daf1432eeb4b3ebd611225b14c5c3575_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

daf1432eeb4b3ebd611225b14c5c3575_JaffaCakes118
Size

138KB
MD5

daf1432eeb4b3ebd611225b14c5c3575
SHA1

49874e90d03bce84d2529a202ac814460dd491af
SHA256

11c5d1d0ba67425149bfee9132a638d4580c55ba0245c512a945c1279c203b4d
SHA512

a44c0ca4a20f06ddf6002fc6b71ae3445af6ce938948ba2c25baec0e7f61cd20cf63190c42170124745ba98dc2009a9153013b09cf0d62c93b347c4f58b710b3
SSDEEP

3072:eYv6A2SReRWxD/STCb+QSas+5QnAONrPx79Llvi9ZDoVuxVQhJ7:Xv6AlzEESas+UNr579LlvinQhJ7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
daf1432eeb4b3ebd611225b14c5c3575_JaffaCakes118

Files

daf1432eeb4b3ebd611225b14c5c3575_JaffaCakes118
.exe windows:5 windows x86 arch:x86

895528c48c0d5ea5a6739b099b5b7634

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateToolhelp32Snapshot
GetThreadContext
SetThreadContext
VirtualAlloc
GetProcessId
CreateMutexW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
GetEnvironmentVariableW
FileTimeToDosDateTime
GetTempFileNameW
HeapReAlloc
FindFirstFileW
SetEndOfFile
CreateProcessW
HeapAlloc
SystemTimeToFileTime
SetFilePointerEx
HeapFree
GetProcessHeap
IsBadReadPtr
SetFileTime
VirtualQueryEx
Thread32First
CreateFileW
ReadProcessMemory
Process32NextW
HeapDestroy
HeapCreate
Thread32Next
ReadFile
GetTimeZoneInformation
MultiByteToWideChar
GetTempPathW
GetFileSizeEx
OpenMutexW
VirtualProtectEx
VirtualAllocEx
FindClose
RemoveDirectoryW
FindNextFileW
VirtualProtect
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
MoveFileExW
GetUserDefaultUILanguage
GetFileAttributesW
WriteFile
Process32FirstW
OpenProcess
CreateRemoteThread
SetFileAttributesW
WTSGetActiveConsoleSessionId
CreateDirectoryW
lstrcmpiA
GetLastError
ExpandEnvironmentStringsW
GetPrivateProfileStringW
GetCurrentThreadId
LoadLibraryW
GetNativeSystemInfo
ReleaseMutex
SetLastError
CreateThread
GetSystemTime
GetLocalTime
ResetEvent
SetThreadPriority
TerminateProcess
TlsSetValue
GetCurrentThread
TlsGetValue
GetPrivateProfileIntW
FlushFileBuffers
EnterCriticalSection
GlobalUnlock
LeaveCriticalSection
InitializeCriticalSection
GetTickCount
GlobalLock
WriteProcessMemory
LocalFree
GetCurrentProcessId
CloseHandle
DuplicateHandle
OpenEventW
GetFileAttributesExW
WaitForMultipleObjects
CreateEventW
GetModuleFileNameW
GetVersionExW
Sleep
VirtualFreeEx
VirtualFree
GetModuleHandleW
SetEvent
GetComputerNameW
WaitForSingleObject
SetErrorMode
GetCommandLineW
ExitProcess
lstrcmpiW
LoadLibraryA
GetProcAddress
WideCharToMultiByte
FreeLibrary

user32

RegisterClassA
GetSystemMetrics
GetMessageA
GetWindowRect
SetCapture
GetParent
GetClassLongW
GetCapture
SetCursorPos
GetWindowLongW
GetAncestor
PeekMessageW
PeekMessageA
SetWindowPos
SendMessageTimeoutW
IsWindow
ReleaseCapture
DefFrameProcW
GetMessagePos
GetWindowThreadProcessId
EndPaint
GetUpdateRgn
GetMessageW
GetWindowDC
FillRect
EndMenu
DrawEdge
BeginPaint
GetUpdateRect
GetDC
IntersectRect
GetTopWindow
HiliteMenuItem
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharLowerA
CharUpperW
SetWindowLongW
GetWindow
DispatchMessageW
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
GetSubMenu
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
GetShellWindow
CharLowerW
CallWindowProcA
CharToOemW
GetMenuItemCount
MapWindowPoints
CharLowerBuffA
CallWindowProcW
DefDlgProcW
DefFrameProcA
GetCursorPos
GetIconInfo
OpenInputDesktop
RegisterClassExW
DefWindowProcA
DefMDIChildProcW
GetDCEx
ReleaseDC
PostThreadMessageW
EqualRect
PrintWindow
SendMessageW
DefWindowProcW
IsRectEmpty
MapVirtualKeyW
PostMessageW
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
SwitchDesktop
DefDlgProcA
DefMDIChildProcA
RegisterClassW
GetWindowInfo
DrawIcon
ExitWindowsEx
ToUnicode
GetClipboardData
GetKeyboardState
TranslateMessage
OpenWindowStationW
GetUserObjectInformationW
SetThreadDesktop
RegisterClassExA

advapi32

IsWellKnownSid
GetLengthSid
ConvertSidToStringSidW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
EqualSid
InitiateSystemShutdownExW
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegSetValueExW
CryptHashData

shlwapi

PathRemoveFileSpecW
PathRemoveBackslashW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathIsURLW
StrCmpNIW
PathQuoteSpacesW
StrStrIW
StrStrIA
PathRenameExtensionW

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

GetDeviceCaps
CreateCompatibleBitmap
CreateDIBSection
SetViewportOrgEx
DeleteDC
GdiFlush
DeleteObject
SelectObject
SetRectRgn
CreateCompatibleDC
GetDIBits
RestoreDC
SaveDC

ws2_32

recv
sendto
getsockname
select
getaddrinfo
recvfrom
getpeername
accept
WSAEventSelect
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
shutdown
setsockopt
bind
socket
WSASetLastError
freeaddrinfo
WSASend
closesocket
send
WSAGetLastError
listen

crypt32

CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
PFXImportCertStore
CryptUnprotectData
PFXExportCertStoreEx

wininet

InternetQueryOptionA
InternetSetOptionA
InternetQueryOptionW
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFile
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetCrackUrlA
InternetConnectA
HttpQueryInfoA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

895528c48c0d5ea5a6739b099b5b7634

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 129KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 129KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB