c9098c53d0313a260528bb814e0c20b9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c9098c53d0313a260528bb814e0c20b9_JaffaCakes118
Size

2.6MB
MD5

c9098c53d0313a260528bb814e0c20b9
SHA1

494537d673e641d66ce84235e7c57253d62c9655
SHA256

633938acf69fca433dd3283c00d3df35c9d8c1b0810a20ed08de2a757ee40465
SHA512

0d6a9052273e40623255ccb3e269c6e706636c452d83f0be619d1c537aeda87b276a8e1720671b0f1ced2f871a55e374f202fc90eb196bbec7079480a0b36397
SSDEEP

49152:tz7YfeRg7dnWbbci4+dtqOYm3jFayudmYj3OOtjNWLmapsB+WGV35DwC8z90hJ+c:tjg7dnWb94+dIRWLmapsZ0h

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c9098c53d0313a260528bb814e0c20b9_JaffaCakes118

Files

c9098c53d0313a260528bb814e0c20b9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0030b36d8031cb2fca7c870c5b95b475

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

StartServiceCtrlDispatcherA
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegSetValueExW
RegSetValueExA
RegEnumKeyExA
RegEnumValueA
RegQueryValueExA
RegQueryValueExW
RegDeleteValueA
RegQueryInfoKeyA
RegOpenKeyExA
SetServiceStatus
RegisterServiceCtrlHandlerA

kernel32

ExitProcess
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
GetModuleFileNameW
GetModuleHandleA
GetModuleFileNameA
GetTickCount
GetSystemTime
GetDateFormatA
GetTimeFormatA
FileTimeToSystemTime
SystemTimeToFileTime
CompareFileTime
GetCommProperties
CreateEventA
CreateFileA
GetLastError
SetCommTimeouts
GetCommState
SetCommState
EscapeCommFunction
CloseHandle
ClearCommError
ReadFile
ResetEvent
WaitForSingleObject
GetOverlappedResult
WriteFile
GetCommModemStatus
SetCommBreak
ClearCommBreak
LoadLibraryA
GetProcAddress
GlobalAlloc
GlobalFree
_lopen
_llseek
_lread
_lclose
FindResourceA
LoadResource
LockResource
CreateFileW
SetFilePointer
VirtualAlloc
OutputDebugStringA
GetUserDefaultLangID
CompareStringA
IsDBCSLeadByteEx
GetStringTypeExA
GetLocaleInfoA
CompareStringW
LoadLibraryW
DeleteFileW
DeleteFileA
GetACP
MultiByteToWideChar
WideCharToMultiByte
GetVersionExA
GetLocaleInfoW
FreeLibrary
FindFirstFileW
FindNextFileW
FindClose
FindFirstFileA
FindNextFileA
GetFileAttributesW
GetFileAttributesA
GetLogicalDriveStringsA
MoveFileW
MoveFileA
SetFileAttributesW
SetFileAttributesA
SetFileTime
GetTempPathW
GetTempPathA
GetWindowsDirectoryW
GetWindowsDirectoryA
GetSystemDirectoryW
GetSystemDirectoryA
RemoveDirectoryW
RemoveDirectoryA
SetCurrentDirectoryA
CopyFileW
CopyFileA
CreateDirectoryW
CreateDirectoryA
GetShortPathNameW
GetShortPathNameA
GetLogicalDrives
GetTempFileNameW
GetTempFileNameA
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
IsBadReadPtr
Sleep
IsValidCodePage
GetCommandLineW
GetCommandLineA
GetEnvironmentVariableA
GetEnvironmentVariableW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetFileSize
SetEndOfFile
FlushFileBuffers
GetTimeZoneInformation
GetLocalTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
VirtualFree
VirtualProtect
GetProcessHeap
HeapAlloc
HeapFree
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
GetCurrentProcess
DuplicateHandle
GetStdHandle
RtlUnwind
GetEnvironmentStrings
FreeEnvironmentStringsA

oleaut32

SysAllocString
SysFreeString

shell32

ShellExecuteW
ShellExecuteA
SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetPathFromIDListA
SHGetDesktopFolder
Shell_NotifyIconA

