d2a0355ca9efea09132fe6c9b727d19b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d2a0355ca9efea09132fe6c9b727d19b_JaffaCakes118
Size

212KB
MD5

d2a0355ca9efea09132fe6c9b727d19b
SHA1

931d80a8a79851bda64974b2b7782afe61ee6eed
SHA256

118259a6a025d6f3851e56df0423d3cb0d0f59dfb7e58dfb1ab8b15db3a0a39a
SHA512

6b3b75f43ca4b16b12d6d7b15f8f84bcfb84f1a7d8d26df0206ed1dd0701ed57b690a3583598e5adf54eee76d406ebe685ab9aec502cb2d2c4c4b76c5071f783
SSDEEP

6144:+dd7Ksi/inBYx+YViwQRzvCHtm28yH/7a:I71nwiwQJaNS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d2a0355ca9efea09132fe6c9b727d19b_JaffaCakes118

Files

d2a0355ca9efea09132fe6c9b727d19b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

df1ecc5640ff074bb93532a2afdff806

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

shlwapi

StrCmpNIA
StrPBrkA
StrRChrW
StrRChrA
StrStrIW
StrToIntExW
wvnsprintfW
wvnsprintfA
StrCmpW
StrStrW
StrStrIA
StrToIntExA
StrCmpNA
StrChrA
StrChrIA
wnsprintfW
wnsprintfA
StrStrA

ws2_32

select
inet_addr
WSAStartup
setsockopt
socket
send
getsockopt
recv
getsockname
gethostbyname
inet_ntoa
shutdown
closesocket
connect
htons
ioctlsocket
WSAGetLastError
sendto

kernel32

GetLocaleInfoW
SetStdHandle
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
FlushFileBuffers
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetCPInfo
GetOEMCP
QueryPerformanceCounter
GetModuleFileNameA
IsBadCodePtr
HeapSize
VirtualFree
SetUnhandledExceptionFilter
VirtualQuery
GetSystemInfo
VirtualAlloc
GetCurrentProcess
TerminateProcess
RtlUnwind
GetSystemTimeAsFileTime
GetCommandLineA
GetVersion
Sleep
CreateThread
GetCurrentThreadId
CreateMutexA
CloseHandle
OpenMutexA
ExitProcess
ExitThread
TerminateThread
OpenThread
HeapCreate
HeapAlloc
HeapReAlloc
IsBadReadPtr
HeapFree
IsBadWritePtr
WriteFile
SetFilePointer
CreateFileA
GetTickCount
WaitForSingleObject
ReleaseMutex
lstrcmpA
SystemTimeToFileTime
GetLocalTime
GetSystemTime
GetTimeZoneInformation
MultiByteToWideChar
lstrcmpW
lstrlenW
GlobalFree
GlobalAlloc
DeviceIoControl
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
CreateProcessA
GetEnvironmentVariableA
GetCurrentProcessId
lstrcmpiW
DeleteCriticalSection
LeaveCriticalSection
GetLastError
EnterCriticalSection
lstrlenA
lstrcpyA
lstrcpynA
RaiseException
InitializeCriticalSection
lstrcatA
lstrcpyW
lstrcatW
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
lstrcmpiA
InterlockedCompareExchange
LocalFree
FormatMessageA
VirtualProtect
GetProcAddress
GetModuleHandleA
WideCharToMultiByte
GetModuleFileNameW
FindClose
FindNextFileA
DeleteFileA
FindFirstFileA
GetProcessHeap
SetLastError
FileTimeToSystemTime
GetConsoleScreenBufferInfo
GetStdHandle
SetConsoleCursorPosition
WriteConsoleW
LoadLibraryA
ReadFile
GetFileSize
CreateFileW
InterlockedIncrement
InterlockedDecrement
GlobalUnlock
GlobalLock
GlobalSize

user32

CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
EnumClipboardFormats
CountClipboardFormats
SetThreadDesktop
CreateDesktopA
SendMessageW
EnumChildWindows
MessageBoxW
GetDesktopWindow
GetWindowTextW
DestroyWindow
PostMessageA
GetDlgItem
GetWindowInfo
GetDlgCtrlID
GetClassNameA
GetAncestor
IsWindow
GetWindowThreadProcessId
CharLowerW
GetDC
wsprintfA
GetClipboardData
MessageBoxA

wininet

GetUrlCacheEntryInfoW
DeleteUrlCacheEntryW

gdiplus

GdipCreateBitmapFromScan0
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusStartup
GdiplusShutdown
GdipCreateSolidFill
GdipGetImageGraphicsContext
GdipGetDC
GdipReleaseDC
GdipDrawLineI
GdipFillRectangleI
GdipDrawImageI
GdipCloneFontFamily
GdipGetFontCollectionFamilyList
GdipDeletePrivateFontCollection
GdipCreateFont
GdipCloneBitmapAreaI
GdipCloneBrush
GdipCloneImage
GdipFree
GdipDrawString
GdipGetImageHeight
GdipGetImageWidth
GdipSaveImageToStream
GdipDisposeImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipDeleteFont
GdipPrivateAddMemoryFont
GdipNewPrivateFontCollection
GdipGetFontCollectionFamilyCount
GdipDeleteGraphics
GdipDeletePen
GdipCreatePen1
GdipDeleteBrush
GdipAlloc

gdi32

GetTextExtentPoint32A

ole32

CoCreateInstance
StringFromCLSID
CreateStreamOnHGlobal
CoInitialize

oleaut32

SysAllocString
VariantInit
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
SysAllocStringLen
VariantClear
VariantCopy
SysAllocStringByteLen
SysStringByteLen
SafeArrayPutElement
SafeArrayCreate
VariantChangeType
SysStringLen
GetErrorInfo
SysFreeString

Sections

.text
Size: 193KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 97.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

df1ecc5640ff074bb93532a2afdff806

Headers

File Characteristics

Imports

advapi32

shlwapi

ws2_32

kernel32

user32

wininet

gdiplus

gdi32

ole32

oleaut32

Sections

.text Size: 193KB - Virtual size: 192KB

.data Size: 18KB - Virtual size: 97.7MB

.text
Size: 193KB - Virtual size: 192KB

.data
Size: 18KB - Virtual size: 97.7MB