cf5d35b54715e58f4a457dd19ded11de_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

cf5d35b54715e58f4a457dd19ded11de_JaffaCakes118
Size

384KB
MD5

cf5d35b54715e58f4a457dd19ded11de
SHA1

14373eb5ccd8282ebc3174ab039d3c925d24c850
SHA256

f7722e7016aa8dc4fcb02e65c0cb0acca0b65c48b22e0011da00838eee704466
SHA512

d2dc446c494896f06c2ee8873d52eec3b8b70dc4e1a1b8a1a407eb38730f8493a119a6dc1acd9fec3be861a56a79fa201ef19df86b83eb9a8820ca419ed5f3be
SSDEEP

6144:ficVQfJ8tDBMCpPGjxOOWkxzj7Mo4e9CTbcmZ1Z2eOrfZSPcFgkq2:fio4JsMdkOWkxzjwo4e9beOrxKcB5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf5d35b54715e58f4a457dd19ded11de_JaffaCakes118

Files

cf5d35b54715e58f4a457dd19ded11de_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bdf6c6da11caffa99fb7c598c0e98c2f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetCrackUrlA
InternetConnectA
InternetReadFile
HttpSendRequestA
InternetAutodial
HttpQueryInfoA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetGetConnectedState
InternetOpenUrlA
InternetCloseHandle
InternetOpenA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

winmm

PlaySoundA

ws2_32

gethostname
WSAStartup
WSACleanup
inet_ntoa
gethostbyname

shlwapi

PathFileExistsA

mfc42

ord2370
ord2302
ord4234
ord4853
ord4710
ord825
ord922
ord755
ord640
ord6197
ord6379
ord323
ord470
ord5875
ord537
ord2244
ord4476
ord3573
ord3626
ord3663
ord1641
ord3619
ord2860
ord3706
ord1640
ord5785
ord2859
ord2379
ord823
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord4424
ord3738
ord561
ord815
ord2614
ord924
ord926
ord1106
ord5943
ord6438
ord2621
ord1134
ord1200
ord6779
ord4129
ord2725
ord535
ord2818
ord941
ord5710
ord4277
ord5683
ord5572
ord2919
ord801
ord541
ord6143
ord2915
ord939
ord2393
ord5583
ord4202
ord6283
ord6282
ord1158
ord2764
ord6877
ord4278
ord6663
ord4480
ord1795
ord6055
ord1776
ord4396
ord5290
ord609
ord4275
ord2380
ord4123
ord3874
ord2575
ord3402
ord3574
ord567
ord4538
ord2243
ord4284
ord1929
ord795
ord5789
ord3797
ord3721
ord1948
ord5303
ord4699
ord5715
ord817
ord2414
ord2726
ord4226
ord1979
ord6385
ord5207
ord690
ord665
ord1988
ord5186
ord354
ord389
ord5856
ord6883
ord5651
ord3127
ord3616
ord350
ord3126
ord3613
ord6648
ord668
ord2820
ord3010
ord2781
ord2770
ord356
ord818
ord2086
ord2814
ord3810
ord539
ord781
ord1168
ord3708
ord812
ord5442
ord3507
ord559
ord5862
ord1980
ord4215
ord536
ord859
ord2582
ord4402
ord3640
ord693
ord4243
ord6453
ord6696
ord6891
ord6905
ord6242
ord936
ord932
ord5216
ord3301
ord5450
ord6394
ord5440
ord6383
ord3370
ord4400
ord3630
ord682
ord6172
ord4133
ord4297
ord5788
ord472
ord2754
ord1576
ord5759
ord6192
ord5756
ord6186
ord4330
ord6189
ord6021
ord5873
ord5794
ord5678
ord5736
ord5579
ord5571
ord6061
ord5864
ord3596
ord3693
ord3571
ord1146
ord2580
ord809
ord556
ord1088
ord3092
ord2122
ord6199
ord2116
ord2645
ord6907
ord6215
ord6270
ord1105
ord3302
ord6378
ord6380
ord656
ord6334
ord3956
ord5982
ord643
ord4136
ord329
ord4220
ord2584
ord3654
ord2438
ord2863
ord1644
ord4287
ord6880
ord3811
ord2135
ord326
ord2688
ord348
ord663
ord940
ord4167
ord521
ord6307
ord2358
ord2515
ord355
ord2642
ord3610
ord2289
ord4224
ord6223
ord1949
ord4034
ord858
ord324
ord540
ord860
ord641
ord800
ord3597
ord4425
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5280
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1775
ord4078
ord6052
ord2514
ord4998
ord4376
ord5265
ord565
ord2971

