d5fd77a6f9cc11c715bb051629bc5ad0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d5fd77a6f9cc11c715bb051629bc5ad0_JaffaCakes118
Size

10.0MB
MD5

d5fd77a6f9cc11c715bb051629bc5ad0
SHA1

d27c510209ad9967ed163fc403744963da6d2d03
SHA256

b36b66110337770b15fd51f31cf74300a6a40004907663faa40c1b071b4b8a8a
SHA512

ccaa0cc6d8155b13fed1e55031e066bb0e00f01d3acdcaa155e9652327cb65b529620cffb82e94bf88b4ff33714275ea86c09c5e473a6e47909d40ad81328029
SSDEEP

98304:nTaROP16/C4Znqo/X7wmCEmXDQC9tElQtbwRS60ZSO/2GveW:T8w8C4Zqo/X3CEAQahtZ/xeW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d5fd77a6f9cc11c715bb051629bc5ad0_JaffaCakes118

Files

d5fd77a6f9cc11c715bb051629bc5ad0_JaffaCakes118
.exe windows:5 windows x86 arch:x86

716ef1bb4b5087c941e2803b835552c2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

icmp

IcmpCloseHandle
IcmpSendEcho
IcmpCreateFile

shlwapi

PathCreateFromUrlW
StrRetToStrW
PathCombineW

wininet

InternetCloseHandle
InternetCrackUrlW
HttpOpenRequestW
HttpSendRequestW
InternetConnectW
InternetOpenA
InternetSetOptionW
HttpQueryInfoW

comdlg32

GetSaveFileNameW
GetOpenFileNameW

authz

AuthzAccessCheck
AuthzFreeResourceManager
AuthzInitializeResourceManager
AuthzFreeContext
AuthzInitializeContextFromSid

msimg32

AlphaBlend

ws2_32

htons
htonl
freeaddrinfo
setsockopt
WSAAddressToStringW
WSCGetProviderPath
getsockname
gethostbyname
listen
getaddrinfo
bind
closesocket
socket
inet_ntoa
ioctlsocket
WSAGetLastError
connect
inet_addr
getnameinfo
WSCEnumProtocols

shell32

SHBindToParent
SHCreateItemFromParsingName
DragQueryFileW
DragAcceptFiles
Shell_NotifyIconW
SHCreateStdEnumFmtEtc
ShellExecuteExW
DragFinish
SHGetFolderPathW
SHGetFileInfoW
SHChangeNotify
SHAppBarMessage
ShellExecuteW

user32

MoveWindow
CreateWindowExW
PeekMessageW
MonitorFromWindow
MessageBoxA
SetTimer
AllowSetForegroundWindow
WindowFromPoint
BeginPaint
FrameRect
RegisterWindowMessageW
FillRect
DispatchMessageW
EnumWindows
GetClassInfoW
SetActiveWindow
GetActiveWindow
GetKeyboardLayoutList
EnumChildWindows
ReleaseCapture
LoadCursorW
SetCapture
GetCapture
GetCursorInfo
CharLowerBuffW
GetSystemMetrics
PostMessageW
SetWindowLongW
CharUpperBuffW
GetClientRect
LoadImageA
ShowCursor
SetClipboardData
GetClipboardData
ClientToScreen
IsIconic
GetMonitorInfoW
ShowWindow
CharUpperW
DefWindowProcW
SetForegroundWindow
GetForegroundWindow
GetAsyncKeyState
MapVirtualKeyExW
EnableWindow
GetShellWindow
DestroyWindow
RegisterClassW
CharNextW
GetWindowThreadProcessId
RedrawWindow
GetDC
SetFocus
ReleaseDC
EndPaint
TrackMouseEvent
GetParent
MessageBeep
MessageBoxW
SetClassLongW
RegisterHotKey
AttachThreadInput
MsgWaitForMultipleObjects
DestroyIcon
IsWindowVisible
EmptyClipboard
FlashWindowEx
PtInRect
UnregisterClassW
SendMessageW
GetLastInputInfo
IsWindow
EnumThreadWindows
InvalidateRect
ScreenToClient
GetWindowInfo
SendMessageTimeoutW
BringWindowToTop
SetCursor
LoadStringW
SetWindowPos
OpenClipboard
TranslateMessage
EnumDisplayMonitors
CallWindowProcW
CloseClipboard
UpdateLayeredWindow
DrawIconEx
GetClassNameW
GetIconInfo
GetKeyNameTextW
GetDesktopWindow
GetCursorPos
DeferWindowPos
EndDeferWindowPos
UnregisterHotKey
GetKeyState
MonitorFromPoint
SystemParametersInfoW
CreateIconFromResourceEx
GetWindow
GetWindowLongW
GetWindowRect
KillTimer
BeginDeferWindowPos
PostThreadMessageW
IsWindowEnabled
GetWindowPlacement
CreateIconIndirect
FindWindowW
GetKeyboardLayout

