bec2b2558decfcf9496da0ec38236b90_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

bec2b2558decfcf9496da0ec38236b90_JaffaCakes118
Size

159KB
MD5

bec2b2558decfcf9496da0ec38236b90
SHA1

f6847ed08291a61a21524aa50804132e9da344f2
SHA256

cfeff9caf19b1ed811ba830a702bd367fcfb39b1a4cbe5af7e0931dd9f3ea800
SHA512

9a7d328cbe02adab18ad2383344262808afad2670491b65105ccaddef37164eeac8029515b8a8ecb9aad134f31d7367a1771fbf7e1e31b57c6bc88255a4af325
SSDEEP

3072:ob2h3VK2abS5VHwO82dKaZuNuoJ+IRWKuFASPHEF8h5sRHkK6:JVQO86ZYEIRXCEs6Rg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bec2b2558decfcf9496da0ec38236b90_JaffaCakes118

Files

bec2b2558decfcf9496da0ec38236b90_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a91ce4b8d930e2a6762727a205af58c7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

taskmgr.pdb

Imports

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
IsValidSid
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
RegOpenKeyExA
RegQueryValueExA
LookupPrivilegeValueW

kernel32

GetProcessAffinityMask
OpenProcess
MultiByteToWideChar
GetThreadTimes
TerminateProcess
GetPriorityClass
lstrcmpW
SetEvent
CreateEventW
GetComputerNameW
Sleep
FreeLibrary
SetProcessAffinityMask
LoadLibraryA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentDirectoryW
SetUnhandledExceptionFilter
lstrcmpiW
GetTickCount
HeapSize
GetProcAddress
GetNumberFormatW
HeapReAlloc
lstrlenW
GetCurrentProcess
SetPriorityClass
GetCommandLineW
GetStartupInfoW
GetModuleHandleW
ExitProcess
CreateMutexW
GetCurrentProcessId
ProcessIdToSessionId
ReleaseMutex
SetProcessShutdownParameters
WaitForSingleObject
ExpandEnvironmentStringsW
CreateProcessW
GetCurrentThreadId
FormatMessageW
lstrcatW
GetVersionExW
GetLocaleInfoW
LocalAlloc
LocalFree
HeapFree
HeapAlloc
GetProcessHeap
CreateThread
CloseHandle
lstrcpynW
lstrcpyW
GetLastError
LoadLibraryW
InterlockedCompareExchange
GetVersionExA
IsBadWritePtr
SetLastError
GetCurrentThread
DelayLoadFailureHook
UnhandledExceptionFilter

gdi32

CreateFontIndirectW
GetCharWidth32W
CreateCompatibleBitmap
Rectangle
SetBkMode
SetTextColor
CreateCompatibleDC
DeleteDC
GetCurrentObject
GetObjectW
BitBlt
SelectObject
MoveToEx
LineTo
CreatePen
GetStockObject
CreateRectRgn
DeleteObject
CreateSolidBrush
CombineRgn
SetRectRgn
GetDeviceCaps
FillRgn

user32

DestroyIcon
LoadImageW
BeginDeferWindowPos
GetMenuItemCount
EnableMenuItem
GetSystemMetrics
SetMenuItemInfoW
LoadMenuW
DestroyMenu
ExitWindowsEx
LockWorkStation
GetAsyncKeyState
SetForegroundWindow
OpenIcon
LoadAcceleratorsW
MessageBoxW
CheckDlgButton
EndDialog
GetWindowTextW
IsDlgButtonChecked
GetSubMenu
InvalidateRect
GetSysColor
MonitorFromRect
SetTimer
LoadIconW
GetThreadDesktop
GetDialogBaseUnits
KillTimer
GetDesktopWindow
DestroyWindow
MessageBeep
MoveWindow
PostQuitMessage
IsZoomed
DispatchMessageW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
GetMessageW
CreateDialogParamW
SendMessageTimeoutW
AllowSetForegroundWindow
GetWindowThreadProcessId
FindWindowW
RegisterWindowMessageW
FillRect
DrawTextW
UpdateWindow
GetDlgCtrlID
SetFocus
CreateWindowExW
DialogBoxParamW
GetShellWindow
SetScrollPos
GetScrollInfo
IsWindow
EnableWindow
GetFocus
CharLowerBuffW
TrackPopupMenuEx
GetGuiResources
EnumWindowStationsW
GetClassLongW
IsHungAppWindow
InternalGetWindowText
IsWindowVisible
GetWindow
SetMenuDefaultItem
EnumWindows
CloseDesktop
SetThreadDesktop
OpenDesktopW
EnumDesktopsW
CloseWindowStation
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
CascadeWindows
TileWindows
SwitchToThisWindow
GetLastActivePopup
EndTask
PostMessageW
ShowWindowAsync
GetCursorPos
SetDlgItemTextW
GetParent
GetWindowTextLengthW
SetRect
SetCursor
LoadCursorW
GetWindowRect
DeferWindowPos
EndDeferWindowPos
GetMenuItemInfoW
IsIconic
BeginPaint
EndPaint
DrawEdge
GetForegroundWindow
GetKeyState
PostThreadMessageW
wsprintfW
GetClientRect
SetScrollInfo
ShowWindow
SetWindowPos
SetMenu
GetDlgItem
MapWindowPoints
SendMessageW
GetMenu
CheckMenuRadioItem
CheckMenuItem
DeleteMenu
LoadStringW
SetWindowTextW
GetClassInfoW
RegisterClassW
GetDC
ReleaseDC
SystemParametersInfoW
GetWindowLongW
SetWindowLongW
CallWindowProcW
DefWindowProcW
RemoveMenu
GetWindowLongA

ntdll

_chkstk
_snwprintf
RtlUnwind
_wcsicmp
NtQueryVirtualMemory
NtOpenThread
NtClose
strrchr
RtlLargeIntegerToChar
RtlAnsiStringToUnicodeString
_ui64tow
mbstowcs
memmove
NtQuerySystemInformation
wcstol
NtShutdownSystem
NtInitiatePowerAction
NtPowerInformation
RtlTimeToElapsedTimeFields

iphlpapi

GetInterfaceInfo
GetNumberOfInterfaces
NhGetInterfaceNameFromDeviceGuid
GetIfEntry

comctl32

ord17
ImageList_Remove
ImageList_ReplaceIcon
ImageList_SetIconSize
ImageList_Create
CreateStatusWindowW

shlwapi

StrStrIW
ord413
StrFormatByteSizeW
ord437
wnsprintfW

shell32

Shell_NotifyIconW
ord245
ShellAboutW
ord236
ord241
ord100
ord61

secur32

GetUserNameExW

vdmdbg

VDMEnumTaskWOWEx
VDMTerminateTaskWOW

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 77KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

lisjnqv
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a91ce4b8d930e2a6762727a205af58c7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

ntdll

iphlpapi

comctl32

shlwapi

shell32

secur32

vdmdbg

Sections

.text Size: 80KB - Virtual size: 79KB

.data Size: 1KB - Virtual size: 5KB

.rsrc Size: 77KB - Virtual size: 78KB

lisjnqv Size: - Virtual size: 4KB

.text
Size: 80KB - Virtual size: 79KB

.data
Size: 1KB - Virtual size: 5KB

.rsrc
Size: 77KB - Virtual size: 78KB

lisjnqv
Size: - Virtual size: 4KB