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
?terminate@@YAXXZ
_except_handler3
??1type_info@@UAE@XZ
_onexit
__dllonexit
memmove
time
srand
rand
strtoul
_mbstok
malloc
sprintf
fgets
isdigit
strcat
calloc
realloc
_ftol
_strdup
wcsstr
strstr
free
_mbscmp
atol
__p___argc
__p___argv
strcmp
atoi
strlen
strcpy
fopen
fseek
ftell
fclose
fread
memcpy
__CxxFrameHandler
_setmbcp
_strupr
_wcsupr
_wcsdup
memset

kernel32

Beep
CreateDirectoryA
GetFileAttributesA
GetModuleFileNameA
MultiByteToWideChar
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
ResumeThread
GetLastError
GetTimeZoneInformation
SizeofResource
LockResource
LoadResource
FindResourceA
GetCurrentDirectoryA
GetWindowsDirectoryA
CreateFileA
TerminateThread
GetExitCodeThread
GlobalUnlock
GlobalLock
WideCharToMultiByte
ResetEvent
SetEvent
LocalFree
LocalAlloc
GetModuleHandleA
GetStartupInfoA
CopyFileA
EnterCriticalSection
LeaveCriticalSection
Sleep
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSection
GetVersionExA
GlobalFree
GlobalAlloc

user32

GrayStringA
SetCursor
LoadCursorA
GetCursorPos
GetCursor
PtInRect
CheckMenuItem
SetMenuDefaultItem
GetMenuState
GetSubMenu
LoadMenuA
GetWindowRect
InvalidateRect
IsWindowVisible
TabbedTextOutA
SetWindowPos
SystemParametersInfoA
ClientToScreen
SetForegroundWindow
OffsetRect
UpdateWindow
GetSysColor
KillTimer
SetTimer
SendMessageA
CopyRect
DrawFrameControl
FillRect
LoadIconA
LoadBitmapA
DrawFocusRect
PostThreadMessageA
FindWindowA
MessageBoxA
PostMessageA
EnableWindow
ReleaseDC
GetDC
GetClientRect
SetWindowRgn
SetRect
CopyImage
GetSystemMetrics
DrawTextA

gdi32

CombineRgn
GetTextColor
Escape
GetTextExtentPoint32A
ExtTextOutA
TextOutA
RectVisible
PtVisible
CreateCompatibleBitmap
GetCurrentObject
CreateFontIndirectA
SetTextColor
GetPixel
CreateSolidBrush
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
GetObjectA
DeleteObject
CreateRectRgn

advapi32

RegDeleteValueA
RegSetValueExA
RegCreateKeyA
RegDeleteKeyA
RegEnumKeyExA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumValueA

shell32

Shell_NotifyIconA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc
ShellExecuteA

comctl32

ord17

ole32

CoInitialize
CoCreateInstance
CreateStreamOnHGlobal

olepro32

ord251

oleaut32

SysFreeString

Sections

.text
Size: 200KB - Virtual size: 197KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bdf6c6da11caffa99fb7c598c0e98c2f

Headers

File Characteristics

Imports

wininet

version

winmm

ws2_32

shlwapi

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

olepro32

oleaut32

Sections

.text Size: 200KB - Virtual size: 197KB

.rdata Size: 40KB - Virtual size: 39KB

.data Size: 12KB - Virtual size: 13KB

.rsrc Size: 20KB - Virtual size: 16KB

.text
Size: 200KB - Virtual size: 197KB

.rdata
Size: 40KB - Virtual size: 39KB

.data
Size: 12KB - Virtual size: 13KB

.rsrc
Size: 20KB - Virtual size: 16KB