bf565e56b8ca8ab9f0d7a705dc05d449_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

bf565e56b8ca8ab9f0d7a705dc05d449_JaffaCakes118
Size

138KB
MD5

bf565e56b8ca8ab9f0d7a705dc05d449
SHA1

c4b5f8fbbdd6116abe4837cc00af047218f25540
SHA256

5b4ffcc48aa8918cbab81f6a658aa98ff2a66da7c2ae957cbbc82e5ce62431b2
SHA512

2a143254e8d5193545fee2d1cf8ed62e08f9cd1f632123c32307eb27ebccf4a9899bf34aea91575a631dad852e2b9237bc4ee2f1ac26caafd6ae244d35eed4e5
SSDEEP

3072:wtRn7gfaQUBCoSd/ORbc0H2FXBmaLeaq0QTY1g4u/KD1NuoFENt6pGr53H:An7VQfI6FXBmaLvZ1gn/K5Cr53

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bf565e56b8ca8ab9f0d7a705dc05d449_JaffaCakes118

Files

bf565e56b8ca8ab9f0d7a705dc05d449_JaffaCakes118
.exe windows:5 windows x86 arch:x86

9bd45714b72a2cd08944f9f202240548

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessW
HeapAlloc
SystemTimeToFileTime
SetFilePointerEx
HeapFree
VirtualFree
GetProcessHeap
IsBadReadPtr
SetFileTime
VirtualQueryEx
Thread32First
WideCharToMultiByte
ReadProcessMemory
HeapDestroy
HeapCreate
Thread32Next
ReadFile
GetTimeZoneInformation
MultiByteToWideChar
GetTempPathW
GetFileSizeEx
OpenMutexW
VirtualProtectEx
VirtualAllocEx
SetLastError
LoadLibraryA
SetEndOfFile
WaitForMultipleObjects
FindNextFileW
VirtualProtect
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
LocalFree
WriteProcessMemory
CreateThread
ExpandEnvironmentStringsW
GetCommandLineW
SetErrorMode
GetComputerNameW
GetVersionExW
OpenEventW
DuplicateHandle
GetCurrentProcessId
GlobalLock
GlobalUnlock
GetLocalTime
GetNativeSystemInfo
GetLastError
LeaveCriticalSection
FindFirstFileW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
GetFileAttributesExW
GetProcessId
VirtualAlloc
SetThreadContext
InitializeCriticalSection
GetUserDefaultUILanguage
GetThreadContext
GetPrivateProfileIntW
FlushFileBuffers
WriteFile
GetPrivateProfileStringW
GetModuleHandleW
SetFileAttributesW
WTSGetActiveConsoleSessionId
GetProcAddress
CreateFileW
LoadLibraryW
CreateDirectoryW
FreeLibrary
ExitProcess
RemoveDirectoryW
EnterCriticalSection
lstrcmpiW
GetModuleFileNameW
GetFileAttributesW
Sleep
GetTickCount
MoveFileExW
TlsFree
TlsAlloc
GetCurrentThreadId
CreateEventW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
CreateMutexW
CloseHandle
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
VirtualFreeEx
OpenProcess
CreateRemoteThread
ReleaseMutex
ResetEvent
TerminateProcess
TlsSetValue
SetEvent
TlsGetValue
GetSystemTime
lstrcmpiA
SetThreadPriority
GetCurrentThread
FindClose
WaitForSingleObject

user32

DispatchMessageW
CharToOemW
MapVirtualKeyW
RegisterClassExA
RegisterWindowMessageW
GetThreadDesktop
GetMenuItemID
SetKeyboardState
GetSubMenu
DefDlgProcW
DefFrameProcA
OpenInputDesktop
OpenDesktopW
MenuItemFromPoint
GetMenu
RegisterClassExW
GetMenuItemRect
GetWindow
SystemParametersInfoW
GetClassNameW
GetMenuState
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
GetMenuItemCount
GetCursorPos
DefMDIChildProcA
HiliteMenuItem
RegisterClassW
GetUserObjectInformationW
CallWindowProcA
GetKeyboardState
ToUnicode
SetWindowPos
GetClipboardData
CreateDesktopW
SetProcessWindowStation
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
CloseDesktop
SetThreadDesktop
OpenWindowStationW
ExitWindowsEx
DrawIcon
GetIconInfo
GetMessageA
GetWindowRect
SetCapture
GetParent
GetClassLongW
GetCapture
SetCursorPos
GetAncestor
IsWindow
ReleaseCapture
SetWindowLongW
MapWindowPoints
PeekMessageA
TrackPopupMenuEx
GetMessagePos
SendMessageTimeoutW
GetTopWindow
LoadImageW
CharLowerBuffA
CharLowerW
MsgWaitForMultipleObjects
WindowFromPoint
TranslateMessage
GetWindowLongW
EndMenu
CallWindowProcW
DefFrameProcW
GetWindowThreadProcessId
RegisterClassA
GetShellWindow
GetSystemMetrics
EndPaint
GetUpdateRgn
GetMessageW
GetWindowDC
FillRect
PostMessageW
GetWindowInfo
DrawEdge
BeginPaint
GetUpdateRect
GetDC
CharLowerA
PeekMessageW
CharUpperW
DefDlgProcA
IsRectEmpty
DefWindowProcW
SendMessageW
PrintWindow
EqualRect
PostThreadMessageW
ReleaseDC
GetDCEx
IntersectRect

advapi32

GetLengthSid
EqualSid
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
IsWellKnownSid
InitiateSystemShutdownExW
RegEnumKeyExW
ConvertSidToStringSidW

shlwapi

StrCmpNIW
PathRenameExtensionW
StrStrIW
StrStrIA
PathIsURLW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveBackslashW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathQuoteSpacesW
PathRemoveFileSpecW

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

GetDeviceCaps
CreateCompatibleBitmap
CreateDIBSection
SetViewportOrgEx
DeleteDC
GdiFlush
DeleteObject
SelectObject
SetRectRgn
CreateCompatibleDC
GetDIBits
RestoreDC
SaveDC

ws2_32

closesocket
WSASetLastError
freeaddrinfo
socket
bind
recv
setsockopt
shutdown
WSAEventSelect
getpeername
recvfrom
sendto
WSASend
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
send
listen
accept
WSAGetLastError
getsockname

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData

wininet

InternetQueryOptionA
InternetOpenA
HttpOpenRequestA
InternetSetOptionA
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
HttpSendRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFile
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpQueryInfoA
HttpSendRequestExA
InternetCloseHandle

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9bd45714b72a2cd08944f9f202240548

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 129KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 129KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB