dcd84ded1c88e47d7dd06aaa1b5a01f4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

dcd84ded1c88e47d7dd06aaa1b5a01f4_JaffaCakes118
Size

501KB
MD5

dcd84ded1c88e47d7dd06aaa1b5a01f4
SHA1

2b82f61ea3ce27a3cf92ae9738800dcdb21694c8
SHA256

43bd47ef9c0259ea56b381c6d06b034246baf23ffe7839276f0a246fb1da9362
SHA512

eb13d97bc4051d1751bdad3fd53c350e4c26597004ef5161b4efc24cd8a8ac531b0b7e8174e7cbaa9c1722be0a3480bd608d586fd375e6f0776d0bb0d0554c4c
SSDEEP

12288:s4iKDhXeItiNqaT/uGIG7byAcG+8Ptav+oBRMuOJFu6:3ZW1T/upG7+98U5MuO2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dcd84ded1c88e47d7dd06aaa1b5a01f4_JaffaCakes118

Files

dcd84ded1c88e47d7dd06aaa1b5a01f4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1dc8b649906325eba4d2b479825f4d93

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

urlmon

URLDownloadToCacheFileW

rpcrt4

UuidCreate

kernel32

FindResourceExW
FindResourceW
MultiByteToWideChar
RemoveDirectoryW
WritePrivateProfileStringW
LoadResource
GetLastError
SizeofResource
LockResource
lstrlenA
DeleteFileW
GetProcessId
ExitProcess
RaiseException
GetThreadLocale
SetThreadLocale
GetUserDefaultLCID
GetLocaleInfoW
VirtualAlloc
LocalAlloc
CloseHandle
LocalFree
GetFileSize
ReadFile
WideCharToMultiByte
WriteFile
CreateFileW
SetEvent
CreateEventW
TerminateThread
WaitForSingleObject
ResetEvent
CopyFileW
LCMapStringW
IsBadReadPtr
IsBadWritePtr
GetSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
CreateFileA
InterlockedExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
GetModuleHandleA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
FindClose
InitializeCriticalSection
FindNextFileW
InterlockedDecrement
FindFirstFileW
InterlockedIncrement
GetACP
GetLocaleInfoA
Sleep
VirtualFree
InterlockedCompareExchange
HeapAlloc
HeapDestroy
GetVersionExA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
UnhandledExceptionFilter

user32

DestroyWindow
wsprintfW
wsprintfA
CharNextW
UnregisterClassA

advapi32

RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegDeleteKeyW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey

gdi32

DeleteObject
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontIndirectW
PatBlt
CreatePatternBrush
CreateBitmap
GetFontData
DeleteDC
StretchBlt
SetBrushOrgEx
SetStretchBltMode
ExtTextOutW
SetBkColor
GetDeviceCaps
MoveToEx
LineTo
TextOutW
SetTextColor
ExtCreatePen
GetTextExtentPointW
SetBkMode
SelectObject
GetTextExtentPoint32W
GetTextMetricsW
BitBlt

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHFileOperationW

shlwapi

PathAppendW
SHCreateStreamOnFileW
PathRemoveFileSpecW
PathRenameExtensionW
PathFileExistsW

wininet

HttpAddRequestHeadersW
HttpSendRequestW
InternetConnectW
InternetQueryDataAvailable
InternetSetOptionW
HttpSendRequestExW
HttpEndRequestW
InternetCloseHandle
InternetOpenW
InternetQueryOptionW
HttpQueryInfoW
InternetReadFile
InternetWriteFile
HttpOpenRequestW
InternetCrackUrlW

Sections

.text
Size: 311KB - Virtual size: 310KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 150KB - Virtual size: 468KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1dc8b649906325eba4d2b479825f4d93

Headers

File Characteristics

Imports

urlmon

rpcrt4

kernel32

user32

advapi32

gdi32

shell32

shlwapi

wininet

Sections

.text Size: 311KB - Virtual size: 310KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 150KB - Virtual size: 468KB

.rsrc Size: 35KB - Virtual size: 36KB

.text
Size: 311KB - Virtual size: 310KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 150KB - Virtual size: 468KB

.rsrc
Size: 35KB - Virtual size: 36KB