b5d8ad98dd1679b3022505c404468eaa_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b5d8ad98dd1679b3022505c404468eaa_JaffaCakes118
Size

256KB
MD5

b5d8ad98dd1679b3022505c404468eaa
SHA1

0e0e29f5c1ca12b646438ee79ec95f837f9d4c7c
SHA256

5ba822b6fb890d3a1b207f9f3ad6b9c7eec89bc5ab2d8a15e41382bec11bb4e2
SHA512

f595173a61d51993ffbcfd53ddcd32fd987e47777a24c90aa294f0c9eae112c6db5ee919b96359d6fa1ac408c5cd2a29bcacf17e7d33700f3abdc60c6b42c36e
SSDEEP

6144:cubbaE9JPRyWAUToCTPuE+X1dVdcO4XoQgX5u:YMRZATE+FPAon4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b5d8ad98dd1679b3022505c404468eaa_JaffaCakes118

Files

b5d8ad98dd1679b3022505c404468eaa_JaffaCakes118
.exe windows:4 windows x86 arch:x86

318f58992355e545a907d076ae6ad454

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathFindExtensionA
PathAppendA
SHSetValueA
PathFileExistsA
SHGetValueA

kernel32

TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
SetErrorMode
FileTimeToLocalFileTime
GetFileAttributesA
GetFileTime
WritePrivateProfileStringA
GlobalFlags
GetVersionExA
lstrcmpW
GlobalFindAtomA
GetCPInfo
GetOEMCP
GetFileType
HeapFree
HeapAlloc
VirtualAlloc
HeapReAlloc
GetCommandLineA
GetProcessHeap
GetStartupInfoA
RtlUnwind
RaiseException
TlsAlloc
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetConsoleCP
GetConsoleMode
SetStdHandle
SetHandleCount
GetStdHandle
HeapDestroy
HeapCreate
VirtualFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetACP
GetTimeZoneInformation
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetEnvironmentVariableA
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
InterlockedIncrement
FileTimeToSystemTime
InterlockedDecrement
GetModuleFileNameW
GetCurrentProcessId
GlobalAddAtomA
WaitForSingleObject
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
GlobalDeleteAtom
GlobalGetAtomNameA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
DuplicateHandle
GetThreadLocale
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
ReleaseSemaphore
CreateSemaphoreA
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
GetVersion
CompareStringA
InterlockedExchange
MultiByteToWideChar
CompareStringW
SystemTimeToFileTime
GetSystemTimeAsFileTime
ResumeThread
GetCurrentProcess
SetPriorityClass
GetCurrentThread
SetThreadPriority
WriteFile
RemoveDirectoryA
DeleteFileA
Sleep
ExitProcess
GetTempPathA
CreateProcessA
SetLastError
lstrcatA
GetLastError
CreateMutexA
LoadLibraryA
GetProcAddress
GetModuleHandleA
CreateFileA
FreeLibrary
GetModuleFileNameA
lstrlenA
CloseHandle
FindResourceA
LoadResource
LockResource
SizeofResource
WideCharToMultiByte

user32

DestroyMenu
UnregisterClassA
ShowWindow
LoadIconA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindow
GetDlgCtrlID
GetClassNameA
PtInRect
SetWindowTextA
GetMessageA
DispatchMessageA
TranslateMessage
RegisterWindowMessageA
RegisterClassExA
GetWindowRect
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
LoadCursorA
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
GetWindowTextA
UnhookWindowsHookEx
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
SetCursor
SetWindowsHookExA
CreateWindowExA
GetMessageExtraInfo
PostQuitMessage
DefWindowProcA
MessageBoxA
wsprintfA
CharUpperA
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
CallNextHookEx
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
GetParent
SendMessageA
ModifyMenuA
EnableMenuItem
CheckMenuItem
PostMessageA
GetSystemMetrics

gdi32

GetStockObject
DeleteDC
SaveDC
CreateBitmap
GetDeviceCaps
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
DeleteObject
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

advapi32

RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegEnumKeyA
RegOpenKeyA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegEnumValueA
RegQueryInfoKeyA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA

shell32

ShellExecuteA
SHGetFolderPathA
SHGetSpecialFolderPathA

oleaut32

VariantInit
VariantClear
VariantChangeType

Sections

.text
Size: 176KB - Virtual size: 174KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

318f58992355e545a907d076ae6ad454

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

oleaut32

Sections

.text Size: 176KB - Virtual size: 174KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 8KB - Virtual size: 24KB

.rsrc Size: 16KB - Virtual size: 14KB

.text
Size: 176KB - Virtual size: 174KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 8KB - Virtual size: 24KB

.rsrc
Size: 16KB - Virtual size: 14KB