c75f3f02f31d0868a898313db45f07dc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c75f3f02f31d0868a898313db45f07dc_JaffaCakes118
Size

376KB
MD5

c75f3f02f31d0868a898313db45f07dc
SHA1

3c4b4fd3547ab1d177c28e7ada64e50be107d13c
SHA256

2c931c280e233b9a1c8c53e7e9253f94e6a16b568c47af7a06dee92b55454576
SHA512

518bde799705f92db3bb4cf13e92de0de927bba354e8d1b7e96f2ba86606724f78cdefcc4e409e0d2f33904ef75c62250ec6e23721511eab43812fb4e4a09120
SSDEEP

6144:dczXulrY3BloHUlGZaIGmTquUrnkSUErpPVjnn7/KlesBnya6OjCtFyGAkx+b5n:dO3Bl4UlEOmO9rnkk5x/yesEa63XbEn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c75f3f02f31d0868a898313db45f07dc_JaffaCakes118

Files

c75f3f02f31d0868a898313db45f07dc_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b482587320a9350346a03407727c25dd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

urlmon

CoInternetCombineUrl

msvcrt

wcscpy
_stricmp
_ltow
_wtol
_wcsicmp
_except_handler3
iswprint
_purecall
free
strtok
wcslen
wcschr
iswspace
_vsnwprintf
memmove
_wcsnicmp
strtoul
wcscat
_itow
wcsrchr
wcscmp
_adjust_fdiv
wcsncpy
_initterm
malloc
swprintf

gdi32

CreateBitmap
GetObjectA
DeleteDC
SetBkColor
GetBkColor
SelectObject
CreateCompatibleBitmap
CreateDIBitmap
CreateCompatibleDC
CreateFontIndirectW
SelectPalette
GetTextExtentPoint32W
CreatePalette
GetObjectW
DeleteObject
SetPixel
GetDeviceCaps
BitBlt
CreateFontIndirectA
RealizePalette

wintrust

WTHelperGetKnownUsages
TrustIsCertificateSelfSigned
WintrustGetDefaultForUsage
WTHelperProvDataFromStateData
WinVerifyTrustEx
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain

advapi32

RegQueryValueExW
DuplicateToken
StartServiceA
AllocateAndInitializeSid
RegEnumKeyExW
CryptAcquireContextW
StartServiceW
OpenThreadToken
ChangeServiceConfigA
RegCreateKeyExA
FreeSid
ControlService
CryptAcquireContextA
UnlockServiceDatabase
CryptDestroyKey
RegEnumKeyExA
RegCloseKey
CloseServiceHandle
CryptSetProvParam
RegEnumValueA
GetUserNameW
RegCreateKeyExW
CryptGetProvParam
QueryServiceStatus
GetTokenInformation
OpenServiceW
RegOpenKeyExW
CryptGetKeyParam
EqualSid
CryptGetUserKey
RegQueryValueExA
RegSetValueExW
OpenSCManagerW
RegOpenKeyExA
RegQueryInfoKeyA
RegSetValueExA
LockServiceDatabase
RegEnumValueW
CryptReleaseContext
QueryServiceConfigA
OpenProcessToken

wininet

InternetCrackUrlW
InternetCanonicalizeUrlW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

rpcrt4

RpcBindingFree
RpcNetworkIsProtseqValidA
RpcEpResolveBinding
RpcStringFreeA
UuidToStringA
RpcBindingFromStringBindingA
UuidCreate
RpcStringBindingComposeA
NdrClientCall2

shlwapi

PathFindFileNameW
StrCmpNIW
PathUndecorateW

ntdll

NtAllocateVirtualMemory

netapi32

DsGetDcNameW
NetApiBufferFree
NetGetDCName

user32

SetDlgItemInt
DialogBoxParamW
SetWindowLongA
GetWindowTextW
LoadStringA
IsWindowVisible
UpdateWindow
SetCapture
SetClassLongA
GetWindowLongW
InvalidateRect
GetWindowDC
EndDialog
PostMessageW
SetWindowPos
GetDlgItem
ReleaseDC
GetNextDlgTabItem
GetWindowLongA
SetWindowTextW
BeginPaint
SystemParametersInfoA
SendMessageA
GetParent
MapWindowPoints
PeekMessageA
MapDialogRect
EndPaint
GetFocus
SetDlgItemTextW
DrawIcon
EnableWindow
GetDesktopWindow
GetSysColorBrush
GetDlgItemTextW
GetDC
MoveWindow
SendMessageW
GetDlgItemInt
IsWindowEnabled
WinHelpW
SetWindowLongW
CallWindowProcA
SetFocus
CreateWindowExA
DrawTextExW
GetDlgItemTextA
CheckRadioButton
GetSysColor
ReleaseCapture
GetWindow
GetWindowRect
CreateWindowExW
DestroyWindow
MonitorFromWindow
FillRect
ShowWindow
CopyRect
SetCursor
RegisterClipboardFormatA
LoadIconA
MessageBoxW
LoadCursorA
GetDialogBaseUnits
LoadBitmapW
IsDlgButtonChecked
PostMessageA
SetWindowTextA
MessageBoxExW
GetMonitorInfoW
SetRect
SendDlgItemMessageW
LoadCursorW
GetUpdateRect
wsprintfA
LoadStringW
DestroyIcon
SendDlgItemMessageA
DrawFocusRect
GetClientRect

kernel32

GetModuleHandleA
GetComputerNameExW
GlobalAlloc
ExpandEnvironmentStringsW
GetFileSize
SystemTimeToFileTime
InitializeCriticalSection
LoadLibraryW
GetCurrentDirectoryW
CompareStringW
GetVersionExA
FindResourceA
GlobalLock
GetCurrentProcessId
GetDateFormatA
GetUserDefaultLCID
GetCurrentProcess
Sleep
FileTimeToLocalFileTime
SetUnhandledExceptionFilter
GetCurrentThreadId
SetFilePointer
CompareStringA
GetComputerNameW
LocalAlloc
FileTimeToSystemTime
CloseHandle
LocalFree
FormatMessageW
WriteFile
lstrlenW
FreeLibrary
UnmapViewOfFile
LoadLibraryExA
GetACP
GetLocalTime
lstrcatA
InterlockedCompareExchange
GlobalUnlock
LeaveCriticalSection
OutputDebugStringA
DisableThreadLibraryCalls
DeleteCriticalSection
QueryPerformanceCounter
lstrcpyA
DeleteFileW
GetModuleFileNameW
GetTickCount
GetSystemTimeAsFileTime
GetDateFormatW
LoadResource
CreateFileW
CreateFileMappingA
SetLastError
CreateFileA
GetLastError
EnterCriticalSection
LoadLibraryA
GetTimeFormatW
TerminateProcess
lstrlenA
MulDiv
UnhandledExceptionFilter
DelayLoadFailureHook
FreeResource
GetProcAddress
GlobalFree
SetEndOfFile
GetModuleHandleW
LocalReAlloc
WideCharToMultiByte
LockResource
MapViewOfFile
CompareFileTime
MultiByteToWideChar
lstrcmpA
GetTimeFormatA
GetCurrentThread
ExpandEnvironmentStringsA

crypt32

CryptMsgEncodeAndSignCTL
CryptSIPRetrieveSubjectGuid
CryptDecodeObject
CertFindCertificateInStore
CertCreateCTLContext
CryptMsgControl
CryptGetDefaultOIDFunctionAddress
CertEnumCTLsInStore
CryptMsgDuplicate
CertCreateCertificateChainEngine
CryptFindOIDInfo
CryptFreeOIDFunctionAddress
CertFindCRLInStore
CertDuplicateStore
CertDuplicateCertificateContext
CertGetEnhancedKeyUsage
CertSaveStore
CertEnumPhysicalStore
CertFreeCRLContext
CryptFindLocalizedName
CryptBinaryToStringA
CryptMsgClose
PFXExportCertStoreEx
CryptDecodeObjectEx
CertGetCRLFromStore
CertCompareCertificate
CertNameToStrW
CertAddCertificateContextToStore
CertGetNameStringW
CryptInitOIDFunctionSet
CertFindAttribute
CertFindExtension
CertFreeCTLContext
CertCloseStore
CertGetCertificateChain
PFXVerifyPassword
CertSetCTLContextProperty
CertCreateCertificateContext
CryptAcquireCertificatePrivateKey
CryptFormatObject
CertGetSubjectCertificateFromStore
CryptMsgUpdate
CryptMsgGetParam
CertFreeCertificateChain
CertEnumCertificatesInStore
CertAddCRLContextToStore
CertGetPublicKeyLength
CryptMsgVerifyCountersignatureEncoded
CertFreeCertificateChainEngine
PFXExportCertStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertVerifyTimeValidity
CertGetStoreProperty
CryptEnumOIDInfo
CertEnumSystemStore
CertOpenStore
CryptGetDefaultOIDDllList
CryptMsgOpenToDecode
CryptFindCertificateKeyProvInfo
CryptQueryObject
CertFindCTLInStore
CertGetValidUsages
CertGetCTLContextProperty
CertSetEnhancedKeyUsage
CryptEncodeObject
CertAddCTLContextToStore
CertSetCertificateContextProperty
CertDeleteCertificateFromStore
PFXImportCertStore

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 282KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b482587320a9350346a03407727c25dd

Headers

File Characteristics

Imports

urlmon

msvcrt

gdi32

wintrust

advapi32

wininet

version

rpcrt4

shlwapi

ntdll

netapi32

user32

kernel32

crypt32

Sections

.text Size: 14KB - Virtual size: 13KB

.data Size: 282KB - Virtual size: 1.2MB

.rsrc Size: 20KB - Virtual size: 19KB

.rdata Size: 59KB - Virtual size: 59KB

.text
Size: 14KB - Virtual size: 13KB

.data
Size: 282KB - Virtual size: 1.2MB

.rsrc
Size: 20KB - Virtual size: 19KB

.rdata
Size: 59KB - Virtual size: 59KB