cb47db092132c66ed0ed6d705cacd72c_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

cb47db092132c66ed0ed6d705cacd72c_JaffaCakes118
Size

362KB
MD5

cb47db092132c66ed0ed6d705cacd72c
SHA1

884cdfb481b5f38485d7844b015728665eedcc51
SHA256

f52720305e8cd88c48de5eecd5965983d48693e4c693e3f82cfa48f1f2edfd78
SHA512

84b58ff20a057ac4804f7bc2e170c9bfc14227a36bd1b02d738a36c5baf39e478f7fa34718ddce9a760d1e8d0c59442a33b4664d9ea0252ac254e30c67f7a18e
SSDEEP

6144:up2jrNSfUetDI1LdsVifhSMQ35HpYHYpOPYN8v:y2/NyUeJI1LdsHMQpHp9UYN8v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cb47db092132c66ed0ed6d705cacd72c_JaffaCakes118

Files

cb47db092132c66ed0ed6d705cacd72c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

725ee6d002775373bb7204ece8e861b6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\acetne\Transformationa.pdb

Imports

kernel32

HeapSize
FlushFileBuffers
CreateFileA
CreateProcessA
GetExitCodeProcess
SetFilePointer
WriteConsoleW
Sleep
GetStringTypeW
MultiByteToWideChar
LCMapStringW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
DeleteCriticalSection
RtlUnwind
HeapReAlloc
CreateFileW
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
lstrcpyA
LocalFree
CloseHandle
CreateToolhelp32Snapshot
lstrcmpiW
WTSGetActiveConsoleSessionId
LocalAlloc
ProcessIdToSessionId
Process32Next
GetFileAttributesA
GetStdHandle
LoadLibraryA
GetLocalTime
GetProcAddress
GetLastError
lstrcatA
GetModuleFileNameW
GetConsoleWindow
CreateEventA
LoadLibraryW
WideCharToMultiByte
FindResourceExA
OpenProcess
GetUserDefaultLangID
EnumTimeFormatsA
HeapCreate
IsProcessorFeaturePresent
GetConsoleMode
GetConsoleCP
WriteFile
GetFileType
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
SetStdHandle
ReadFile
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
FormatMessageA
GetProcessHeap
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
WaitForSingleObject
Process32First
HeapFree
HeapAlloc
CreateProcessW
LoadResource
FindResourceExW
TerminateProcess
RaiseException
GetStartupInfoW
HeapSetInformation
GetCommandLineA
DecodePointer
ExitProcess
GetModuleHandleW
DeleteFileA

user32

GetCursorPos
SetWindowPos
GetDesktopWindow
EnableMenuItem
GetClassNameW
SetScrollPos
DrawFrameControl
SetDlgItemTextA
GetWindowThreadProcessId
GetWindow
SendMessageW
ShowWindow
SystemParametersInfoA
PostMessageA
IsWindow
SetMenu
GetWindowLongA
MessageBoxA
EnumDisplaySettingsExA
CreateDialogParamA
InsertMenuItemA
GetWindowDC
LoadBitmapA
IsClipboardFormatAvailable
GetParent
IsWindowEnabled
FindWindowExA
FindWindowW
GetMenuCheckMarkDimensions
SendMessageA
GetDC
GetForegroundWindow
SetWindowLongA

gdi32

SetWindowExtEx
CreateDIBSection
SetBrushOrgEx
GetCurrentObject
CreateDCA
GetTextCharsetInfo
DeleteObject
SelectObject
SetMapMode
SetStretchBltMode
SetTextJustification
GetObjectA
GetStockObject

winspool.drv

EnumPrintersA

advapi32

RegConnectRegistryA
OpenProcessToken
ConvertSidToStringSidA
GetUserNameW
GetTokenInformation
RegSetValueExA
RegQueryValueExA
SetTokenInformation
RegOpenKeyExA
RegCloseKey
CreateProcessAsUserA
AdjustTokenPrivileges
DuplicateTokenEx

ole32

CoInitializeEx
StringFromGUID2
CoUninitialize
CoCreateInstance

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime
UnRegisterTypeLi

odbc32

ord9

ws2_32

send
recv
WSAStartup

netapi32

DsRoleGetPrimaryDomainInformation
NetApiBufferFree
NetUserGetInfo
NetShareGetInfo

psapi

EnumProcesses
GetModuleFileNameExA

userenv

CreateEnvironmentBlock

avifil32

AVIMakeCompressedStream

msacm32

acmDriverClose

shlwapi

PathCanonicalizeA
PathCombineA

comctl32

ImageList_SetOverlayImage
ImageList_AddMasked
ord236
ImageList_Create
ord410
ord412

winhttp

WinHttpOpen

setupapi

SetupDeleteErrorA

wtsapi32

WTSEnumerateSessionsA
WTSQueryUserToken

dxva2

GetNumberOfPhysicalMonitorsFromHMONITOR

Sections

.text
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 199KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

725ee6d002775373bb7204ece8e861b6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

ole32

oleaut32

odbc32

ws2_32

netapi32

psapi

userenv

avifil32

msacm32

shlwapi

comctl32

winhttp

setupapi

wtsapi32

dxva2

Sections

.text Size: 124KB - Virtual size: 124KB

.rdata Size: 32KB - Virtual size: 32KB

.data Size: 5KB - Virtual size: 12KB

.rsrc Size: 199KB - Virtual size: 198KB

.text
Size: 124KB - Virtual size: 124KB

.rdata
Size: 32KB - Virtual size: 32KB

.data
Size: 5KB - Virtual size: 12KB

.rsrc
Size: 199KB - Virtual size: 198KB