user32

GetAsyncKeyState
wsprintfA
MessageBeep
GetSysColor
SetFocus
GetWindowLongA
DefWindowProcA
KillTimer
CreateWindowExA
SetWindowLongA
RegisterClassA
SetTimer
PeekMessageA
TranslateMessage
DispatchMessageA
DestroyWindow
IsWindowVisible
ShowWindow
GetCursorPos
ScreenToClient
SetCapture
ReleaseCapture
CharUpperBuffA
CharLowerBuffA
MessageBoxA
SetRect
ClientToScreen
CreateWindowExW
GetClassNameA
OffsetRect
ScrollWindow
InvalidateRect
SendMessageA
GetSystemMetrics
ValidateRect
DragDetect
MoveWindow
SetParent
SetWindowPos
RedrawWindow
GetDC
ReleaseDC
SetForegroundWindow
EnumWindows
SetWindowLongW
MapVirtualKeyA
GetKeyNameTextW
GetKeyNameTextA
CreateIconIndirect
LoadIconA
DestroyIcon

ole32

OleInitialize
CoInitialize
CoCreateInstance
CoUninitialize

Exports

Exports

AddTrayItem
AppAutoCloseGetter
AppAutoCloseSetter
AppBalloonHelpVisibleGetter
AppBalloonHelpVisibleSetter
AppFolderItemGetter
AppGetCurrentEventTime
AppIntegerVersionStuffGetter
AppMenuBarGetter
AppMenuBarSetter
AppSleepCurrentThread
AppStringVersionStuffGetter
AppendStyledTextRun
ApplicationAddMenuHandler
ApplicationAddPollableObject
ApplicationDoSingleEvent
ApplicationFinalizer
ApplicationInitializer
ApplicationNewDocument
ApplicationOpenDocument
ApplicationQuit
ApplicationRemoveAllPollableObjects
ApplicationRemovePollableObject
AutoInitDate
BinaryStreamClose
BinaryStreamDestructor
BinaryStreamEOF
BinaryStreamFlush
BinaryStreamGetLength
BinaryStreamGetPosition
BinaryStreamHandleCtor
BinaryStreamHandleGetter
BinaryStreamInitializer
BinaryStreamLastErrorGetter
BinaryStreamRead
BinaryStreamReadBoolean
BinaryStreamReadByte
BinaryStreamReadDouble
BinaryStreamReadFloat
BinaryStreamReadInt16
BinaryStreamReadInt64
BinaryStreamReadInt8
BinaryStreamReadLong
BinaryStreamReadPString
BinaryStreamReadShort
BinaryStreamReadUInt16
BinaryStreamReadUInt32
BinaryStreamReadUInt64
BinaryStreamReadUInt8
BinaryStreamSetLength
BinaryStreamSetPosition
BinaryStreamWrite
BinaryStreamWriteBoolean
BinaryStreamWriteByte
BinaryStreamWriteDouble
BinaryStreamWriteFloat
BinaryStreamWriteInt16
BinaryStreamWriteInt64
BinaryStreamWriteInt8
BinaryStreamWriteLong
BinaryStreamWritePString
BinaryStreamWriteShort
BinaryStreamWriteUInt16
BinaryStreamWriteUInt32
BinaryStreamWriteUInt64
BinaryStreamWriteUInt8
BinaryStringMemoryBlockCtor
BinaryStringStringCtor
BitwiseAnd
BitwiseOr
BitwiseXor
BlowfishDecipher
BlowfishDecipherByBlock
BlowfishEncipher
BlowfishEncipherByBlock
BlowfishInitialize
BooleanToVariant
ColorToVariant
ConsoleApplicationInitializer
ConvertObjectToBoolean
ConvertObjectToColor
ConvertObjectToDate
ConvertObjectToDouble
ConvertObjectToInt32
ConvertObjectToInt64
ConvertObjectToSingle
ConvertObjectToString
ConvertObjectToUInt32
ConvertObjectToUInt64
ConvertPtrToMemoryBlock
ConvertStringToWin32KeyCode
ConvertToWin32KeyCode
CreateApplicationClass
CreateArray
CreateControlClasses
CreateInstance
CriticalSectionFinalizer
CriticalSectionInitializer
CriticalSection_TryEnter
CursorFieldBooleanValueGetter
CursorFieldBooleanValueSetter
CursorFieldConvertToBoolean
CursorFieldConvertToDate
CursorFieldConvertToDouble
CursorFieldConvertToInteger
CursorFieldConvertToString
CursorFieldValueGetter
CursorFieldValueSetter
CursorMoveFirst
CursorMoveLast
CursorMovePrev
CustomControlConstructor
CustomControlCreatePane
CustomControlDestructor
DaemonizeApp
DatabaseConnect
DatabaseConstructor
DateCompare
DateFinalizer
DateToVariant
DebugBreakASAP
DebugRuntimeInit
DecodeBackslashEscape
DecodeBackslashEscapeString
DesignAddDataSource
DictionaryLookup
DisableAutoWaitCursor
DoubleToVariant
EnableAutoWaitCursor
EncodeBackslashEscape
EncodeBackslashEscapeString
EncodingsGetFromCode
EncodingsGetter
FPToInt
FileDisplayNameGetter
FileExtensionVisibleGetter
FileExtensionVisibleSetter
FileShellPathGetter
FileURLGetter
FillSpawnTypeTable
FireApplicationCancelCloseEvent
FireLineChangedEvent
