eb847bcc617ccb5668bf2cdf7b72838b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

eb847bcc617ccb5668bf2cdf7b72838b_JaffaCakes118
Size

176KB
MD5

eb847bcc617ccb5668bf2cdf7b72838b
SHA1

8f488b56f6b071de13cce7556de9e409b898c3c2
SHA256

99d19c15428033d64a47e714a069a29b93513f59922786a391681feb328c3451
SHA512

79fd14315e2499c5fe2df1778b6b0a234e6664760bfa53531a2ee93263279d48b65fe257f277a46c0949244e92b7f23737b44e37f753da9ffe4b00dd230914cd
SSDEEP

3072:U4Xc8vzyygLt4phG6u6JumM3Mnbpx2STE0pC+/qfcb6ghroMBMPEhMgMI:U4s8ryR46G1Xw0M+Ucb64rhMTp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb847bcc617ccb5668bf2cdf7b72838b_JaffaCakes118

Files

eb847bcc617ccb5668bf2cdf7b72838b_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b1ac0438d1dbfc574a5f65918f700ed2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
lstrlenW
FlushFileBuffers
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
FindClose
RemoveDirectoryW
QueryDosDeviceW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
LocalFree
WriteProcessMemory
SetFileAttributesW
CreateThread
ExpandEnvironmentStringsW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
OpenProcess
ExitProcess
GetCommandLineW
SetErrorMode
GetComputerNameW
GetModuleFileNameW
ExitThread
GetModuleHandleA
GetFileAttributesExW
OpenEventW
DuplicateHandle
GetCurrentProcessId
GetThreadContext
SetThreadContext
GetProcessId
GetLocalTime
GetPrivateProfileStringW
GetPrivateProfileIntW
WTSGetActiveConsoleSessionId
SetHandleInformation
CreatePipe
GlobalLock
GlobalUnlock
MoveFileExW
GetUserDefaultUILanguage
GetNativeSystemInfo
CreateRemoteThread
Process32FirstW
Process32NextW
WriteFile
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualFree
GetModuleHandleW
CreateDirectoryW
HeapFree
GetLogicalDriveStringsW
CreateFileW
GetTimeZoneInformation
ReadFile
Thread32Next
GetFileAttributesW
lstrcpynW
HeapCreate
HeapDestroy
ReadProcessMemory
Sleep
LoadLibraryW
VirtualFreeEx
WideCharToMultiByte
GetVersionExW
Thread32First
SetFilePointerEx
GetCurrentProcess
SystemTimeToFileTime
HeapAlloc
CreateProcessW
SetEndOfFile
FindFirstFileW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
lstrcmpiW
LoadLibraryA
GetProcAddress
FreeLibrary
TlsFree
TlsAlloc
CreateFileMappingW
UnmapViewOfFile
WaitForSingleObject
MapViewOfFile
CreateMutexW
GetSystemTime
ReleaseMutex
GetCurrentThreadId
SetLastError
GetTickCount
ResetEvent
SetThreadPriority
TerminateProcess
TlsSetValue
GetCurrentThread
SetEvent
TlsGetValue
CloseHandle
WaitForMultipleObjects
CreateEventW
lstrcmpiA

user32

GetKeyboardState
GetSystemMetrics
OpenInputDesktop
OpenDesktopW
MenuItemFromPoint
GetMenu
RegisterClassExW
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
GetMenuItemCount
DefDlgProcA
GetClipboardData
HiliteMenuItem
RegisterClassW
CallWindowProcA
EndMenu
CallWindowProcW
DefFrameProcW
RegisterClassA
GetShellWindow
CharLowerW
GetMessageA
GetIconInfo
SetCapture
GetParent
GetClassLongW
GetCapture
SetCursorPos
GetWindowLongW
GetAncestor
ToUnicode
CreateDesktopW
SetProcessWindowStation
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenWindowStationW
DestroyWindow
LoadCursorW
ExitWindowsEx
CloseDesktop
LoadIconW
CreateWindowExA
ShowWindow
SetThreadDesktop
UpdateWindow
GetKeyboardLayoutList
MapVirtualKeyW
CharLowerBuffA
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharToOemW
TranslateMessage
CharLowerA
SetWindowLongW
CharUpperW
GetWindow
DispatchMessageW
DefMDIChildProcA
DrawIcon
PeekMessageW
PeekMessageA
SetWindowPos
RegisterClassExA
RegisterWindowMessageW
GetThreadDesktop
GetCursorPos
SendMessageTimeoutW
IsWindow
ReleaseCapture
MapWindowPoints
GetMessagePos
GetWindowThreadProcessId
EndPaint
GetUpdateRgn
GetMessageW
GetWindowDC
FillRect
PostMessageW
GetWindowInfo
DrawEdge
BeginPaint
GetUpdateRect
GetDC
IntersectRect
GetMenuItemID
SetKeyboardState
GetSubMenu
DefDlgProcW
GetWindowRect
DefFrameProcA
GetDCEx
ReleaseDC
PostThreadMessageW
EqualRect
PrintWindow
SendMessageW
DefWindowProcW
IsRectEmpty
GetUserObjectInformationW

advapi32

CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
IsWellKnownSid
GetLengthSid
SetSecurityInfo
CreateProcessAsUserA
RegEnumKeyExW
EqualSid
InitiateSystemShutdownExW
ConvertSidToStringSidW

shlwapi

PathMatchSpecW
PathIsURLW
StrCmpNIW
StrStrIW
StrStrIA
PathRenameExtensionW
PathQuoteSpacesW
wvnsprintfA
StrCmpNIA
UrlUnescapeA
PathRemoveBackslashW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW

shell32

ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

CLSIDFromString
StringFromGUID2
CoInitializeEx
CoUninitialize
CoCreateInstance

gdi32

RestoreDC
CreateCompatibleDC
SetRectRgn
SelectObject
DeleteObject
GdiFlush
DeleteDC
SetViewportOrgEx
CreateCompatibleBitmap
GetDeviceCaps
GetDIBits
CreateDIBSection
GetStockObject
SaveDC

ws2_32

select
getaddrinfo
recvfrom
getpeername
listen
send
closesocket
WSASetLastError
inet_addr
WSASend
gethostbyname
WSAIoctl
sendto
recv
freeaddrinfo
WSAEventSelect
getsockname
accept
bind
setsockopt
shutdown
WSAGetLastError
WSAStartup
connect
WSAAddressToStringW
socket

crypt32

CryptUnprotectData
PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore

wininet

InternetQueryOptionW
InternetCrackUrlA
InternetReadFile
InternetSetOptionA
InternetCloseHandle
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
HttpAddRequestHeadersA
InternetQueryOptionA
InternetConnectA
InternetOpenA
HttpSendRequestA
HttpQueryInfoA
HttpOpenRequestA

oleaut32

SysFreeString
VariantInit
SysAllocString
VariantClear

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetInfo

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

winmm

waveOutGetVolume
PlaySoundA
PlaySoundW
waveOutSetVolume

Sections

.text
Size: 166KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b1ac0438d1dbfc574a5f65918f700ed2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

version

winmm

Sections

.text Size: 166KB - Virtual size: 168KB

.data Size: 1KB - Virtual size: 12KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 166KB - Virtual size: 168KB

.data
Size: 1KB - Virtual size: 12KB

.reloc
Size: 7KB - Virtual size: 6KB