d6896f7393cce3688596d30a57c4005f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d6896f7393cce3688596d30a57c4005f_JaffaCakes118
Size

1.1MB
MD5

d6896f7393cce3688596d30a57c4005f
SHA1

159edcda57f692e8a22a3f1e1981260c9170eed9
SHA256

fb8a85e6e19a63140ba7329673664cab51d220058911e7e7a1e7dd49bacf3fb7
SHA512

769a8644a82c98bb12e36bd0e6e2f58e964e07a425a19562a1155e7ac5545b60b56120e7b1186f8ba5ff81228756ad0a462ee142102704196f97f86bcc2f7246
SSDEEP

24576:8FsUOXyrP3QLq5T5zbdKJEpBAHFSv47HiRUwrQdgD6:hCr3QLcVryHFg47H8Uwrxm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d6896f7393cce3688596d30a57c4005f_JaffaCakes118

Files

d6896f7393cce3688596d30a57c4005f_JaffaCakes118
.exe windows:5 windows x86 arch:x86

1373f808d89a670c980e3d88897d8137

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\labs\Downloader\trunk\Out\Release\Downloader.pdb

Imports

shlwapi

PathFindExtensionW
PathStripToRootW
PathFileExistsW
PathFindFileNameW
PathRemoveFileSpecW
PathIsUNCW

ws2_32

WSAStartup
closesocket
socket
recv
send
getsockname
ntohs
bind
htons
getsockopt
getpeername
setsockopt
connect
WSASetLastError
freeaddrinfo
getaddrinfo
sendto
recvfrom
accept
listen
__WSAFDIsSet
select
ioctlsocket
gethostname
WSACleanup
WSAGetLastError

wldap32

ord33
ord200
ord79
ord35
ord32
ord30
ord301
ord50
ord60
ord143
ord211
ord22
ord27
ord41
ord46
ord26

kernel32

GlobalLock
GlobalAlloc
GlobalFree
FreeResource
RaiseException
GetModuleHandleA
GetCurrentProcessId
LoadLibraryW
GetModuleHandleW
GetVersionExA
lstrcmpW
CompareStringW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
InterlockedDecrement
FileTimeToSystemTime
InterlockedExchange
CompareStringA
LoadLibraryExW
GetLocaleInfoW
lstrcmpA
EnumResourceLanguagesW
ConvertDefaultLocale
GetCurrentThread
WritePrivateProfileStringW
GlobalUnlock
DuplicateHandle
GetCurrentProcess
FindClose
FindFirstFileW
GetVolumeInformationW
lstrlenA
LocalAlloc
GlobalReAlloc
GlobalHandle
LocalReAlloc
TlsFree
GlobalFlags
SetErrorMode
FileTimeToLocalFileTime
GetFileSizeEx
GetFileTime
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
HeapFree
RtlUnwind
HeapReAlloc
GetDriveTypeA
FindFirstFileA
ExitThread
GetFileInformationByHandle
ExitProcess
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapSize
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
LCMapStringW
LCMapStringA
GetCurrentDirectoryA
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
GetProcessHeap
FormatMessageW
LocalFree
MulDiv
lstrlenW
GetThreadLocale
DeleteFileA
GetSystemTime
GetTempPathA
DeleteFileW
TlsAlloc
GetCurrentThreadId
GetTempPathW
FlushFileBuffers
GetFileAttributesW
GetFileAttributesA
GetVersionExW
TlsSetValue
GetSystemTimeAsFileTime
LockFile
UnlockFile
InterlockedIncrement
TlsGetValue
CreateFileA
GetFullPathNameA
GetFullPathNameW
LoadLibraryA
GetProcAddress
FreeLibrary
GetFileType
WaitForMultipleObjects
PeekNamedPipe
GetTickCount
FormatMessageA
SleepEx
SetLastError
ExpandEnvironmentStringsA
CreateProcessW
GetStdHandle
SetEndOfFile
LockFileEx
Sleep
CreateThread
SetEvent
DeleteCriticalSection
CreateEventW
InitializeCriticalSection
GetPrivateProfileStringW
SetFilePointer
GetLastError
WriteFile
CloseHandle
ReadFile
GetFileSize
CreateFileW
CreateDirectoryW
MoveFileExA
SetCurrentDirectoryW
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameW
FindResourceW
LoadResource
LockResource
SizeofResource