FireSerialError
FireTrayItemActionEvent
FolderChild
FolderItemAppendTextFile
FolderItemCopyCtor
FolderItemCopyFileTo
FolderItemCreateAsFolder
FolderItemCreateBinaryFile
FolderItemCreateTextFile
FolderItemCreateVirtualVolume
FolderItemDelete
FolderItemDestructor
FolderItemFromPath
FolderItemGetImp
FolderItemGetLastError
FolderItemGetPermissions
FolderItemGetRelative
FolderItemGetSaveInfo
FolderItemGroupGetter
FolderItemGroupSetter
FolderItemImpMakeFileExecutable
FolderItemIsCurrentlyReadable
FolderItemIsCurrentlyWriteable
FolderItemItem
FolderItemLaunch
FolderItemLaunchWithParameters
FolderItemMoveFileTo
FolderItemOpenAsVirtualVolume
FolderItemOpenBinaryFile
FolderItemOpenJPEG
FolderItemOpenTextFile
FolderItemOwnerGetter
FolderItemOwnerSetter
FolderItemPathCtor
FolderItemPathCtorNoParams
FolderItemSaveAsJPEG
FolderItemSaveAsPicture
FolderItemSetLastError
FolderItemSetPermissionsClass
FolderItemSetPermissionsInteger
FolderItemTrueItem
FolderTrueChild
GetControlHWND
GetControlVisible
GetDatabaseRecordBlobColumn
GetDatabaseRecordBooleanColumn
GetDisabledTextColor
GetDocumentsFolder
GetEncodingFromTEObject
GetEncodingObjectFromCode
GetEncodingsObject
GetEventInstance
GetIDERegistryKey
GetInterfaceRoutine
GetMacInputDriverRef
GetMacOutputDriverRef
GetNetworkInterfaceObject
GetPosixDescriptor
GetSpecialFolder
GetSpecialFolderFromCode
GetTabPanelVisible
GetWin32DriverHandle
GlobalShowURL
HasMultipleThreads
HasSerialControls
IPCSocketBytesAvailable
IPCSocketBytesLeftToSend
IPCSocketClose
IPCSocketConnect
IPCSocketEOF
IPCSocketFinalizer
IPCSocketFlush
IPCSocketGetHandle
IPCSocketHadError
IPCSocketInitializer
IPCSocketIsConnected
IPCSocketLastErrorGetter
IPCSocketListen
IPCSocketLookahead
IPCSocketPoll
IPCSocketRead
IPCSocketReadAll
IPCSocketWrite
InsertStyledTextRun
Int32ToVariant
Int64ToVariant
IntToFP
IsCMMClick
IsFunctionAvailable
IsNull
LineStateGetter
LineStateSetter
LoadFunctionPointerFromLibrary
LoadPlugins
LockCFString
LockWString
LookupObjectDefinition
MacNonIDEIntVer
MacNonIDEStringVer
MemoryBlockAddOperator
MemoryBlockCompareOperator
MemoryBlockFinalizer
MemoryBlockFromStringOperator
MemoryBlockInitializer
MemoryBlockLeftB
MemoryBlockMidB2
MemoryBlockMidB3
MemoryBlockRightB
MemoryBlockToStringOperator
MutexContructor
MutexFinalizer
MutexInitializer
MutexLock
MutexTryLock
MutexUnlock
NetIdle
NetworkInterfaceCtor
NetworkLookupDNSAddress
NetworkLookupIPAddress
NetworkSafeToConnect
NetworkWakeOnLAN
NilCreatePane
OLEObjectConstructor
OLEObjectDestructor
OLEObjectInvoke
OLEObjectInvokeNoReturnValue
OLEObjectInvokeWithParams
OLEObjectInvokeWithParamsNoReturnValue
OLEObjectNewInstanceConstructor
OLEObjectNoReturnOperatorLookup
OLEObjectOperatorAdd
OLEObjectOperatorAddRight
OLEObjectOperatorAnd
OLEObjectOperatorCompare
OLEObjectOperatorConvert
OLEObjectOperatorDivide
OLEObjectOperatorDivideRight
OLEObjectOperatorIntegerDivide
OLEObjectOperatorIntegerDivideRight
OLEObjectOperatorLookup
OLEObjectOperatorLookupSetterWithParameters
OLEObjectOperatorModulo
OLEObjectOperatorModuloRight
OLEObjectOperatorMultiply
OLEObjectOperatorMultiplyRight
OLEObjectOperatorNegate
OLEObjectOperatorNot
OLEObjectOperatorOr
OLEObjectOperatorSubtract
OLEObjectOperatorSubtractRight
OLEObjectProgramIDConstructor
OLEObjectPropertyArrayGetter
OLEObjectPropertyGetter
OLEObjectPropertySetter
OLEObjectPropertySetterWithParameters
OLEObjectPropertySetterWithValue
OLEObjectTypeName
OLEParameterDestructor
OLEParameterValueArraySetter
OLEParameterValueGetter
OLEParameterValueSetter
ObjectToVariant
PacketsAvailableGetter
PermissionsCtor
PermissionsGetter
PermissionsInitializer
PermissionsSetter
PluginDefaultControlCaption
PluginDefaultControlFont
PluginDefaultControlFontSize
PluginGetControlBounds
PluginInterpretConstantValue
PluginMarkSocketUsage
PluginNewInstance
PluginNewOfSameClass
PluginRegisterClass
PluginRegisterClassExtension
PluginRegisterControl
