db08a7d32155eab9a6691f2d4cd79c03_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

db08a7d32155eab9a6691f2d4cd79c03_JaffaCakes118
Size

101KB
MD5

db08a7d32155eab9a6691f2d4cd79c03
SHA1

0378d4f263f4bc84e1ecaba774136ded491483a2
SHA256

89bb2e0557ea3c3cef97a4d9689319f2b519e68a0030da2260e7f7a7d84168e9
SHA512

83ec923bf47a71bec1062fa1d63fc1a4c927656deffd06016606c4903e64ee3115d0d16e4f75ba2a5af9e78dde83c07b4ddd522c0020ee8205d0f57ce3be8458
SSDEEP

3072:cLses6FlTy2/LVfplifV/8LaUVfnls4YKfbiO:cLHs6FnBxgh6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
db08a7d32155eab9a6691f2d4cd79c03_JaffaCakes118

Files

db08a7d32155eab9a6691f2d4cd79c03_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2e45c9144e684d902da2fc74b9f6070b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipCreateBitmapFromFile
GdipCreateHBITMAPFromBitmap
GdipFree
GdiplusShutdown
GdipCloneImage
GdipAlloc
GdiplusStartup
GdipDisposeImage
GdipCreateBitmapFromFileICM

ole32

CoAllowSetForegroundWindow
CoCreateInstance
OleInitialize
CoInitializeSecurity
CreateStreamOnHGlobal
CoTaskMemAlloc
CoSetProxyBlanket
CoTaskMemFree
CoUninitialize
OleLockRunning
OleUninitialize
StringFromGUID2
CLSIDFromString
CoGetClassObject
CoInitializeEx
StringFromCLSID
CLSIDFromProgID
CoCreateGuid

netapi32

NetLocalGroupAddMembers
NetUserAdd
NetUserGetLocalGroups
NetUserDel
NetWkstaUserGetInfo
NetUserEnum
NetApiBufferFree
NetGetJoinInformation

kernel32

GetProcessHeap
lstrcmpW
GetSystemDirectoryW
WideCharToMultiByte
VirtualUnlock
VirtualFree
LeaveCriticalSection
LockResource
lstrlenA
ProcessIdToSessionId
LoadLibraryExW
DeleteCriticalSection
GetLocaleInfoA
lstrlenW
GetSystemTimeAsFileTime
LocalAlloc
HeapDestroy
GetTickCount
GetModuleFileNameW
FormatMessageW
FreeLibrary
GetProcAddress
GetCurrentProcess
SetLastError
InterlockedCompareExchange
GetThreadLocale
CloseHandle
GetLastError
Sleep
GlobalUnlock
SizeofResource
WaitForSingleObject
GetProcessVersion
LocalFree
GetProcessId
UnhandledExceptionFilter
IsProcessorFeaturePresent
LoadResource
VirtualAlloc
WaitForMultipleObjects
ExitProcess
HeapReAlloc
GetACP
GetLocaleInfoW
HeapSize
VirtualLock
IsDebuggerPresent
InitializeCriticalSection
GetSystemInfo
GetComputerNameW
GetCurrentThreadId
FindResourceW
LoadLibraryW
GlobalFree
FlushInstructionCache
CreateThread
CreateEventW
GetTempPathW
FindResourceExW
GlobalHandle
QueryPerformanceCounter
ReleaseMutex
RaiseException
MultiByteToWideChar
ResetEvent
SetEvent
CreateMutexW
EnterCriticalSection
InterlockedExchange
LCMapStringW
InterlockedIncrement
GetVersionExW
GetVersionExA
HeapAlloc
CreateFileW
InterlockedDecrement
LoadLibraryA
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
HeapSetInformation
GlobalAlloc
GlobalLock
MulDiv
HeapFree
OpenProcess
GetModuleHandleW

user32

IsChild
DefWindowProcW
GetDesktopWindow
DispatchMessageW
RegisterClassExW
ShowWindow
TranslateMessage
DestroyMenu
SystemParametersInfoW
GetWindowTextLengthW
SetClipboardData
GetWindowTextW
AppendMenuW
SetFocus
CreateWindowExW
SendMessageW
SetCapture
SetTimer
CloseClipboard
PeekMessageW
SetWindowLongW
GetWindowLongW
CharNextW
GetMessageW
SetCursor
UnregisterClassA
ScreenToClient
RegisterWindowMessageW
MonitorFromWindow
AttachThreadInput
KillTimer
GetForegroundWindow
GetDC
InvalidateRgn
DestroyIcon
SetProcessDefaultLayout
GetCursorPos
FindWindowW
GetClientRect
PostMessageW
SetWindowPos
LoadCursorW
UpdateLayeredWindow
ClientToScreen
GetSysColor
PtInRect
IsWindow
CallNextHookEx
GetWindowThreadProcessId
SetForegroundWindow
RedrawWindow
ReleaseDC
DialogBoxIndirectParamW
SetWindowsHookExW
DestroyWindow
GetDlgItem
OpenClipboard
ReleaseCapture
PostThreadMessageW
CreateAcceleratorTableW
GetClassInfoExW
UnhookWindowsHookEx
GetWindow
TrackPopupMenu
GetMonitorInfoW
SetWindowTextW
AllowSetForegroundWindow
BeginPaint
GetKeyState
GetFocus
EndPaint
InvalidateRect
GetWindowRect
CreatePopupMenu
PostQuitMessage
MoveWindow
FillRect
EndDialog
GetParent
GetClassNameW
CallWindowProcW
DestroyAcceleratorTable
MapDialogRect
SendDlgItemMessageW
LoadIconW
SetWindowContextHelpId

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

crypt32

CryptUnprotectData
CryptProtectData

secur32

GetUserNameExW

shlwapi

UrlCanonicalizeW
UrlApplySchemeW
PathCombineW
UrlGetPartW
UrlCombineW
PathAppendW

ddraw

DirectDrawCreate
DirectDrawEnumerateA
DirectDrawCreateEx

wtsapi32

WTSEnumerateSessionsW
WTSQuerySessionInformationW
WTSUnRegisterSessionNotification
WTSFreeMemory
WTSRegisterSessionNotification

gdi32

GetStockObject
DeleteDC
CreateSolidBrush
SelectObject
CreateCompatibleDC
DeleteObject
GetDeviceCaps
BitBlt
CreateCompatibleBitmap
GetObjectW

shell32

FindExecutableW
CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW
SHAppBarMessage
Shell_NotifyIconW
ShellExecuteExW

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2e45c9144e684d902da2fc74b9f6070b

Headers

File Characteristics

Imports

gdiplus

ole32

netapi32

kernel32

user32

version

crypt32

secur32

shlwapi

ddraw

wtsapi32

gdi32

shell32

Sections

.text Size: 52KB - Virtual size: 52KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 39KB - Virtual size: 39KB

.rsrc Size: 1024B - Virtual size: 56KB

.text
Size: 52KB - Virtual size: 52KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 39KB - Virtual size: 39KB

.rsrc
Size: 1024B - Virtual size: 56KB