ea39946de1215764814e8881070148c6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ea39946de1215764814e8881070148c6_JaffaCakes118
Size

3.1MB
MD5

ea39946de1215764814e8881070148c6
SHA1

0e1291b3dc40f1805e816deef0248d75f7eebe59
SHA256

74ce2c149ee089abe36624e2e99b0be29387ff563ee6ce337e36eeebd7e9f2f8
SHA512

a72369d8e1993d16736e9b0380c37f4bae85ed2661be28d00c12ffa23ac125b17339a0c07ccba279265adf96126a2ca52f865a3ed54eef634f9d83881d8ec7be
SSDEEP

49152:NCNvlRJipkO+G6iG9YKt41zmEYlC+O5yEtORWBo/y4CWwAnYQH5c9TWKs8E2fmXQ:eRJ6kThSxA0tORGo/y4sAYQHwT2rKjm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ea39946de1215764814e8881070148c6_JaffaCakes118

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

Files

ea39946de1215764814e8881070148c6_JaffaCakes118
.exe windows:5 windows x86 arch:x86

fc5049154ace0d189c94d3f27e8e85e2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\arc\Release\Arc.pdb

Imports

wininet

InternetCanonicalizeUrlA
InternetQueryDataAvailable
InternetCloseHandle
InternetGetLastResponseInfoA
InternetOpenA
InternetSetStatusCallback
InternetSetFilePointer
InternetWriteFile
InternetReadFile
HttpSendRequestA
InternetConnectA
InternetGetCookieA
InternetSetCookieA
InternetCrackUrlA
HttpOpenRequestA

iphlpapi

GetIfEntry

kernel32

LockFile
UnlockFile
GetFileSize
DuplicateHandle
GetCurrentProcess
FindFirstFileA
GetVolumeInformationA
GetFullPathNameA
CreateFileA
WritePrivateProfileStringA
GetCurrentDirectoryA
GlobalFlags
GlobalReAlloc
GlobalHandle
LocalReAlloc
FindResourceExA
GetCPInfo
GetOEMCP
GetModuleHandleW
GetFileAttributesA
GetFileTime
SetErrorMode
GetTickCount
GetSystemTimeAsFileTime
ExitProcess
HeapFree
HeapAlloc
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
MoveFileW
GetDriveTypeW
GetFullPathNameW
ExitThread
CreateThread
GetFileType
GetDriveTypeA
VirtualQuery
HeapSize
SetStdHandle
GetStdHandle
IsValidCodePage
SetHandleCount
GetConsoleCP
GetConsoleMode
HeapCreate
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
LocalAlloc
InitializeCriticalSection
FileTimeToLocalFileTime
FileTimeToSystemTime
GetModuleFileNameW
FlushFileBuffers
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetVersionExA
GetThreadLocale
GetCurrentProcessId
GlobalAddAtomA
VirtualProtect
FreeResource
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
CompareStringA
lstrcmpA
LoadLibraryA
FreeLibrary
CancelIo
QueryPerformanceCounter
QueryPerformanceFrequency
CreateSemaphoreW
ReleaseSemaphore
Sleep
GetVersionExW
CreateWaitableTimerW
SetLastError
GetQueuedCompletionStatus
SetWaitableTimer
TlsSetValue
TlsGetValue
InterlockedCompareExchange
GetCurrentThreadId
GetModuleHandleA
GetProcAddress
CreateIoCompletionPort
GlobalMemoryStatusEx
VirtualLock
VirtualUnlock
SleepEx
WaitForMultipleObjects
TerminateThread
QueueUserAPC
ResetEvent
WaitForSingleObject
SetEvent
GetDiskFreeSpaceW
FindFirstFileW
DeleteFileW
RemoveDirectoryW
CopyFileW
CreateDirectoryW
WriteFile
WriteFileGather
CreateFileW
DeviceIoControl
GetFileSizeEx
SetEndOfFile
SetFilePointerEx
ReadFile
CreateEventW
ReadFileScatter
CloseHandle
GetOverlappedResult
FindNextFileW
FindClose
VirtualFree
VirtualAlloc
GetSystemInfo
PostQueuedCompletionStatus
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LocalFree
MulDiv
GetTempPathA
GetModuleFileNameA
FormatMessageA
GetACP
lstrcpyA
MultiByteToWideChar
lstrlenA
GlobalLock
GlobalAlloc
GlobalFree
GlobalUnlock
LockResource
SizeofResource
LoadResource
FindResourceA
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
TlsFree
TlsAlloc
InterlockedExchangeAdd
GetLastError
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
SetFilePointer
TerminateProcess

user32

CopyAcceleratorTableA
CharUpperA
SetCapture
SetWindowRgn
DrawIcon
IsRectEmpty
GetMenuItemInfoA
InflateRect
UnpackDDElParam
ReuseDDElParam
LoadMenuA
DestroyMenu
ReleaseCapture
LoadAcceleratorsA
InsertMenuItemA
CreatePopupMenu
SetRectEmpty
BringWindowToTop
TranslateAcceleratorA
GetDesktopWindow
CreateDialogIndirectParamA
EndDialog
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
MoveWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetClassLongA
GetClassNameA
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
BeginDeferWindowPos
EndDeferWindowPos
SetRect
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
UpdateWindow
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
EqualRect
GetScrollInfo
SetScrollInfo
DefWindowProcA
CallWindowProcA
GetMenu
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
IsWindow
OffsetRect
PtInRect
CopyRect
GetDlgCtrlID
CharNextA
GetWindowThreadProcessId
GetLastActivePopup
MessageBoxA
ShowOwnedPopups
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
IsWindowVisible
GetKeyState
PeekMessageA
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
PostThreadMessageA
RegisterClipboardFormatA
ModifyMenuA
GetMenuState
EnableMenuItem
UnregisterClassA
GetSysColorBrush
GetNextDlgGroupItem
GetTopWindow
InvalidateRgn
CheckMenuItem
SetPropA
GetCapture
GetActiveWindow
SetActiveWindow
GetPropA
RemovePropA
GetAsyncKeyState
GetFocus
SetFocus
GetWindowLongA
GetDlgItem
IsWindowEnabled
SetWindowContextHelpId
SetWindowPos
PostMessageA
PostQuitMessage
MapDialogRect
ScreenToClient
GetCursorPos
GetSystemMenu
InsertMenuA
SetWindowLongA
MessageBeep
SetTimer
GetParent
KillTimer
GetClientRect
GetWindow
ShowWindow
SendMessageA
LoadCursorA
LoadIconA
GetWindowRect
InvalidateRect
EnableWindow
DeferWindowPos
GetNextDlgTabItem

gdi32

ExtSelectClipRgn
DeleteDC
CreatePatternBrush
CreateSolidBrush
CreateRectRgnIndirect
LPtoDP
Ellipse
GetRgnBox
GetWindowExtEx
EnumFontFamiliesExA
GetViewportExtEx
GetMapMode
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
CreateFontIndirectA
DeleteObject
CreateEllipticRgn
GetStockObject
SetMapMode
SetBkMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
GetObjectA
CreateBitmap
SelectObject
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
GetTextColor
GetTextExtentPoint32A
CreateFontA
GetBkColor
GetPixel

msimg32

GradientFill

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
DragFinish
DragQueryFileA
ShellExecuteA

comctl32

InitCommonControlsEx
ord17

shlwapi

PathFindFileNameA
UrlUnescapeA
PathStripToRootA
PathIsUNCA
PathFindExtensionA

oledlg

ord8

ole32

OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoRevokeClassObject
CoTaskMemAlloc
CLSIDFromString
CLSIDFromProgID
CoTaskMemFree
CreateStreamOnHGlobal
CoRegisterMessageFilter
OleFlushClipboard
CoGetClassObject
OleIsCurrentClipboard

oleaut32

VariantCopy
SafeArrayDestroy
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocString
SysAllocStringByteLen
SysStringLen
VariantInit
VariantChangeType
VariantClear
OleCreateFontIndirect
SysAllocStringLen
SysFreeString

gdiplus

GdipCreateBitmapFromStream
GdipCloneImage
GdipDrawImageI
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup

ws2_32

socket
WSAIoctl
WSARecvFrom
WSASendTo
getpeername
inet_addr
select
WSARecv
getsockopt
WSAStartup
WSACleanup
WSASetLastError
ntohl
htonl
ntohs
htons
WSAGetLastError
bind
setsockopt
getsockname
listen
WSASend
WSASocketW
WSAAddressToStringA
WSAStringToAddressA
gethostbyname
getservbyname
closesocket
ioctlsocket
__WSAFDIsSet
accept
connect

mswsock

GetAcceptExSockaddrs
AcceptEx

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 240KB - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 45KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 126KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fc5049154ace0d189c94d3f27e8e85e2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wininet

iphlpapi

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

gdiplus

ws2_32

mswsock

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 240KB - Virtual size: 240KB

.data Size: 45KB - Virtual size: 65KB

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.reloc Size: 126KB - Virtual size: 126KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 240KB - Virtual size: 240KB

.data
Size: 45KB - Virtual size: 65KB

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

.reloc
Size: 126KB - Virtual size: 126KB