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

oleaut32

SafeArrayPutElement
SysFreeString
VariantClear
VariantInit
SysReAllocStringLen
SysAllocString
SafeArrayCreate
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayCreateVector
SafeArrayGetUBound
SafeArrayGetLBound
VariantCopy
VariantChangeType

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorA
CloseServiceHandle
RegSetValueExW
AddAccessDeniedObjectAce
AddAccessAllowedObjectAce
AddAuditAccessAceEx
AddAce
OpenThreadToken
CloseEventLog
RegQueryInfoKeyW
IsValidSid
CreateWellKnownSid
GetLengthSid
AddAccessAllowedAceEx
OpenEventLogW
GetTokenInformation
ReadEventLogW
RegCreateKeyExW
SetSecurityDescriptorDacl
OpenServiceW
InitializeAcl
RegEnumKeyExW
AdjustTokenPrivileges
QueryServiceConfigW
CopySid
SetSecurityInfo
AddAuditAccessObjectAce
RegDeleteKeyW
LookupPrivilegeValueW
OpenSCManagerW
RegOpenKeyExW
OpenProcessToken
RegDeleteValueW
RegNotifyChangeKeyValue
AddAccessDeniedAceEx
GetNamedSecurityInfoW
SetNamedSecurityInfoW
RegFlushKey
RegEnumValueW
RegQueryValueExW
ConvertSidToStringSidW
RegCloseKey
InitializeSecurityDescriptor
EnumServicesStatusW

netapi32

NetWkstaGetInfo
NetApiBufferFree

kernel32

ReadFileEx
SetFileTime
GetFileTime
GetACP
Process32FirstW
GetExitCodeProcess
CloseHandle
LocalFree
SizeofResource
GetCurrentProcessId
TerminateThread
SetHandleInformation
GetHandleInformation
GetFullPathNameW
FindNextFileW
WriteProcessMemory
SetUnhandledExceptionFilter
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
FreeLibrary
SetDllDirectoryW
GetUserDefaultLCID
SetLastError
WaitNamedPipeW
GetModuleFileNameW
GetLastError
GlobalAlloc
GlobalUnlock
OpenMutexW
CreateThread
CompareStringW
GetGeoInfoW
LoadLibraryA
CreateMutexW
ResetEvent
GetVolumeInformationW
RaiseException
FormatMessageW
OpenJobObjectW
GetCurrentThread
GetLogicalDrives
IsBadReadPtr
ExpandEnvironmentStringsW
LoadLibraryExW
MoveFileWithProgressW
FileTimeToSystemTime
GetShortPathNameW
VirtualQuery
VirtualQueryEx
Sleep
SetFilePointer
FlushFileBuffers
LoadResource
SuspendThread
GetTickCount
WritePrivateProfileStringW
GetFileSize
GetStartupInfoW
GetFileAttributesW
SetThreadPriority
VirtualAlloc
GetSystemInfo
GetTempPathW
LeaveCriticalSection
VerSetConditionMask
GetDiskFreeSpaceW
GetUserDefaultUILanguage
WriteFileEx
GetModuleFileNameA
CompareStringA
WaitForSingleObjectEx
GetCompressedFileSizeW
WideCharToMultiByte
MultiByteToWideChar
FindClose
LoadLibraryW
SetEvent
FreeEnvironmentStringsW
GetLocaleInfoW
ConnectNamedPipe
GetLocalTime
WaitForSingleObject
GetSystemPowerStatus
DeleteCriticalSection
OpenThread
SetErrorMode
TzSpecificLocalTimeToSystemTime
SleepEx
IsValidLocale
LocalAlloc
WaitForMultipleObjectsEx
GetVolumePathNameW
SetFileAttributesW
VirtualProtect
SetEnvironmentVariableW
ReadProcessMemory
QueryPerformanceFrequency
SetThreadContext
VirtualFree
GetThreadContext
FlushInstructionCache
ExitProcess
GetLongPathNameW
RtlUnwind
GetCPInfo
GetStdHandle
DisconnectNamedPipe
GetModuleHandleW
SetInformationJobObject
ReadFile
CreateProcessW
CreateRemoteThread
FindResourceW
GetUserGeoID
CopyFileW
CheckRemoteDebuggerPresent
MapViewOfFile
MulDiv
CreateFileA
GetVersion
GetDriveTypeW
FreeResource
Module32NextW
MoveFileW
SetThreadExecutionState
GlobalAddAtomW
GetSystemTimeAsFileTime
OpenProcess
SwitchToThread
GetExitCodeThread
GetEnvironmentVariableA
OutputDebugStringW
GetFileAttributesExW
SetNamedPipeHandleState
GlobalMemoryStatusEx
LockResource
TerminateProcess
QueryInformationJobObject
GetCurrentThreadId
MoveFileExW
UnhandledExceptionFilter
PeekNamedPipe
GlobalFree
EnterCriticalSection
GetDiskFreeSpaceExW
ReleaseMutex
EnumResourceLanguagesW
GlobalDeleteAtom
SetCurrentDirectoryW
GetCurrentDirectoryW
InitializeCriticalSection
GlobalLock
GetCurrentProcess
GetCommandLineW
ResumeThread
GetProcAddress
VirtualAllocEx
FindResourceExW
GetVersionExW
VerifyVersionInfoW
GetEnvironmentStringsW
DeviceIoControl
FindFirstFileW
UnmapViewOfFile
Process32NextW
lstrlenW
SetEndOfFile
QueryPerformanceCounter
GetVolumeNameForVolumeMountPointW
CreateToolhelp32Snapshot
SystemTimeToFileTime
CreateFileW
GetSystemDirectoryW
EnumResourceNamesW
DeleteFileW
GetEnvironmentVariableW
WriteFile
GetFileInformationByHandle
Module32FirstW
FindFirstFileExW
ExitThread
CreateNamedPipeW
CreateFileMappingW
CreatePipe
TlsGetValue
GetDateFormatW
TlsSetValue
GetSystemDefaultUILanguage
GetOverlappedResult
CreateDirectoryW
EnumCalendarInfoW
RemoveDirectoryW
CreateEventW
SetThreadLocale
GetThreadLocale

