ceb2a6fc5b2f70547cb129037935c37d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ceb2a6fc5b2f70547cb129037935c37d_JaffaCakes118
Size

1.3MB
MD5

ceb2a6fc5b2f70547cb129037935c37d
SHA1

d6d329718d4b6041d6aecfb721289039c78bed9c
SHA256

8f15717b25b411a3ec4b976358c5974aac5f2335b6fcb971959e04d7e757594c
SHA512

94c10f5746a37ab12703641d06125d8363b57432ccf9dc082a1876ce8d1e0ff133a829e0c7dac879dd333c1d0e625bafa0c991b81349031eb57ff0887da680bd
SSDEEP

24576:3VHzkXkgVao8aFmNlblLet8zMC1Csa+EakmBalVeOipTMwNa:faFmNTLR1CxqJgVeOAa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ceb2a6fc5b2f70547cb129037935c37d_JaffaCakes118

Files

ceb2a6fc5b2f70547cb129037935c37d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

ecd878d9fe6e9f967b18667af5851697

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

cancelautoplay

RegisterCancelAutoPlayHook
UnregisterCancelAutoPlayHook
CancelDriveType

libjpegdll

ord41
ord51
ord4
ord21
ord43
ord1
ord3
ord48
ord52
ord42
ord53
ord23
ord2
ord5
ord30
ord29
ord28
ord38
ord27
ord39

mfc90u

ord1810
ord1809
ord1675
ord3353
ord6408
ord1492
ord4664
ord5653
ord4682
ord799
ord4631
ord5167
ord4774
ord2904
ord6275
ord2596
ord5008
ord1938
ord778
ord595
ord797
ord3654
ord4681
ord4910
ord4348
ord2891
ord4071
ord4081
ord4080
ord3286
ord2764
ord2893
ord2774
ord3140
ord2966
ord4728
ord3112
ord2983
ord2771
ord5650
ord1727
ord1791
ord1792
ord2139
ord5625
ord1442
ord3226
ord6376
ord5404
ord2208
ord6804
ord4174
ord6802
ord1641
ord2368
ord2375
ord2630
ord2612
ord2610
ord2628
ord2640
ord2617
ord2633
ord2638
ord2621
ord2623
ord2625
ord2619
ord2635
ord2615
ord971
ord967
ord969
ord965
ord960
ord5683
ord5685
ord6466
ord1728
ord4702
ord5154
ord3743
ord5664
ord4603
ord6800
ord5324
ord5632
ord6579
ord1137
ord3794
ord374
ord639
ord4000
ord2364
ord2069
ord2593
ord3537
ord1183
ord2537
ord600
ord296
ord2106
ord3543
ord1354
ord2592
ord4131
ord6065
ord3741
ord4527
ord2597
ord4543
ord2909
ord813
ord6273
ord2274
ord1665
ord4652
ord3489
ord611
ord2360
ord6577
ord367
ord636
ord1353
ord1108
ord6604
ord524
ord744
ord5182
ord1119
ord3456
ord280
ord3515
ord3220
ord285
ord1607
ord2103
ord1601
ord4510
ord2277
ord1667
ord4654
ord3496
ord615
ord3528
ord654
ord4130
ord4398
ord4978
ord3953
ord4044
ord2431
ord5512
ord2074
ord5602
ord4660
ord1493
ord4345
ord1751
ord1754
ord6411
ord3355
ord1719
ord2283
ord801
ord2470
ord5194
ord5387
ord341
ord617
ord2326
ord5572
ord4043
ord589
ord794
ord4211
ord1098
ord5567
ord2447
ord3670
ord4905
ord3115
ord6018
ord5663
ord5680
ord4996
ord4347
ord5676
ord5674
ord3217
ord2087
ord4213
ord5830
ord6741
ord5548
ord1048
ord4179
ord6035
ord2206
ord2251
ord4747
ord6803
ord4173
ord6801
ord4423
ord4448
ord3589
ord1272
ord5573
ord1603
ord1599
ord3933
ord2141
ord3906
ord1779
ord1708
ord750
ord811
ord286
ord4405
ord2479
ord899
ord265
ord266
ord3768
ord5322
ord1109
ord3682

msvcr90

__RTDynamicCast
__CxxFrameHandler3
floor
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
_except_handler4_common
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
memset
_CxxThrowException
modf
_strnicmp
_wunlink
strncmp
_wtoi64
wcsspn
_wtof
wcspbrk
localeconv
isleadbyte
toupper
islower
_wstat64
towupper
iswlower
strcpy_s
_close
_wsopen_s
isalpha
_errno
_wmkdir
_localtime64_s
ceil
_set_sbh_threshold
_get_heap_handle
_beginthreadex
setlocale
_time64
realloc
wcsstr
wcschr
_mbsicmp
_mbscmp
_mbsnbcpy_s
wcsrchr
calloc
wcscpy_s
_snwprintf_s
malloc
_vsnwprintf_s
_wtoi
_wcsnicmp
swscanf_s
_wcsdup
free
swscanf
wcsncpy_s
_purecall
memcpy_s
memmove_s
_wcsicmp
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
memcpy

kernel32

GetDriveTypeW
GetLogicalDrives
SetThreadExecutionState
InterlockedDecrement
GetLongPathNameW
GetTickCount
GetModuleFileNameW
Sleep
GetCurrentThreadId
IsDebuggerPresent
UnhandledExceptionFilter
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
RaiseException
LocalAlloc
GetMailslotInfo
CreateMailslotW
GetProcessHeap
HeapFree
MulDiv
GlobalAlloc
GlobalUnlock
GlobalLock
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
GetFileSize
SetEndOfFile
SetFileTime
SetFilePointer
GetStdHandle
GetCurrentProcess
DuplicateHandle
CreatePipe
WriteFile
ReadFile
GetDiskFreeSpaceW
GetDiskFreeSpaceExW
FindNextFileW
SetErrorMode
CreateFileA
GetVersion
LoadLibraryExW
LocalFileTimeToFileTime
SystemTimeToFileTime
OutputDebugStringW
GetModuleHandleW
SizeofResource
LockResource
LoadResource
FindResourceW
RemoveDirectoryW
DeleteFileW
SetFileAttributesW
GetFileAttributesW
CopyFileW
MoveFileWithProgressW
MoveFileW
MoveFileExW
FindClose
FindFirstFileW
SetThreadPriority
GetThreadPriority
GetExitCodeThread
PulseEvent
ResetEvent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetVersionExW
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryW
WideCharToMultiByte
MultiByteToWideChar
GetACP
GetTempPathW
DeviceIoControl
ReleaseMutex
WaitForSingleObject
SetEvent
CreateEventW
CreateFileW
GetCurrentProcessId
CreateProcessW
GetSystemPowerStatus
InterlockedExchange
TerminateProcess
GetVolumeInformationW
LoadLibraryA
GetProcAddress
ExpandEnvironmentStringsA
GetLastError
CreateMutexW
CloseHandle
InterlockedIncrement

user32

IntersectRect
EndDeferWindowPos
DeferWindowPos
EqualRect
GetIconInfo
DrawIcon
GetWindow
GetClassNameW
ReleaseDC
GetWindowRect
GetDC
AnimateWindow
LoadIconW
SendMessageW
EnableMenuItem
GetSystemMenu
BeginDeferWindowPos
GetDesktopWindow
LoadImageW
GetSystemMetrics
SetTimer
GetWindowThreadProcessId
GetForegroundWindow
AttachThreadInput
SetForegroundWindow
KillTimer
IsIconic
GetClientRect
wsprintfA
SetClipboardData
EmptyClipboard
CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
RegisterWindowMessageW
GetMessageW
UnregisterDeviceNotification
RegisterDeviceNotificationW
PostQuitMessage
UnregisterClassW
DestroyWindow
DefWindowProcW
ShowWindow
SetWindowLongW
CreateWindowExW
RegisterClassExW
LoadCursorW
GetDlgCtrlID
GetWindowLongW
PtInRect
GetActiveWindow
SetWindowTextW
IsWindowVisible
GetLastActivePopup
GetSysColor
InvalidateRect
GetPropW
RemovePropW
SetPropW
DispatchMessageW
TranslateMessage
PeekMessageW
PostMessageW
SetFocus
IsWindow
GetFocus
EnableWindow

gdi32

CreateFontIndirectW
CreateCompatibleDC
SelectObject
DeleteObject
BitBlt
CreateDIBSection
DeleteDC
GetObjectW

advapi32

RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegEnumKeyExW

shell32

SHFileOperationW
SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetFolderLocation
ord2
ord4
SHGetDesktopFolder
SHGetMalloc

comctl32

_TrackMouseEvent
ord17

shlwapi

PathGetDriveNumberW
StrCmpIW
StrRetToStrW
StrFromTimeIntervalW
PathAddBackslashW
PathRemoveBackslashW
PathIsRootW
PathIsNetworkPathW
PathIsDirectoryW
StrFormatByteSizeW
PathStripToRootW

ole32

CoTaskMemFree
StringFromGUID2
CoCreateGuid
CoUninitialize
CoCreateInstance
CoInitialize

oleaut32

VariantClear
SysFreeString
SysAllocString
SysStringByteLen

msvcp90

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Sections

.text
Size: 536KB - Virtual size: 536KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 646KB - Virtual size: 646KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ecd878d9fe6e9f967b18667af5851697

Headers

DLL Characteristics

File Characteristics

Imports

cancelautoplay

libjpegdll

mfc90u

msvcr90

kernel32

user32

gdi32

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

msvcp90

version

Sections

.text Size: 536KB - Virtual size: 536KB

.rdata Size: 646KB - Virtual size: 646KB

.data Size: 11KB - Virtual size: 12KB

.rsrc Size: 125KB - Virtual size: 125KB

.reloc Size: 48KB - Virtual size: 48KB

.text
Size: 536KB - Virtual size: 536KB

.rdata
Size: 646KB - Virtual size: 646KB

.data
Size: 11KB - Virtual size: 12KB

.rsrc
Size: 125KB - Virtual size: 125KB

.reloc
Size: 48KB - Virtual size: 48KB