PluginRegisterDBCursor
PluginRegisterDBEngine
PluginRegisterInterface
PluginRegisterMethod
PluginRegisterModule
PluginSetDelegateResolver
PtrToMemoryBlock
QTInstalledGetter
RB_ApplicationQuit
REALBuildPictureFromBuffer
REALBuildPictureFromDIB
REALBuildPictureFromGWorld
REALBuildPictureFromPictureDescription
REALBuildString
REALConstructDBDatabase
REALConvertString
REALCountClassMethods
REALCountClassProperties
REALDBConnectionDialogAddField
REALDBConnectionDialogCreate
REALDBConnectionDialogDelete
REALDBConnectionDialogShow
REALDatabaseConnect
REALDatabaseConstructor
REALDatabaseCreateDatabaseFile
REALDatabaseDestructor
REALDatabaseFolderItemGetter
REALDatabaseFolderItemSetter
REALDatabaseSetError
REALGetClassMethod
REALGetClassProperty
REALGetCommandLineForUnix
REALGetControlEnabled
REALGetControlFocus
REALGetControlGraphics
REALGetControlGraphicsWithDC
REALGetControlHandle
REALGetControlName
REALGetControlParent
REALGetCurrentThread
REALGetCursorFromREALdbCursor
REALGetDBDatabaseName
REALGetDBFromREALdbDatabase
REALGetDBHost
REALGetDBPassword
REALGetDBUserName
REALGetFontEncoding
REALGetGraphicsFontStyle
REALGetGraphicsOrigin
REALGetPictureMask
REALGetProjectFolder
REALGetPropValueBool
REALGetPropValueDouble
REALGetPropValueInt
REALGetPropValueObject
REALGetPropValueString
REALGetRBVersion
REALGetStringEncoding
REALGetWin32Charset
REALGetWindowHandle
REALGraphicsDC
REALInDebugMode
REALInvalidateControl
REALInvalidateControlRect
REALIsHIViewWindow
REALLoadGlobalMethod
REALLoadObjectMethod
REALLockObject
REALLockPictureDescription
REALLockString
REALPictureClearCache
REALSetAccelerator
REALSetControlFocus
REALSetDBIsConnected
REALSetGraphicsOrigin
REALSetGraphicsStyle
REALSetMovieMovie
REALSetPropValueBoolean
REALSetPropValueDouble
REALSetPropValueInt
REALSetPropValueObject
REALSetPropValueString
REALSetSpecialBackground
REALSetStringEncoding
REALStripAmpersands
REALUnlockObject
REALUnlockString
REALYieldToRB
REALdbDatabaseFromDBDatabase
REALenterMovies
REALinRuntime
REALpathFromFolderItem
RaiseExceptionClass
RaiseIllegalCastException
RaiseNilObjectException
RaiseOutOfBoundsException
RandomConstructor
RandomGaussian
RandomNumber
RandomNumberInRangeMinMax
RandomNumberLessThan
RandomSeedSetter
RandomizeSeed
RangeEndPosGetter
RecordSetColumnType
RecordSetRecordCount
RectControlDefaultConstructor
RegisterDataSource
RegisterDataSourceInterface
RegisterPluginVersion
RegistryItemAddFolder
RegistryItemChild
RegistryItemCopyCtor
RegistryItemDefaultValueGetter
RegistryItemDefaultValueSetter
RegistryItemDelete
RegistryItemDestructor
RegistryItemFolderCountGetter
RegistryItemItem
RegistryItemKeyCountGetter
RegistryItemKeyTypeGetter
RegistryItemNameGetter
RegistryItemNumValueGetter
RegistryItemNumValueSetter
RegistryItemPathCtor
RegistryItemPathGetter
RegistryItemValueGetter
RegistryItemValueSetter
RegistryParentGetter
RemoteDebuggerStartup
RemoveStyledTextRun
RemoveTrayItem
ResourceForkDestructor
RunFireSerial
RunningThreadCount
RuntimeACos
RuntimeASin
RuntimeATan
RuntimeATan2
RuntimeAbs
RuntimeAddIntegerScriptParam
RuntimeAddString
RuntimeAddStringScriptParam
RuntimeAllocatePluginEntrypointsTable
RuntimeBackgroundTask
RuntimeBeep
RuntimeBin
RuntimeBinDouble
RuntimeBinInt16
RuntimeBinInt64
RuntimeBinInt8
RuntimeBinSingle
RuntimeBinUInt16
RuntimeBinUInt32
RuntimeBinUInt64
RuntimeBinUInt8
RuntimeBinVariant
RuntimeBitwiseAnd
RuntimeBitwiseOr
RuntimeBitwiseShiftLeft
RuntimeBitwiseShiftRight
RuntimeBitwiseXor
RuntimeCMY
RuntimeCeil
RuntimeCheckCast
RuntimeClassOf
RuntimeCloneMenu
RuntimeCloseWindow
RuntimeCompleteParamScriptExecute
RuntimeCompleteParamScriptFunction
RuntimeConsoleInput
RuntimeConsoleInputAmount
RuntimeConsolePrint
RuntimeConsolePrintError
RuntimeControlArrayItemReference
RuntimeControlDefaultHeight
RuntimeControlDrawInto
RuntimeControlFetch
RuntimeControlMove
RuntimeControlReference