wintrust

WinVerifyTrust

shfolder

SHGetFolderPathA

wsock32

accept
htonl
htons
setsockopt
select
WSAStartup
__WSAFDIsSet
WSACleanup
getsockname
listen
bind
closesocket
socket
recv
ioctlsocket
WSAGetLastError
shutdown
send

crypt32

CertGetNameStringW
CryptQueryObject
CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore
CryptMsgGetParam
CryptMsgClose

dnsapi

DnsQuery_W
DnsRecordListFree

ole32

CoCreateGuid
CoCreateInstance
CoUninitialize
OleInitialize
CoSetProxyBlanket
PropVariantClear
OleUninitialize
CoInitialize
CoInitializeSecurity
CoTaskMemFree
CoTaskMemAlloc
DoDragDrop

iphlpapi

GetAdaptersAddresses

gdi32

SetBkMode
GetObjectW
CreateCompatibleBitmap
CreateDIBSection
SetMapMode
CreateSolidBrush
SelectObject
DeleteObject
DeleteDC
BitBlt
GetDeviceCaps
CreateCompatibleDC

Exports

Exports

NoGCLayPipe
__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

.text
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 636KB - Virtual size: 635KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 99KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 137B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 56B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 93B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 395KB - Virtual size: 395KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

716ef1bb4b5087c941e2803b835552c2

Headers

DLL Characteristics

File Characteristics

Imports

icmp

shlwapi

wininet

comdlg32

authz

msimg32

ws2_32

shell32

user32

version

oleaut32

advapi32

netapi32

kernel32

wintrust

shfolder

wsock32

crypt32

dnsapi

ole32

iphlpapi

gdi32

Exports

Exports

Sections

.text Size: 5.8MB - Virtual size: 5.8MB

.itext Size: 11KB - Virtual size: 10KB

.data Size: 636KB - Virtual size: 635KB

.bss Size: - Virtual size: 99KB

.idata Size: 13KB - Virtual size: 13KB

.didata Size: 512B - Virtual size: 420B

.edata Size: 512B - Virtual size: 137B

.tls Size: - Virtual size: 56B

.rdata Size: 512B - Virtual size: 93B

.reloc Size: 395KB - Virtual size: 395KB

.rsrc Size: 3.2MB - Virtual size: 3.2MB

.text
Size: 5.8MB - Virtual size: 5.8MB

.itext
Size: 11KB - Virtual size: 10KB

.data
Size: 636KB - Virtual size: 635KB

.bss
Size: - Virtual size: 99KB

.idata
Size: 13KB - Virtual size: 13KB

.didata
Size: 512B - Virtual size: 420B

.edata
Size: 512B - Virtual size: 137B

.tls
Size: - Virtual size: 56B

.rdata
Size: 512B - Virtual size: 93B

.reloc
Size: 395KB - Virtual size: 395KB

.rsrc
Size: 3.2MB - Virtual size: 3.2MB