user32

ModifyMenuW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
PostQuitMessage
MapDialogRect
SetWindowContextHelpId
ValidateRect
GetCursorPos
TranslateMessage
GetMessageW
SetCursor
CharUpperW
CopyAcceleratorTableW
IsRectEmpty
SetRect
InvalidateRect
InvalidateRgn
SetCapture
ReleaseCapture
GetSysColorBrush
LoadCursorW
DestroyMenu
UnregisterClassW
GetNextDlgGroupItem
MessageBeep
RegisterClipboardFormatW
PostThreadMessageW
EnableMenuItem
CheckMenuItem
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
DispatchMessageW
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
GetKeyState
SetMenu
SetForegroundWindow
IsWindowVisible
UpdateWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
DefWindowProcW
CallWindowProcW
GetMenu
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
GetWindowThreadProcessId
GetLastActivePopup
MessageBoxW
GetSysColor
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
RegisterWindowMessageW
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetNextDlgTabItem
EndDialog
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetWindowTextW
GetFocus
SetWindowPos
SetFocus
IsWindowEnabled
ShowWindow
EnableWindow
SendMessageW
KillTimer
PostMessageW
MoveWindow
SetWindowLongW
SetWindowTextW
IsDialogMessageW
SendDlgItemMessageW
GetDlgItem
GetWindowLongW
OffsetRect
PtInRect
CopyRect
GetDlgCtrlID
GetWindow
CharNextW
IsWindow
DrawIcon
GetSystemMetrics
IsIconic
LoadIconW
GetClientRect
SetTimer
wsprintfW
LoadBitmapW
GetParent
IntersectRect

gdi32

DeleteObject
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutW
ExtTextOutW
ExtSelectClipRgn
CreatePen
CreateRectRgnIndirect
GetRgnBox
GetMapMode
DeleteDC
GetClipBox
SetMapMode
SetTextColor
SetBkMode
SetBkColor
RestoreDC
SaveDC
GetTextColor
GetBkColor
GetDeviceCaps
GetObjectW
GetStockObject
Rectangle
CreateFontW
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
CreateBitmap
CreateSolidBrush
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegQueryValueExW
RegQueryValueW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
CryptAcquireContextW
RegCloseKey
CryptHashData
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptDuplicateKey
CryptDeriveKey

shell32

ShellExecuteW

comctl32

InitCommonControlsEx

oledlg

OleUIBusyW

ole32

CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
StgOpenStorageOnILockBytes
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes

oleaut32

VariantClear
SysFreeString
SysAllocStringLen
OleCreateFontIndirect
SysStringLen
VariantInit
VariantCopy
VariantChangeType
SysAllocString
DispCallFunc
LoadRegTypeLi
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayCreate
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime

Exports

Exports

_sqlite3_key_interop@12
_sqlite3_rekey_interop@12

Sections

.text
Size: 767KB - Virtual size: 766KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 186KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1373f808d89a670c980e3d88897d8137

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

ws2_32

wldap32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

oleaut32

Exports

Exports

Sections

.text Size: 767KB - Virtual size: 766KB

.rdata Size: 135KB - Virtual size: 135KB

.data Size: 17KB - Virtual size: 34KB

.rsrc Size: 186KB - Virtual size: 186KB

.reloc Size: 61KB - Virtual size: 60KB

.text
Size: 767KB - Virtual size: 766KB

.rdata
Size: 135KB - Virtual size: 135KB

.data
Size: 17KB - Virtual size: 34KB

.rsrc
Size: 186KB - Virtual size: 186KB

.reloc
Size: 61KB - Virtual size: 60KB