dca5803d1f682856b86dba766818a50f_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

dca5803d1f682856b86dba766818a50f_JaffaCakes118
Size

54KB
MD5

dca5803d1f682856b86dba766818a50f
SHA1

9b7b9ca285b0991f4300d76d24a21ee90acf467e
SHA256

44c2fa40fba22319c0dc6910d7dd2cb7d1680a23a98d8af38572dd7936b0309e
SHA512

4958b083ec3f0b32f1f0b79d79ff8c5a8449b9dfc7a8cf7f2b0c3c5acc000743739b826e4d1a40cabac4597e9cd3ec08ad5a17e541dca68dcd10a7c6ebd78b70
SSDEEP

1536:nuVr87LjcrIe8Tp1muFxDQv962O8rqSHe6+Q:eI7s18NwmGQNPSHe69

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dca5803d1f682856b86dba766818a50f_JaffaCakes118

Files

dca5803d1f682856b86dba766818a50f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

97c315c749c8e9e8dd52a13c52179cb8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

RpcEpResolveBinding
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingFree
NdrClientCall2
RpcBindingSetAuthInfoExW
UuidCreate
RpcStringFreeW

mpr

WNetGetResourceInformationW
WNetGetNetworkInformationW
WNetGetConnectionW

userenv

UnloadUserProfile

comctl32

ImageList_GetIcon
ImageList_AddMasked
ImageList_SetOverlayImage
ImageList_Create
PropertySheetW
ImageList_Destroy
CreatePropertySheetPageW
InitCommonControlsEx
ImageList_ReplaceIcon
DestroyPropertySheetPage
ImageList_Remove

ntdsapi

DsMakeSpnW

user32

SetForegroundWindow
SendDlgItemMessageW
RegisterClassW
EndDialog
SetMenuItemInfoW
PostMessageW
GetSystemMetrics
EnableWindow
SetTimer
DestroyWindow
RemoveMenu
WinHelpW
DialogBoxParamW
GetWindowRect
GetClientRect
GetWindowThreadProcessId
DestroyMenu
GetParent
FindWindowW
CreateWindowExW
SetWindowPos
GetDlgItem
SetFocus
CheckRadioButton
CheckMenuItem
GetDC
GetMenuItemInfoW
MessageBeep
GetLastActivePopup
SwitchToThisWindow
LoadStringW
MessageBoxW
RegisterWindowMessageW
GetDlgItemInt
SetMenuDefaultItem
GetKeyState
GetForegroundWindow
LoadCursorW
SetCursor
GetWindowTextW
TrackPopupMenu
GetClassNameW
SystemParametersInfoW
GetDlgItemTextW
LoadMenuW
GetMenuItemCount
KillTimer
ReleaseDC
EnumChildWindows
InvalidateRect
DefWindowProcW
EnableMenuItem
IsWindow
SetDlgItemTextW
GetWindowTextLengthW
DestroyIcon
GetWindow
LoadImageW
ValidateRect
CheckDlgButton
RegisterClipboardFormatW
SetWindowLongW
SetWindowTextW
EnumWindows
MapWindowPoints
IsDlgButtonChecked
SendMessageW
GetClassInfoW
GetSubMenu
GetWindowLongW
GetMenuItemID
ShowWindow

winmm

auxOutMessage

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathFindExtensionW

secur32

GetUserNameExW

shell32

SHChangeNotify
SHGetPathFromIDListW
SHFileOperationW
SHExtractIconsW
ShellExecuteW
DragQueryFileW
SHGetFolderPathW

