptMessage
DecryptMessage
DeleteSecurityContext
GetUserNameExW

ole32

CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize
CoCreateInstance
CoTaskMemFree
CreateStreamOnHGlobal
CLSIDFromString
StringFromGUID2

gdi32

SetViewportOrgEx
CreateDCW
GdiFlush
GetDIBits
CreateDIBSection
SetRectRgn
SaveDC
RestoreDC
DeleteDC
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
GetDeviceCaps
BitBlt

ws2_32

getaddrinfo
select
shutdown
WSACleanup
recv
bind
socket
freeaddrinfo
WSAStartup
WSACloseEvent
WSAIoctl
WSAAddressToStringW
WSAEnumNetworkEvents
WSAEventSelect
setsockopt
WSACreateEvent
getsockopt
WSAAddressToStringA
WSAStringToAddressW
WSARecv
WSASend
closesocket
send
listen
accept
WSAGetLastError
WSASetLastError
getpeername
sendto
getsockname
recvfrom
WSAGetOverlappedResult
connect

crypt32

CertOpenSystemStoreW
CertDuplicateCertificateContext
PFXExportCertStoreEx
CryptUnprotectData
CertDeleteCertificateFromStore
CertEnumCertificatesInStore
CertCloseStore
PFXImportCertStore

wininet

InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
InternetConnectA
HttpQueryInfoA
InternetCrackUrlA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetUserGetInfo
NetUserEnum
NetApiBufferFree

iphlpapi

GetAdaptersAddresses

msvcrt

_except_handler3
_errno
memcpy
memset
memcmp
_purecall
memmove
strcmp
strtoul
_ultow
memchr
_vsnwprintf
_vsnprintf
abs

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Sections

.text
Size: 275KB - Virtual size: 275KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f7d6b8c9a047bf737e89207fc4a691d5

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

iphlpapi

msvcrt

version

Sections

.text Size: 275KB - Virtual size: 275KB

.data Size: 2KB - Virtual size: 9KB

.reloc Size: 15KB - Virtual size: 14KB

.text
Size: 275KB - Virtual size: 275KB

.data
Size: 2KB - Virtual size: 9KB

.reloc
Size: 15KB - Virtual size: 14KB