be45d621020e612522a2a4073a9064f3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

be45d621020e612522a2a4073a9064f3_JaffaCakes118
Size

608KB
MD5

be45d621020e612522a2a4073a9064f3
SHA1

d2fa618df48a775e8d1fefcb8e9920f64ed6e16a
SHA256

326c9ab94bc5d3fd28052575d5c4c747296b70da7556d32e19d70ca63313ffef
SHA512

40aac4a43bb26fdedd8b1744ef33f3feda20da4b4e317444dbe08371d17e92cd123774501ab639fd4f674d80b415eb85889801c500af12883e678cdd3ff67837
SSDEEP

12288:QctIDrsUUwt3+ziboDvNEbyZYde9WxL/UO9UX8HHyamiC0:QcgiwJ+z8YyQ2em/UO9UX8vD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be45d621020e612522a2a4073a9064f3_JaffaCakes118

Files

be45d621020e612522a2a4073a9064f3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

62b977f97032c011ee2c3c52bc870b5b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedExchange
GetTempFileNameA
SetVolumeLabelA
HeapDestroy
CreateMutexA
GetProfileStringA
GetFullPathNameA
GetDiskFreeSpaceA
GetLocaleInfoA
GetNumberFormatA
CompareStringA
GetShortPathNameA
GetEnvironmentVariableA
GlobalSize
GetPrivateProfileSectionA
WritePrivateProfileSectionA
WritePrivateProfileStringA
GetPrivateProfileIntA
SizeofResource
lstrlenA
GetWindowsDirectoryA
CreateThread
lstrcmpiA
TerminateThread
WideCharToMultiByte
GetSystemDirectoryA
TerminateProcess
Sleep
lstrcatA
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumDateFormatsA
EnumTimeFormatsA
InitializeCriticalSection
DeleteCriticalSection
lstrlenW
GlobalHandle
FreeResource
GetPrivateProfileStringA
GetLocalTime
GetLastError
GlobalFree
GlobalAlloc
MulDiv
lstrcmpA
GetCurrentProcessId
GlobalLock
GlobalUnlock
lstrcpynA
lstrcpynW
GetModuleHandleA
GetLogicalDrives
GetCurrentProcess
FlushInstructionCache
SetLastError
OutputDebugStringA
DebugBreak
InterlockedDecrement
FindResourceA
LoadResource
LockResource
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetFileAttributesA
FindFirstFileA
FindNextFileA
FindClose
MultiByteToWideChar
CopyFileA
InterlockedIncrement
CreateDirectoryA
GetTempPathA
lstrcpyA
CreateFileA
WriteFile
CloseHandle
RemoveDirectoryA
SetFileAttributesA
DeleteFileA
GetSystemDefaultLangID
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
GetVersionExA
GetStartupInfoA

user32

DeleteMenu
CheckMenuItem
SetWindowPlacement
SetForegroundWindow
SetActiveWindow
GetMenu
SetMenu
LoadIconA
GetWindowPlacement
InvalidateRgn
CreateAcceleratorTableA
GetDesktopWindow
IsChild
CreateDialogIndirectParamA
DrawFocusRect
GetWindowTextLengthA
DestroyWindow
EnableMenuItem
PostQuitMessage
LoadMenuA
GetDlgCtrlID
GetScrollPos
MoveWindow
SetScrollInfo
IsRectEmpty
IntersectRect
SetScrollPos
GetMenuDefaultItem
GetCapture
GetSystemMenu
SetRect
DrawIconEx
LoadBitmapA
SetWindowTextA
InsertMenuItemA
EnumWindows
CharUpperA
GetParent
EndDialog
EnableWindow
SendMessageA
LoadImageA
GetSystemMetrics
SetWindowPos
GetClassNameA
DrawFrameControl
TrackPopupMenuEx
ModifyMenuA
FrameRect
DrawEdge
OffsetRect
GetSysColorBrush
SetRectEmpty
GetSubMenu
PeekMessageA
PtInRect
CallNextHookEx
GetWindowDC
DrawTextA
IsMenu
InsertMenuA
LoadStringW
GetMenuStringA
SetMenuDefaultItem
DispatchMessageA
TranslateMessage
LoadAcceleratorsA
RemoveMenu
SetCursor
FindWindowExA
DestroyCursor
GetScrollInfo
DrawIcon
CloseClipboard
SetClipboardData
OpenClipboard
GetClipboardData
DrawAnimatedRects
DestroyIcon
FindWindowA
ScreenToClient
GetWindowRect
SetWindowLongA
GetWindowLongA
SetDlgItemTextA
wsprintfA
GetWindowTextA
MessageBoxA
DialogBoxParamA
GetActiveWindow
CharLowerA
MapWindowPoints
GetClientRect
SystemParametersInfoA
GetWindow
CreateWindowExA
wvsprintfA
CharNextA
ScrollWindowEx
MenuItemFromPoint
RemovePropA
GetPropA
SetPropA
GetMenuItemID
DialogBoxIndirectParamA
GetMessageA
SendMessageTimeoutA
IsZoomed
CreateCursor
GetDlgItem
RegisterWindowMessageA
WindowFromPoint
InvalidateRect
GetKeyState
GetWindowThreadProcessId
GetMenuItemInfoA
SetMenuItemInfoA
FillRect
IsWindowEnabled
MessageBeep
UnhookWindowsHookEx
SetWindowsHookExA
IsWindow
TranslateAcceleratorA
IsDialogMessageA
GetDoubleClickTime
GetMessagePos
ReleaseDC
GetDC
CreatePopupMenu
TrackPopupMenu
DestroyMenu
RegisterClipboardFormatA
EndPaint
BeginPaint
CreateDialogParamA
GetAsyncKeyState
GetClassInfoExA
LoadCursorA
InflateRect
PostMessageA
CopyRect
GetCursorPos
SetCapture
IsWindowVisible
ReleaseCapture
SetTimer
GetSysColor
SetFocus
UpdateWindow
RedrawWindow
SetClassLongA
KillTimer
ClientToScreen
GetMenuItemCount
AppendMenuA
GetFocus
RegisterClassExA
DefWindowProcA
SetParent
ShowWindow
CallWindowProcA
LoadStringA
EmptyClipboard

gdi32

SetWindowExtEx
SetViewportExtEx
Rectangle
CreateDCA
GetDeviceCaps
SaveDC
SetMapMode
CreateSolidBrush
RestoreDC
GetClipBox
LPtoDP
DPtoLP
GetBkColor
SetViewportOrgEx
CreateDIBSection
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
PatBlt
CreateBitmap
CreatePatternBrush
SetTextColor
SetBkColor
SetBrushOrgEx
SetBkMode
DeleteDC
GetTextExtentPoint32A
ExcludeClipRect
OffsetWindowOrgEx
SetWindowOrgEx
CreatePen
SelectObject
MoveToEx
LineTo
DeleteObject
GetViewportExtEx
GetWindowExtEx
OffsetViewportOrgEx
SelectClipRgn
DeleteEnhMetaFile
GetEnhMetaFileHeader
EndDoc
AbortDoc
EndPage
StartPage
ResetDCA
GetPixel
StretchBlt
SetStretchBltMode
CreateEnhMetaFileA
CloseEnhMetaFile
ExtTextOutA
CreateFontIndirectA
IntersectClipRect
GetStockObject
GetObjectA
StartDocA

winspool.drv

GetPrinterA
OpenPrinterA
ClosePrinter

comdlg32

PrintDlgA
GetSaveFileNameA
ChooseColorA
PageSetupDlgA
GetOpenFileNameA

advapi32

GetUserNameA
RegDeleteValueA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCloseKey
RegDeleteKeyA
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegEnumKeyExA

shell32

SHAppBarMessage
Shell_NotifyIconA
ord21
DragFinish
SHBrowseForFolderA
ord16
ord25
ExtractIconExA
SHFileOperationA
ord68
SHGetSettings
DragQueryFileA
SHGetFileInfoA
DragAcceptFiles
SHGetMalloc
ord155
ord18
SHGetDesktopFolder
ord4
ord2
ShellExecuteExA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ShellExecuteA
ord17

ole32

DoDragDrop
ReleaseStgMedium
CoCreateInstance
CreateStreamOnHGlobal
CLSIDFromProgID
OleInitialize
OleUninitialize
CLSIDFromString
CoTaskMemFree
StringFromCLSID
CoTaskMemAlloc
OleLockRunning
RevokeDragDrop
CoUninitialize
CoInitialize
RegisterDragDrop

oleaut32

VariantInit
OleCreateFontIndirect
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysAllocStringLen
SysFreeString

msvcrt

_mbscmp
??3@YAXPAX@Z
??2@YAPAXI@Z
_mbschr
_mbsstr
wcslen
_ismbcdigit
atoi
_ismbcspace
memmove
_fullpath
realloc
free
clock
fclose
fwrite
fopen
_purecall
time
malloc
_mbsicmp
_chdir
fread
strrchr
calloc
rand
ceil
toupper
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_ftol
sprintf
_mbsrchr
_adjust_fdiv

comctl32

ord6
PropertySheetA
DestroyPropertySheetPage
CreatePropertySheetPageA
_TrackMouseEvent
ImageList_GetIcon
ImageList_DrawEx
ord8
ImageList_AddMasked
ImageList_Draw
ImageList_GetImageCount
ImageList_Destroy
InitCommonControlsEx
ImageList_SetBkColor
ImageList_Create
ImageList_ReplaceIcon
ImageList_LoadImageA
ImageList_Remove

msimg32

AlphaBlend

winmm

PlaySoundA
timeGetTime

shlwapi

PathRelativePathToA

Sections

.text
Size: 432KB - Virtual size: 432KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 216KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

62b977f97032c011ee2c3c52bc870b5b

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

msvcrt

comctl32

msimg32

winmm

shlwapi

Sections

.text Size: 432KB - Virtual size: 432KB

.rdata Size: 16KB - Virtual size: 16KB

.data Size: 15KB - Virtual size: 32KB

Shared Size: 2KB - Virtual size: 1KB

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 216KB - Virtual size: 216KB

.text
Size: 432KB - Virtual size: 432KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 15KB - Virtual size: 32KB

Shared
Size: 2KB - Virtual size: 1KB

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 216KB - Virtual size: 216KB