e2eb762d6d248fec5b8af8ab437cfdc2_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

e2eb762d6d248fec5b8af8ab437cfdc2_JaffaCakes118
Size

361KB
MD5

e2eb762d6d248fec5b8af8ab437cfdc2
SHA1

c6be1c85d65136e6ce2cc098db499837d2c5ea9e
SHA256

e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28
SHA512

0c85ede00a5ae7d0fe5aabfb9b662c6329922e6278bc80b59384234891a1383fe53d7931b9ca7d52ac95a355cd10840a4886a268238e347077d91fb0ba7d3a33
SSDEEP

6144:Co1FG6NxV4I+OAlUtWgH5MigzOjI5jqBtsimuD1X19XjK7kA:Co1kwxiI+OCUtW2MlOm3UD1XzKoA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
e2eb762d6d248fec5b8af8ab437cfdc2_JaffaCakes118

Files

e2eb762d6d248fec5b8af8ab437cfdc2_JaffaCakes118
.exe windows:5 windows x86 arch:x86

686c1f8b8d12c95beafa94d3bf0f0a4d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\20112012\Mtime\desired\spectrog.pdb

Imports

kernel32

LockResource
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetCurrentProcessId
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
HeapSize
ReadFile
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
SetFilePointer
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
CreateFileMappingA
LoadLibraryA
GlobalFree
GetLastError
FindFirstFileA
GetStdHandle
FlushFileBuffers
DisconnectNamedPipe
GlobalUnlock
CreateFileW
GetModuleFileNameW
HeapCreate
SizeofResource
GlobalAlloc
FindResourceExA
EnumResourceTypesA
WriteFile
GlobalLock
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
InterlockedIncrement
GetCPInfo
GetFileType
SetHandleCount
GetProcAddress
Sleep
GetModuleHandleW
HeapReAlloc
VirtualAlloc
VirtualFree
DeleteCriticalSection
HeapFree
RtlUnwind
RaiseException
GetStartupInfoA
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedDecrement
UpdateResourceA
HeapAlloc
LeaveCriticalSection
EnterCriticalSection
LoadResource
VirtualQuery
FreeResource
ExitProcess

user32

LoadIconA
AttachThreadInput
SetForegroundWindow
MenuItemFromPoint
FindWindowW
GetClientRect
DrawTextA
GetMenuItemID
RegisterWindowMessageW
SendMessageA
EnumDisplayDevicesA
EndDeferWindowPos
BeginPaint
wsprintfW
PostQuitMessage
ScreenToClient
EndPaint
GetMenu
OffsetRect
GetWindowLongA
DefWindowProcA
GetCursorPos
EnumChildWindows
GetSysColorBrush
GetWindowTextA
LoadCursorA
FindWindowA
SendMessageW
LoadImageA
MessageBoxA
UnhookWindowsHookEx

gdi32

MoveToEx
BitBlt
LineTo
CreateEnhMetaFileA
SetTextColor
DeleteDC
CreateDCA
SetPixel
CreatePalette
SelectObject
CreateCompatibleDC
Rectangle
SetStretchBltMode
GetObjectA
GetStockObject
CreateSolidBrush

winspool.drv

GetPrinterDataA
EndPagePrinter
StartDocPrinterA
StartPagePrinter
ClosePrinter
EnumPrintersA
OpenPrinterA
EndDocPrinter
WritePrinter

shell32

Shell_NotifyIconA

ole32

CreateBindCtx
MkParseDisplayName
CreateStreamOnHGlobal
GetHGlobalFromStream
CoGetMalloc
CreateItemMoniker
CoMarshalInterface
CoUnmarshalInterface
CoInitialize
CoCreateInstance
GetRunningObjectTable

oleaut32

OleCreatePictureIndirect

ws2_32

ioctlsocket
inet_addr
WSASocketA
bind
WSASendTo
closesocket
WSAHtons
WSAHtonl

winmm

timeBeginPeriod
PlaySoundW

crypt32

CryptImportPKCS8
CryptHashToBeSigned

shlwapi

UrlGetPartW
wnsprintfA

gdiplus

GdipDeleteBrush
GdipFree
GdipSetPathGradientCenterColor
GdiplusStartup
GdipFillEllipseI
GdipCreatePath
GdipCreateFromHDC
GdipDeletePath
GdipAlloc
GdipGetPathGradientPointCount
GdipCreatePathGradientFromPath
GdipAddPathEllipseI
GdipDeleteGraphics
GdipSetPathGradientSurroundColorsWithCount
GdipCloneBrush

traffic

TcCloseInterface

dciman32

DCISetSrcDestClip
GetWindowRegionData
GetDCRegionData

mscms

OpenColorProfileA

Sections

.text
Size: 239KB - Virtual size: 239KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

686c1f8b8d12c95beafa94d3bf0f0a4d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

winspool.drv

shell32

ole32

oleaut32

ws2_32

winmm

crypt32

shlwapi

gdiplus

traffic

dciman32

mscms

Sections

.text Size: 239KB - Virtual size: 239KB

.rdata Size: 26KB - Virtual size: 26KB

.data Size: 6KB - Virtual size: 13KB

.rsrc Size: 78KB - Virtual size: 78KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 239KB - Virtual size: 239KB

.rdata
Size: 26KB - Virtual size: 26KB

.data
Size: 6KB - Virtual size: 13KB

.rsrc
Size: 78KB - Virtual size: 78KB

.reloc
Size: 10KB - Virtual size: 9KB