d1df6db3f4d6840b59dee039541067d4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d1df6db3f4d6840b59dee039541067d4_JaffaCakes118
Size

138KB
MD5

d1df6db3f4d6840b59dee039541067d4
SHA1

39bdb23bbc2912180088ad34f8f85f255419c129
SHA256

a3c9aeff3c3ed06da1709b627ad0294a581a5dee4af89533477bfd91b5c30472
SHA512

aca07458093167ec1a50b9ede38d61d65fb5037cafc4aff3814706aab95a2384d875547f814ec32d333dcf7c5d4c3352b6e52bd0653bcc019c078600506e4124
SSDEEP

3072:uA+AZqZ3hlTrDj/jXhO27U0WDfC+iT6qeS/mNf5KeNpzRsSwrlp:uA+zhRrP/ThO27Uji7e995bN0rlp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d1df6db3f4d6840b59dee039541067d4_JaffaCakes118

Files

d1df6db3f4d6840b59dee039541067d4_JaffaCakes118
.exe windows:5 windows x86 arch:x86

2854fcbe57607f76b0bbbd856d26b70c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteFile
OpenProcess
Thread32First
WideCharToMultiByte
ReadProcessMemory
HeapDestroy
HeapCreate
Thread32Next
ReadFile
GetTimeZoneInformation
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetFileSizeEx
OpenMutexW
VirtualProtectEx
VirtualAllocEx
FindClose
LoadLibraryA
RemoveDirectoryW
WaitForMultipleObjects
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
FreeLibrary
ReleaseMutex
VirtualQueryEx
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
WriteProcessMemory
GetCurrentThreadId
GetCommandLineW
SetErrorMode
GetComputerNameW
OpenEventW
DuplicateHandle
GetCurrentProcessId
GetPrivateProfileStringW
GetPrivateProfileIntW
CreateRemoteThread
Process32FirstW
Process32NextW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TerminateProcess
ExitProcess
CreateThread
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualFree
GetModuleHandleW
HeapFree
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
GetSystemTime
GetLocalTime
CreateProcessW
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
SetFileAttributesW
WTSGetActiveConsoleSessionId
GetProcAddress
lstrcmpiA
CreateFileW
LoadLibraryW
FileTimeToLocalFileTime
CreateDirectoryW
CreateEventW
ResetEvent
SetLastError
GetLastError
SetEvent
ExpandEnvironmentStringsW
GetUserDefaultUILanguage
lstrcmpiW
GetModuleFileNameW
GetFileAttributesW
MoveFileExW
SetThreadPriority
Sleep
GetCurrentThread
WaitForSingleObject
LocalFree
GetVersionExW
GetNativeSystemInfo
CloseHandle
GetFileAttributesExW
GetProcessId
VirtualAlloc
VirtualFreeEx
SetThreadContext
GetThreadContext
EnterCriticalSection
GlobalUnlock
LeaveCriticalSection
InitializeCriticalSection
GetTickCount
GetFileTime
GlobalLock

user32

DrawIcon
GetIconInfo
CharLowerW
MapVirtualKeyW
CharLowerBuffA
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
OpenWindowStationW
GetMessageA
RegisterClassA
GetMessageW
SetCapture
PostMessageW
GetParent
GetWindowInfo
GetClassLongW
GetCapture
GetWindowDC
GetAncestor
PeekMessageA
SetWindowPos
GetCursorPos
IsWindow
FillRect
DrawEdge
RegisterClassExA
IntersectRect
EqualRect
PrintWindow
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
GetSubMenu
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
GetMenuItemCount
PostThreadMessageW
HiliteMenuItem
EndMenu
GetShellWindow
EndPaint
DefDlgProcW
DefFrameProcA
DefWindowProcW
OpenInputDesktop
GetUpdateRgn
GetWindowRect
BeginPaint
DefFrameProcW
RegisterClassExW
GetDCEx
ToUnicode
GetClipboardData
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
DefDlgProcA
ReleaseCapture
SendMessageW
MapWindowPoints
GetMessagePos
GetWindowThreadProcessId
IsRectEmpty
GetSystemMetrics
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
GetDC
GetWindowLongW
CharLowerA
PeekMessageW
ReleaseDC
DefMDIChildProcA
RegisterClassW
CallWindowProcA
CallWindowProcW
SetCursorPos
GetKeyboardState
TranslateMessage
ExitWindowsEx
CharToOemW
DispatchMessageW
GetWindow
SendMessageTimeoutW
SetWindowLongW
CharUpperW
GetUpdateRect

advapi32

ConvertSidToStringSidW
InitiateSystemShutdownExW
EqualSid
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
IsWellKnownSid
GetLengthSid
RegEnumKeyExW

shlwapi

PathIsURLW
PathRemoveFileSpecW
StrStrIW
StrStrIA
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveBackslashW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
StrCmpNIW
PathRenameExtensionW
PathQuoteSpacesW

shell32

SHGetFolderPathW
ShellExecuteW
CommandLineToArgvW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

RestoreDC
SaveDC
DeleteDC
GdiFlush
SetViewportOrgEx
CreateCompatibleDC
SelectObject
CreateDIBSection
GetDeviceCaps
GetDIBits
DeleteObject
SetRectRgn
CreateCompatibleBitmap

ws2_32

listen
WSASetLastError
freeaddrinfo
socket
bind
recv
setsockopt
WSAEventSelect
recvfrom
sendto
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
WSAGetLastError
getsockname
accept
getpeername
WSASend
closesocket
send
shutdown

crypt32

CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData
PFXExportCertStoreEx

wininet

InternetQueryOptionA
InternetSetOptionA
InternetQueryOptionW
InternetOpenA
HttpOpenRequestA
InternetCrackUrlA
InternetConnectA
HttpSendRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFile
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpQueryInfoA
HttpSendRequestExA
InternetCloseHandle

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2854fcbe57607f76b0bbbd856d26b70c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 129KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 129KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB