eab440358f54075b5e222012d0089b28_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

eab440358f54075b5e222012d0089b28_JaffaCakes118
Size

93KB
MD5

eab440358f54075b5e222012d0089b28
SHA1

b02be079b6c75fa50e33f233a3bb1aa72e8d2a81
SHA256

4567d1e0ceaba11091eb2bc625ef58fc9fd704cebf84cd81c16067ad589e4c8f
SHA512

2e8a18d8e6fdda6a8ba046e1366f8332119c4a88ee1692f6348b7360d3f3d395ee23411b5522a6ee0faa9280fcb07d908728bdc5ada9f96942bb5cafe40f17ac
SSDEEP

1536:bwH8glr3QF/GTqg8HLhobQLAfm5b8HLljs2mwEhstzWrYa6:2rlr39Og8HlKQLAfMmLljJmwEixWrL6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eab440358f54075b5e222012d0089b28_JaffaCakes118

Files

eab440358f54075b5e222012d0089b28_JaffaCakes118
.exe windows:5 windows x86 arch:x86

608b524939a4ae825f572a36fd684373

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThread
GetProcessHeap
IsBadReadPtr
SetFileTime
VirtualQueryEx
WriteFile
OpenProcess
Thread32First
WideCharToMultiByte
ReadProcessMemory
HeapDestroy
HeapCreate
Thread32Next
ReadFile
GetTimeZoneInformation
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
SetLastError
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
FindClose
LoadLibraryA
GetEnvironmentVariableW
FindNextFileW
HeapFree
CreateToolhelp32Snapshot
GetFileTime
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
CreateThread
ExpandEnvironmentStringsW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLocalTime
SetThreadPriority
GetThreadContext
SetThreadContext
GetProcessId
GetNativeSystemInfo
CreateRemoteThread
Process32FirstW
Process32NextW
GetPrivateProfileStringW
GetPrivateProfileIntW
GlobalLock
GlobalUnlock
ResetEvent
GetUserDefaultUILanguage
GetTickCount
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
MoveFileExW
GetSystemTime
GetTempFileNameW
VirtualProtect
FileTimeToDosDateTime
WriteProcessMemory
LocalFree
GetCurrentProcessId
DuplicateHandle
OpenEventW
GetFileAttributesExW
GetModuleFileNameW
GetVersionExW
VirtualFreeEx
VirtualFree
GetModuleHandleW
WaitForSingleObject
GetComputerNameW
SetErrorMode
GetCommandLineW
WaitForMultipleObjects
CreateEventW
SetFileAttributesW
CloseHandle
lstrcmpiW
WTSGetActiveConsoleSessionId
GetProcAddress
lstrcmpiA
CreateFileW
GetFileAttributesW
Sleep
LoadLibraryW
SetEvent
CreateDirectoryW
FreeLibrary
ExitProcess
RemoveDirectoryW

user32

LoadImageW
MsgWaitForMultipleObjects
CharLowerBuffA
GetCursorPos
CharToOemW
ExitWindowsEx
GetIconInfo
CharLowerA
PeekMessageW
DrawIcon
ToUnicode
GetClipboardData
TranslateMessage
GetKeyboardState
CharLowerW
DispatchMessageW
CharUpperW

advapi32

CryptCreateHash
LookupPrivilegeValueW
SetNamedSecurityInfoW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CreateProcessAsUserW
RegQueryValueExW
CryptReleaseContext
RegCreateKeyExW
GetTokenInformation
GetSidSubAuthorityCount
OpenThreadToken
CryptAcquireContextW
GetSidSubAuthority
OpenProcessToken
CryptGetHashParam
GetLengthSid
IsWellKnownSid
EqualSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
ConvertSidToStringSidW
InitiateSystemShutdownExW

shlwapi

PathRemoveFileSpecW
StrCmpNIW
PathRenameExtensionW
PathRemoveBackslashW
UrlUnescapeA
wvnsprintfW
PathIsDirectoryW
PathFindFileNameW
PathAddBackslashW
SHDeleteValueW
PathSkipRootW
SHDeleteKeyW
PathCombineW
PathAddExtensionW
PathUnquoteSpacesW
PathMatchSpecW
StrCmpNIA
wvnsprintfA
PathQuoteSpacesW
PathIsURLW

shell32

ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

CLSIDFromString
StringFromGUID2

ws2_32

recv
select
getaddrinfo
recvfrom
send
getpeername
listen
WSAIoctl
connect
WSAStartup
WSAGetLastError
shutdown
setsockopt
bind
socket
WSASetLastError
closesocket
freeaddrinfo
WSAEventSelect
getsockname
accept
sendto

crypt32

CertCloseStore
PFXExportCertStoreEx
PFXImportCertStore
CertDeleteCertificateFromStore
CertOpenSystemStoreW
CertEnumCertificatesInStore
CertDuplicateCertificateContext

wininet

InternetQueryDataAvailable
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpAddRequestHeadersA
InternetQueryOptionA
InternetOpenA
HttpOpenRequestA
InternetSetOptionA
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
InternetCloseHandle
HttpSendRequestA
HttpSendRequestW
InternetReadFile
InternetReadFileExA
HttpSendRequestExW
HttpQueryInfoA
HttpSendRequestExA

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

608b524939a4ae825f572a36fd684373

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

ws2_32

crypt32

wininet

netapi32

Sections

.text Size: 87KB - Virtual size: 87KB

.data Size: 512B - Virtual size: 7KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 87KB - Virtual size: 87KB

.data
Size: 512B - Virtual size: 7KB

.reloc
Size: 4KB - Virtual size: 3KB