e22ea10a00b69dfdce6a61965340f1c0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e22ea10a00b69dfdce6a61965340f1c0_JaffaCakes118
Size

340KB
MD5

e22ea10a00b69dfdce6a61965340f1c0
SHA1

101b41aef49282610e3109bab5b6d3b7a4e7c19e
SHA256

afc3d2a0e3b21b16eaaacfc95b8bd2f0f65cd695f13d52cf5f72245c2739c04a
SHA512

cea74e6f813b32ade60f5f2c1d441703476ee0f75209c901ac1a9ba6fdb1cdd7f58fb6273e537a021236a04000f306501c1161a26d4c78939e7a9663a74b985a
SSDEEP

6144:51IlLD67Q7uTTJi/OQPc7m7DiUOaeNuEKVvmjjB5J/pST:oLwQiY/OQUSdOaIKVejb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e22ea10a00b69dfdce6a61965340f1c0_JaffaCakes118

Files

e22ea10a00b69dfdce6a61965340f1c0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e687239a2359b51f02f980d39a359b81

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

ws2_32

recvfrom
recv
ntohs
ioctlsocket
inet_ntoa
inet_addr
htons
htonl
getservbyport
getservbyname
send
gethostbyaddr
connect
closesocket
bind
accept
WSAStringToAddressA
WSAStartup
WSASetLastError
WSAGetLastError
WSACleanup
WSAAsyncSelect
sendto
socket
gethostbyname

kernel32

GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessVersion
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemTime
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetUserDefaultLCID
GetVersion
GetVersionExA
GetVersionExW
GetWindowsDirectoryA
GlobalAddAtomW
GlobalAlloc
GlobalDeleteAtom
GlobalFindAtomW
GlobalFlags
GlobalFree
GlobalGetAtomNameW
GlobalHandle
GlobalLock
GlobalReAlloc
GlobalUnlock
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsBadCodePtr
IsBadReadPtr
IsBadWritePtr
IsValidCodePage
IsValidLocale
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
GetModuleFileNameW
LocalFree
LocalReAlloc
MultiByteToWideChar
RaiseException
ReadFile
ReleaseMutex
RtlUnwind
SetConsoleCtrlHandler
SetEnvironmentVariableA
SetErrorMode
SetEvent
SetFilePointer
SetHandleCount
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
WritePrivateProfileStringW
WriteProfileStringW
lstrcatW
lstrcmpA
lstrcmpW
lstrcmpiA
lstrcmpiW
ExitProcess
lstrcpynW
lstrlenA
lstrlenW
CloseHandle
CompareStringA
CompareStringW
CreateEventA
CreateEventW
CreateFileA
CreateMutexA
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
EnumSystemLocalesA
GetModuleFileNameA
GetLocaleInfoW
GetLocaleInfoA
GetLocalTime
GetLastError
lstrcpyW
GetFileType
GetEnvironmentVariableW
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStringsA
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess
GetConsoleWindow
GetComputerNameW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetACP
FreeLibrary
FreeEnvironmentStringsW
FreeEnvironmentStringsA
FreeConsole
LocalAlloc
FlushFileBuffers

user32

GetMessagePos
GetMessageTime
GetMessageW
GetNextDlgTabItem
GetParent
GetPropW
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMetrics
GetTopWindow
GetWindow
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextW
GrayStringW
InvalidateRect
IsIconic
IsWindow
IsWindowEnabled
IsWindowVisible
KillTimer
LoadAcceleratorsW
LoadBitmapW
LoadCursorW
LoadIconW
LoadMenuW
LoadStringW
MapWindowPoints
MessageBoxW
ModifyMenuW
PeekMessageW
PostMessageW
PostQuitMessage
PtInRect
RegisterClassW
RegisterWindowMessageW
ReleaseCapture
ReleaseDC
RemovePropW
ReuseDDElParam
ScreenToClient
SendMessageTimeoutW
SendMessageW
SetActiveWindow
SetCursor
SetFocus
SetForegroundWindow
SetMenu
SetMenuItemBitmaps
SetPropW
SetRectEmpty
SetTimer
GetMenuState
SetWindowPos
SetWindowTextW
SetWindowsHookExW
ShowOwnedPopups
ShowWindow
SystemParametersInfoW
TabbedTextOutW
TranslateAcceleratorW
TranslateMessage
UnhookWindowsHookEx
UnpackDDElParam
UnregisterClassW
UpdateWindow
ValidateRect
WaitMessage
WinHelpW
wsprintfW
GetMenuCheckMarkDimensions
GetMenu
GetLastActivePopup
GetKeyState
GetForegroundWindow
GetFocus
GetDlgItem
GetDlgCtrlID
GetDesktopWindow
GetDC
GetCursorPos
GetClientRect
GetClassNameW
GetClassInfoW
GetCapture
GetActiveWindow
EqualRect
EnumWindows
EnumThreadWindows
EndDeferWindowPos
EnableMenuItem
DrawTextW
DispatchMessageW
DestroyWindow
DestroyMenu
DeferWindowPos
DefWindowProcW
CreateWindowExW
CopyRect
ClientToScreen
CheckMenuItem
CallWindowProcW
CallNextHookEx
BringWindowToTop
BeginDeferWindowPos
AdjustWindowRectEx
GetMenuItemID
SetWindowLongW
GetMenuItemCount
EnableWindow

gdi32

CreateBitmap
DeleteObject
Escape
ExtTextOutW
GetClipBox
GetDeviceCaps
GetObjectW
GetStockObject
OffsetViewportOrgEx
PtVisible
RectVisible
RestoreDC
SaveDC
ScaleViewportExtEx
ScaleWindowExtEx
SelectObject
SetBkColor
SetMapMode
SetTextColor
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
TextOutW
DeleteDC

advapi32

OpenProcessToken
CloseServiceHandle
LookupAccountSidW
LookupAccountNameW
IsValidSid
SetThreadToken
SetSecurityDescriptorDacl
RevertToSelf
ReportEventA
RegisterEventSourceA
RegSetValueExW
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegQueryValueA
RegOpenKeyW
RegOpenKeyExW
RegOpenKeyExA
RegOpenKeyA
RegNotifyChangeKeyValue
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExW
RegCreateKeyExA
RegCloseKey
QueryServiceStatus
OpenThreadToken
OpenServiceW
OpenSCManagerW
InitializeSecurityDescriptor
GetUserNameW
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
FreeSid
EqualSid
DeregisterEventSource
AllocateAndInitializeSid

shell32

DragFinish
DragQueryFileW

comctl32

ord17

Exports

Exports

JetAddColumn
JetAttachDatabase
JetBackup
JetBeginExternalBackup
JetBeginSession
JetBeginTransaction
JetCloseDatabase
JetCloseFile
JetCloseTable
JetCommitTransaction
JetCompact
JetComputeStats
JetCreateDatabase
JetCreateIndex
JetCreateLink
JetCreateQuery
JetCreateTable
JetCreateTableColumnIndex
JetDBUtilities
JetDelete
JetDeleteColumn
JetDeleteIndex
JetDeleteTable
JetDetachDatabase
JetDupCursor
JetDupSession
JetEndExternalBackup
JetEndSession
JetExecuteSql
JetExternalRestore
JetGetAttachInfo
JetGetBookmark
JetGetChecksum
JetGetColumnInfo
JetGetCounter
JetGetCurrentIndex
JetGetCursorInfo
JetGetDatabaseInfo
JetGetIndexInfo
JetGetLogInfo
JetGetObjectInfo
JetGetObjidFromName
JetGetQueryParameterInfo
JetGetRecordPosition
JetGetSystemParameter
JetGetTableColumnInfo
JetGetTableIndexInfo
JetGetTableInfo
JetGetVersion
JetGotoBookmark
JetGotoPosition
JetIdle
JetIndexRecordCount
JetInit
JetMakeKey
JetMove
JetOpenDatabase
JetOpenFile
JetOpenQueryDef
JetOpenTable
JetOpenTempTable
JetOpenTempTable2
JetPrepareUpdate
JetReadFile
JetResetCounter
JetRestore
JetRestore2
JetRetrieveColumn
JetRetrieveColumns
JetRetrieveKey
JetRetrieveQoSql
JetRollback
JetSeek
JetSetAccess
JetSetColumn
JetSetColumns
JetSetCurrentIndex
JetSetCurrentIndex2
JetSetIndexRange
JetSetQoSql
JetSetSystemParameter
JetTerm
JetTerm2
JetTruncateLog
JetUpdate

Sections

.text
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 80KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e687239a2359b51f02f980d39a359b81

Headers

File Characteristics

Imports

version

ws2_32

kernel32

user32

gdi32

advapi32

shell32

comctl32

Exports

Exports

Sections

.text Size: 160KB - Virtual size: 160KB

.rdata Size: 52KB - Virtual size: 52KB

.data Size: 80KB - Virtual size: 1.7MB

.idata Size: 12KB - Virtual size: 12KB

.rsrc Size: 32KB - Virtual size: 32KB

.text
Size: 160KB - Virtual size: 160KB

.rdata
Size: 52KB - Virtual size: 52KB

.data
Size: 80KB - Virtual size: 1.7MB

.idata
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 32KB - Virtual size: 32KB