da7d9a8da2595f0cb57a073fe7ac9ff6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

da7d9a8da2595f0cb57a073fe7ac9ff6_JaffaCakes118
Size

472KB
MD5

da7d9a8da2595f0cb57a073fe7ac9ff6
SHA1

6bdb75f791aee18967fc93a3d2b521868ff62334
SHA256

3f882ece256228b912ff236045017b50d0838779bfdebade30457f6818b7ef86
SHA512

af52bc2fb8dc2ed9697425530ff440726ad52d7ca75e3f44febdf0e2eeb97f8778f92187f5f586da1b447aa466d27fcb06efbf92d7fc4f4c8c8daec36695cf1f
SSDEEP

6144:9MeWJvxwaHeM1zTh41kBWikG+qWHSYgIxM:KjwueM1JEik9qWyYW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da7d9a8da2595f0cb57a073fe7ac9ff6_JaffaCakes118

Files

da7d9a8da2595f0cb57a073fe7ac9ff6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f67f536eebc66723743576123a687345

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\BUILD_~1\jdk6_14\control\build\WINDOW~1\tmp\deploy\plugin\jucheck\obj\jucheck.pdb

Imports

advapi32

RegDeleteKeyA
RegCreateKeyExA
RegDeleteValueA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegSetValueExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExA
RegEnumKeyA
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA

crypt32

CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CryptMsgClose
CertCloseStore

version

VerQueryValueA
GetFileVersionInfoA

user32

IsWindowUnicode
ReleaseCapture
SetCapture
FillRect
GetClientRect
MapDialogRect
SetWindowContextHelpId
GetWindowRect
PtInRect
SetCursor
GetDlgCtrlID
LoadBitmapA
EnableWindow
EndDialog
RegisterClassA
ShowWindow
PostQuitMessage
CreatePopupMenu
AppendMenuA
GetCursorPos
SetForegroundWindow
TrackPopupMenu
PostMessageA
GetSystemMetrics
LoadImageA
DialogBoxIndirectParamA
RegisterWindowMessageA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
RegisterClassExA
GetDC
UnregisterClassA
MessageBoxA
LoadStringA
CharNextA
wsprintfA
GetDesktopWindow
PeekMessageA
DispatchMessageA
DispatchMessageW
TranslateMessage
GetMessageA
GetMessageW
GetSysColor
MsgWaitForMultipleObjects
ReleaseDC
SetWindowLongA
InvalidateRect
InvalidateRgn
CallWindowProcA
EndPaint
BeginPaint
SetFocus
GetWindow
IsChild
GetFocus
DestroyAcceleratorTable
GetWindowLongA
DefWindowProcA
GetClassInfoExA
LoadCursorA
CreateWindowExA
CreateAcceleratorTableA
GetParent
GetClassNameA
SetWindowPos
DestroyWindow
RedrawWindow
GetDlgItem
IsWindow
SendMessageA

gdi32

StretchBlt
SetTextColor
SaveDC
SetGraphicsMode
ModifyWorldTransform
SetViewportOrgEx
SetWindowOrgEx
DPtoLP
CreateFontIndirectA
RestoreDC
CreateSolidBrush
GetStockObject
GetObjectA
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
SelectObject
DeleteObject
SetBkMode

comctl32

ord17

wintrust

WinVerifyTrust

wininet

InternetErrorDlg
InternetTimeToSystemTime
InternetReadFile
HttpAddRequestHeadersA
InternetOpenA
InternetCrackUrlA
InternetConnectA
HttpOpenRequestA
InternetTimeFromSystemTime
InternetGetConnectedState
InternetCloseHandle
HttpQueryInfoA
HttpSendRequestA

urlmon

URLDownloadToFileA

shell32

ShellExecuteA
Shell_NotifyIconA

kernel32

FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
GetCPInfo
GetOEMCP
GetTimeZoneInformation
SetUnhandledExceptionFilter
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
HeapSize
CompareStringW
IsBadWritePtr
HeapCreate
HeapDestroy
ExitProcess
GetStartupInfoA
GetSystemTimeAsFileTime
HeapReAlloc
VirtualQuery
SetEnvironmentVariableA
RtlUnwind
GetEnvironmentStrings
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
CreatePipe
SetHandleInformation
ReadFile
GetCurrentProcessId
GetTickCount
SystemTimeToTzSpecificLocalTime
LocalFree
GetEnvironmentVariableA
GetTempPathA
GetSystemInfo
LoadLibraryA
GetProcAddress
OpenEventA
GetSystemTime
CreateEventA
CreateThread
ResetEvent
WaitForMultipleObjects
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
IsBadReadPtr
IsBadCodePtr
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
FlushFileBuffers
CompareStringA
VirtualProtect
TerminateProcess
SetEvent
LockResource
GlobalHandle
GlobalFree
SetLastError
GlobalLock
GlobalUnlock
MulDiv
GetCurrentThreadId
FormatMessageA
DeleteFileA
CreateProcessA
GetExitCodeProcess
GlobalAlloc
GetCurrentProcess
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
lstrcpyA
lstrcatA
CreateFileA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
GetLastError
CreateMutexA
lstrcmpiA
GetCommandLineA
InterlockedIncrement
InterlockedDecrement
lstrlenW
GetModuleHandleA
MultiByteToWideChar
lstrlenA
GetModuleFileNameA
WideCharToMultiByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcpynA
IsDBCSLeadByte
lstrcmpA
WriteFile
WaitForSingleObject
SetEndOfFile
SetFilePointer
CompareFileTime
SystemTimeToFileTime
Sleep
FileTimeToSystemTime
GetFileTime
GetFileSize

ole32

OleUninitialize
OleInitialize
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
CreateStreamOnHGlobal
OleLockRunning
StringFromCLSID
CoInitializeSecurity
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
StringFromGUID2

oleaut32

VarUI4FromStr
SysAllocStringLen
LoadTypeLi
LoadRegTypeLi
VariantInit
VariantClear
OleCreateFontIndirect
SysStringByteLen
SysStringLen
SysAllocString
SysFreeString

Sections

.text
Size: 124KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 304KB - Virtual size: 301KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f67f536eebc66723743576123a687345

Headers

File Characteristics

PDB Paths

Imports

advapi32

crypt32

version

user32

gdi32

comctl32

wintrust

wininet

urlmon

shell32

kernel32

ole32

oleaut32

Sections

.text Size: 124KB - Virtual size: 121KB

.rdata Size: 32KB - Virtual size: 30KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 304KB - Virtual size: 301KB

.text
Size: 124KB - Virtual size: 121KB

.rdata
Size: 32KB - Virtual size: 30KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 304KB - Virtual size: 301KB