kernel32

GlobalReAlloc
CloseHandle
SetCurrentDirectoryW
GetFileSize
GetCurrentDirectoryW
CreateFileW
GetDateFormatW
GetLocaleInfoW
DeleteCriticalSection
MulDiv
GetComputerNameExW
GetUserDefaultUILanguage
SearchPathW
UnmapViewOfFile
SetEndOfFile
InterlockedDecrement
InitializeCriticalSection
ReleaseActCtx
ExpandEnvironmentStringsW
FileTimeToSystemTime
GlobalAlloc
SetWaitableTimer
FindClose
SystemTimeToFileTime
UnhandledExceptionFilter
CreateWaitableTimerW
FindFirstFileW
GetTimeFormatW
MapViewOfFile
GetLocalTime
GetFullPathNameW
GetFileAttributesW
Sleep
CreateFileMappingW
SetFileTime
DuplicateHandle
LoadResource
GetFileType
IsBadStringPtrW
GlobalLock
LeaveCriticalSection
GetComputerNameW
SetFilePointer
FreeLibrary
LocalAlloc
LocalFree
SetErrorMode
GlobalFree
IsBadWritePtr
WriteFile
GetTickCount
LockResource
InterlockedIncrement
CancelWaitableTimer
lstrlenW
GetCurrentThread
GetDriveTypeW
DeactivateActCtx
ReadFile
CreateDirectoryW
lstrcmpiW
lstrcpynW
DeleteFileW
GetCurrentProcessId
LocalReAlloc
CompareStringW
lstrcmpW
VirtualAlloc
ExitThread
GetCurrentProcess
GetUserDefaultLCID
CreateThread
FormatMessageW
SetUnhandledExceptionFilter
FindNextFileW
CompareFileTime
GlobalUnlock
WideCharToMultiByte
GetProcAddress
TerminateProcess
QueryPerformanceCounter
GetLastError
GetSystemTimeAsFileTime
GetEnvironmentVariableW
GetVersionExW
EnterCriticalSection
GetVolumeInformationW
GetCurrentActCtx
lstrcmpA
OpenProcess
GetSystemTime
DisableThreadLibraryCalls
ActivateActCtx
GetCurrentThreadId
FindResourceW
LoadLibraryW
GetFileTime

ole32

CoTaskMemAlloc
OleSetClipboard
OleInitialize
ReleaseStgMedium
CoTaskMemFree
CoCreateInstance
OleGetClipboard
OleUninitialize
CoGetCallContext

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

msvcrt

_itow
wcsncmp
wcscmp
wcsspn
setlocale
_purecall
wcstoul
wcslen
wcspbrk
memmove
wcsstr
_initterm
_wcsicmp
mbstowcs
wcsrchr
wcsncpy
malloc
wcstombs
_adjust_fdiv
_wcsnicmp
_except_handler3
rand
iswctype
free
wcschr
_vsnwprintf

gdi32

BitBlt
GetObjectW
CreateCompatibleDC
SelectObject
CreatePalette
SelectPalette
GetDeviceCaps
CreateDIBitmap
CreateFontIndirectW
RealizePalette
DeleteObject
DeleteDC
GetStockObject

comdlg32

CommDlgExtendedError
GetOpenFileNameW

lz32

LZClose

advapi32

OpenProcessToken
GetUserNameW
RegOpenKeyExW
RegCloseKey
ControlService
QueryServiceStatus
AllocateAndInitializeSid
RegSetValueExW
ImpersonateSelf
LookupPrivilegeValueW
CheckTokenMembership
SetSecurityDescriptorOwner
AdjustTokenPrivileges
RegQueryValueExW
OpenSCManagerW
OpenThreadToken
GetSecurityInfo
RevertToSelf
CloseServiceHandle
RegDeleteKeyW
SetEntriesInAclW
OpenServiceW
SetSecurityInfo
GetFileSecurityW
RegEnumKeyExW
AccessCheck
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegConnectRegistryW
StartServiceW
FreeSid
LookupAccountSidW
GetTokenInformation

Sections

.textbss
Size: 43KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

97c315c749c8e9e8dd52a13c52179cb8

Headers

File Characteristics

Imports

rpcrt4

mpr

userenv

comctl32

ntdsapi

user32

winmm

shlwapi

secur32

shell32

kernel32

ole32

version

msvcrt

gdi32

comdlg32

lz32

advapi32

Sections

.textbss Size: 43KB - Virtual size: 1.3MB

.text Size: 512B - Virtual size: 420B

.idata Size: 8KB - Virtual size: 8KB

.rdata Size: 512B - Virtual size: 32B

.reloc Size: 512B - Virtual size: 4B

.textbss
Size: 43KB - Virtual size: 1.3MB

.text
Size: 512B - Virtual size: 420B

.idata
Size: 8KB - Virtual size: 8KB

.rdata
Size: 512B - Virtual size: 32B

.reloc
Size: 512B - Virtual size: 4B