ebca189f71766f02f15f49ae3674481d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ebca189f71766f02f15f49ae3674481d_JaffaCakes118
Size

170KB
MD5

ebca189f71766f02f15f49ae3674481d
SHA1

20fd6e32c73c962ba7a04c614b8a7f62edf848a8
SHA256

c2619ee2d007c491f32eeed6265b70b6ce51f560ab615c25fcac056f3b239500
SHA512

497dc0e3efa5512fedf6387a071bbe12a2a93fa241c3214f308261074e8f770715ab07efcf05f9cea7418fcb4227a55bace9dc2039e98cb3cea4987ef1685a3c
SSDEEP

3072:DOp8KRaug8q9/ZXoOIeBBMLE0Y11rP3jdkvpoGoFjT7rEzmZ/B9Ww2CUQGO/bF0P:iCKRaczLE0odkvpoGoqzY3zF0rth

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ebca189f71766f02f15f49ae3674481d_JaffaCakes118

Files

ebca189f71766f02f15f49ae3674481d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

9bfc803938ebce80f9ec3f9530421229

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetEndOfFile
CreateProcessW
HeapAlloc
SetUnhandledExceptionFilter
SystemTimeToFileTime
SetFilePointerEx
HeapFree
CreateDirectoryW
GetProcessHeap
IsBadReadPtr
SetFileTime
VirtualQueryEx
WriteFile
Thread32First
WideCharToMultiByte
LoadLibraryW
ReadProcessMemory
HeapDestroy
HeapCreate
GetFileAttributesW
Thread32Next
ReadFile
GetTimeZoneInformation
CreateFileW
SetThreadContext
FlushFileBuffers
SetFilePointer
GetFileSizeEx
OpenMutexW
GetLastError
VirtualProtectEx
VirtualAllocEx
FindClose
RemoveDirectoryW
FindNextFileW
VirtualProtect
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
SetFileAttributesW
GetPrivateProfileStringW
GetPrivateProfileIntW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
WTSGetActiveConsoleSessionId
MoveFileExW
GetUserDefaultUILanguage
GetThreadContext
Sleep
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
GlobalUnlock
GlobalLock
WriteProcessMemory
CreateToolhelp32Snapshot
Process32NextW
GetCurrentProcessId
DuplicateHandle
OpenEventW
WaitForMultipleObjects
CreateEventW
GetModuleFileNameW
VirtualFree
GetComputerNameW
GetCommandLineW
ExitProcess
LocalFree
GetVersionExW
GetNativeSystemInfo
GetProcessId
GetTempPathW
VirtualAlloc
Process32FirstW
VirtualFreeEx
OpenProcess
CreateRemoteThread
LoadLibraryA
FreeLibrary
lstrcmpiA
ResetEvent
SetThreadPriority
TerminateProcess
TlsSetValue
GetCurrentThread
SetEvent
TlsGetValue
ExpandEnvironmentStringsW
GetFileAttributesExW
lstrcmpiW
GetProcAddress
GetModuleHandleW
ReleaseMutex
GetCurrentThreadId
SetLastError
GetTickCount
WaitForSingleObject
CreateThread
GetSystemTime
CloseHandle
GetLocalTime
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
InitializeCriticalSection

user32

GetIconInfo
CharLowerW
CharLowerBuffA
FillRect
DrawEdge
IntersectRect
GetClassNameW
PostThreadMessageW
EqualRect
PrintWindow
ExitWindowsEx
EndPaint
GetUpdateRgn
RegisterClassExA
GetWindowDC
DefDlgProcW
DefFrameProcA
GetSystemMetrics
BeginPaint
GetUpdateRect
GetDC
TranslateMessage
RegisterClassExW
GetClipboardData
GetDCEx
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
DefDlgProcA
DefMDIChildProcA
RegisterClassW
CreateDesktopW
SetProcessWindowStation
GetShellWindow
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
CloseDesktop
SetThreadDesktop
OpenWindowStationW
RegisterWindowMessageW
GetThreadDesktop
GetMenuItemID
SetKeyboardState
GetSubMenu
OpenDesktopW
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetMenuState
GetMenuItemCount
HiliteMenuItem
GetUserObjectInformationW
GetTopWindow
MapVirtualKeyW
LoadImageW
MsgWaitForMultipleObjects
EndMenu
OpenInputDesktop
WindowFromPoint
DrawIcon
CharLowerA
IsRectEmpty
GetWindowThreadProcessId
CharUpperW
SetWindowLongW
GetWindow
DispatchMessageW
CallWindowProcA
CallWindowProcW
DefWindowProcW
DefFrameProcW
RegisterClassA
GetMessageA
GetWindowRect
GetMessageW
SetCapture
PostMessageW
GetParent
GetWindowInfo
GetClassLongW
GetCapture
SetCursorPos
GetWindowLongW
GetAncestor
PeekMessageW
GetKeyboardState
ToUnicode
MessageBeep
MessageBoxW
ReleaseDC
GetMessagePos
MapWindowPoints
SendMessageW
ReleaseCapture
IsWindow
SendMessageTimeoutW
GetCursorPos
SetWindowPos
PeekMessageA
CharToOemW

advapi32

InitiateSystemShutdownExW
GetLengthSid
ConvertSidToStringSidW
IsWellKnownSid
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
EqualSid
RegEnumKeyExW

shlwapi

PathRenameExtensionW
PathQuoteSpacesW
StrStrIW
StrStrIA
StrCmpNIW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathRemoveBackslashW
PathIsURLW

shell32

CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

CreateCompatibleBitmap
GetDIBits
CreateDIBSection
SetViewportOrgEx
DeleteDC
GdiFlush
DeleteObject
SelectObject
SetRectRgn
CreateCompatibleDC
GetDeviceCaps
RestoreDC
SaveDC

ws2_32

listen
WSASetLastError
freeaddrinfo
socket
bind
recv
setsockopt
shutdown
WSAEventSelect
recvfrom
sendto
getpeername
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
WSAGetLastError
accept
WSASend
closesocket
send
getsockname

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
PFXImportCertStore
CryptUnprotectData

wininet

HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
InternetQueryOptionA
InternetSetOptionA
InternetQueryOptionW
HttpSendRequestW
InternetReadFile
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetCrackUrlA
InternetConnectA
HttpQueryInfoA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9bfc803938ebce80f9ec3f9530421229

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 160KB - Virtual size: 160KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 160KB - Virtual size: 160KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 7KB - Virtual size: 7KB