Sections

.text
Size: 895KB - Virtual size: 894KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.exc
Size: 512B - Virtual size: 340B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 380KB - Virtual size: 379KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 95KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0030b36d8031cb2fca7c870c5b95b475

Headers

File Characteristics

Imports

advapi32

kernel32

oleaut32

shell32

user32

ole32

Exports

Exports

Sections

.text Size: 895KB - Virtual size: 894KB

.rdata Size: 9KB - Virtual size: 8KB

.exc Size: 512B - Virtual size: 340B

.data Size: 380KB - Virtual size: 379KB

.CRT Size: 512B - Virtual size: 100B

.rsrc Size: 26KB - Virtual size: 26KB

.idata Size: 6KB - Virtual size: 5KB

.bss Size: - Virtual size: 95KB

.edata Size: 42KB - Virtual size: 42KB

.reloc Size: 56KB - Virtual size: 55KB

.text
Size: 895KB - Virtual size: 894KB

.rdata
Size: 9KB - Virtual size: 8KB

.exc
Size: 512B - Virtual size: 340B

.data
Size: 380KB - Virtual size: 379KB

.CRT
Size: 512B - Virtual size: 100B

.rsrc
Size: 26KB - Virtual size: 26KB

.idata
Size: 6KB - Virtual size: 5KB

.bss
Size: - Virtual size: 95KB

.edata
Size: 42KB - Virtual size: 42KB

.reloc
Size: 56KB - Virtual size: 55KB