bd15a3142b4b14a080596fe5e4120690_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

bd15a3142b4b14a080596fe5e4120690_JaffaCakes118
Size

1.6MB
MD5

bd15a3142b4b14a080596fe5e4120690
SHA1

cc814e51d00e6237bb56c783cf1b9deb7961a1e6
SHA256

c8abd5641ec4708a1b15a3229d437bda4bfd1c131b2a1d25b97ff3cbc0b7a1e8
SHA512

e3153887d91f6b79060a5c260b6bcf3c9d19d059e9a9c3db0873a7cfd66f02a4c51b965c5761dc60127c07556758cec13be606afb7c57cc8a1bb1410b0564775
SSDEEP

24576:ggcGfunVBBHXZlewmkm2/N5y2hAsGUkEGi0jI63oSgm24+ssB0uots2p:ggcGs3LtmkJ/GzEGpP/gjEw5ks2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bd15a3142b4b14a080596fe5e4120690_JaffaCakes118

Files

bd15a3142b4b14a080596fe5e4120690_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bdc78b384b41303d3118b444d4deec69

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

netapi32

NetMessageBufferSend

kernel32

GetEnvironmentVariableA
GetExitCodeProcess
GetFileAttributesW
GetFileSize
GetFileTime
GetFileType
GetLastError
GetLocalTime
GetLocaleInfoA
GetLocaleInfoW
GetLogicalDrives
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetPrivateProfileSectionW
GetPrivateProfileStringW
GetProcAddress
GetProcessHeap
GetShortPathNameW
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemTime
GetSystemTimeAsFileTime
GetTempFileNameW
GetTempPathW
GetTickCount
GetTimeFormatA
GetTimeFormatW
GetTimeZoneInformation
GetVersion
GetVersionExA
GetVersionExW
GetWindowsDirectoryW
GlobalMemoryStatus
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsBadCodePtr
GetEnvironmentStringsW
IsBadWritePtr
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalAlloc
LocalFree
MapViewOfFile
MoveFileExW
MoveFileW
MultiByteToWideChar
OpenFileMappingW
OpenMutexW
OpenProcess
QueryDosDeviceW
ReadFile
ReadProcessMemory
ReleaseMutex
ResetEvent
RtlUnwind
GetEnvironmentStringsA
SetEnvironmentVariableA
SetEvent
SetFileAttributesW
SetFilePointer
SetHandleCount
SetLastError
SetStdHandle
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
TerminateThread
TlsAlloc
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
WritePrivateProfileSectionW
WritePrivateProfileStringW
lstrcmpA
lstrlenA
lstrlenW
GetDriveTypeW
GetDiskFreeSpaceW
GetDateFormatW
GetDateFormatA
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetComputerNameW
GetComputerNameA
GetCommandLineA
GetCPInfo
GetACP
FreeLibrary
FreeEnvironmentStringsW
FreeEnvironmentStringsA
FlushFileBuffers
FindNextFileW
FindFirstFileW
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
ExpandEnvironmentStringsW
ExitProcess
EnterCriticalSection
DuplicateHandle
DeviceIoControl
DeleteFileW
DeleteCriticalSection
CreateThread
CreateProcessW
CreateMutexW
CreateFileW
CreateFileMappingW
CreateFileA
CreateEventW
CreateDirectoryW
CopyFileW
CompareStringW
CompareStringA
CompareFileTime
CloseHandle
IsBadReadPtr
SetEndOfFile

user32

wsprintfW
TranslateMessage
SetTimer
SendMessageW
RegisterClassW
PostMessageW
PeekMessageW
MsgWaitForMultipleObjects
LoadStringW
KillTimer
GetMessageW
DispatchMessageW
CreateWindowExW
DefWindowProcW

advapi32

RegOpenKeyExW
RegOpenKeyA
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
QueryServiceStatus
OpenThreadToken
OpenServiceW
OpenSCManagerW
OpenProcessToken
LookupAccountSidW
IsValidSid
InitializeSecurityDescriptor
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
GetSecurityDescriptorDacl
GetKernelObjectSecurity
FreeSid
EqualSid
DuplicateTokenEx
DuplicateToken
DeleteService
CreateServiceW
CreateProcessAsUserW
ControlService
CloseServiceHandle
AllocateAndInitializeSid
RegQueryInfoKeyW
RegQueryValueExA
RegQueryValueExW
RegSetValueExW
RegisterServiceCtrlHandlerW
RevertToSelf
SetKernelObjectSecurity
SetSecurityDescriptorDacl
SetServiceStatus
SetThreadToken
StartServiceCtrlDispatcherW
StartServiceW
RegEnumKeyExW
RegEnumKeyW
RegEnumValueW
RegDeleteValueW

wsock32

WSASetLastError
WSAGetLastError
__WSAFDIsSet
closesocket
connect
gethostbyname
htons
ioctlsocket
inet_ntoa
recv
select
send
setsockopt
socket
WSACleanup
WSAStartup

ole32

CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

VariantClear
SysFreeString
SysAllocString

Exports

Exports

adler32
compress
compress2
compressBound
crc32
deflate
deflateBound
deflateCopy
deflateEnd
deflateInit2_
deflateInit_
deflateParams
deflatePrime
deflateReset
deflateSetDictionary
get_crc_table
gzclearerr
gzclose
gzdopen
gzeof
gzerror
gzflush
gzgetc
gzgets
gzopen
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzsetparams
gztell
gzungetc
gzwrite
inflate
inflateBack
inflateBackEnd
inflateBackInit_
inflateCopy
inflateEnd
inflateInit2_
inflateInit_
inflateReset
inflateSetDictionary
inflateSync
inflateSyncPoint
uncompress
zError
zlibCompileFlags
zlibVersion

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 396KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bdc78b384b41303d3118b444d4deec69

Headers

File Characteristics

Imports

netapi32

kernel32

user32

advapi32

wsock32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 44KB - Virtual size: 44KB

.data Size: 24KB - Virtual size: 396KB

.idata Size: 8KB - Virtual size: 8KB

.rsrc Size: 28KB - Virtual size: 28KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 44KB - Virtual size: 44KB

.data
Size: 24KB - Virtual size: 396KB

.idata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 28KB - Virtual size: 28KB