ec0e5a602f2758bd432a1be03dc8642e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ec0e5a602f2758bd432a1be03dc8642e_JaffaCakes118
Size

3.1MB
MD5

ec0e5a602f2758bd432a1be03dc8642e
SHA1

93cad66dd2263b0862e824fc684280a282260b44
SHA256

a1b321e696b9f99ed3a9755bdfb8910cbdcbb7c4465dddfa8306adafaa560aba
SHA512

88162d960ade6c370f22ce7e6f61d231d58a406883cfcaf2ab15f7ecfbe6989f6d2b1453e246707d64baed7aabbdb0672fce9067b89e21f41174e58171159c38
SSDEEP

49152:w6cnHyf5tHTsaEs8UcrqgVol9pu2yZXpOwNZYvMGYFiTPQGP/zVLoGvI:wd0v/8UcrqgVywZXQH7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ec0e5a602f2758bd432a1be03dc8642e_JaffaCakes118

Files

ec0e5a602f2758bd432a1be03dc8642e_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a07c43327cec90c238eaf77d2c329c2f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

timeGetDevCaps

kernel32

SleepEx
GetSystemInfo
FormatMessageW
GetSystemDirectoryA
WaitForMultipleObjects
PeekNamedPipe
GetTickCount
MultiByteToWideChar
FindResourceW
GetModuleHandleW
LoadLibraryExW
lstrcmpiW
SizeofResource
LoadResource
GetLastError
RaiseException
FreeLibraryAndExitThread
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
ExpandEnvironmentStringsW
InterlockedDecrement
InterlockedIncrement
DecodePointer
DeleteFileW
CreateFileW
lstrcpyW
ReadFile
WriteFile
GetFileSize
InitializeCriticalSectionAndSpinCount
CreateEventW
WaitForSingleObject
SetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetACP
DeleteCriticalSection
GetCurrentDirectoryW
FreeResource
LockResource
ExitProcess
MulDiv
GetFileType
SetFilePointer
SetFileTime
DuplicateHandle
SystemTimeToFileTime
DosDateTimeToFileTime
CreateDirectoryW
GetTempPathW
GetLongPathNameW
GetFileAttributesW
GetTempFileNameW
CopyFileW
GlobalAlloc
GlobalFree
LocalAlloc
LocalFree
OpenProcess
CreateProcessW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
MoveFileExW
FindClose
FindFirstFileW
FindNextFileW
GetWindowsDirectoryW
GetSystemDirectoryW
GetVolumeInformationW
GetVersion
VirtualAllocEx
VirtualFreeEx
ReadProcessMemory
WriteProcessMemory
lstrcpynW
ReleaseMutex
CreateMutexW
VirtualProtect
SetErrorMode
VirtualAlloc
VirtualFree
HeapAlloc
HeapFree
GetProcessHeap
SetLastError
GetNativeSystemInfo
LoadLibraryA
IsBadReadPtr
DeviceIoControl
OutputDebugStringA
SetPriorityClass
GetLogicalDriveStringsW
QueryDosDeviceW
OutputDebugStringW
EncodePointer
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetStdHandle
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
HeapSize
HeapReAlloc
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetCommandLineA
GetCommandLineW
FindFirstFileExW
SetStdHandle
FlushFileBuffers
GetTimeZoneInformation
WriteConsoleW
SetEndOfFile
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CreateThread
Sleep
WideCharToMultiByte
GetVersionExW
AreFileApisANSI
WritePrivateProfileStringW
GetPrivateProfileStringW
GetModuleFileNameW
LoadLibraryW
lstrlenW
CloseHandle
GetProcAddress
FreeLibrary
GetFullPathNameW

user32

LoadImageW
MonitorFromWindow
GetMonitorInfoW
IsIconic
IsZoomed
SetWindowRgn
MessageBoxW
IntersectRect
GetWindowRgn
CharPrevW
DrawTextW
FillRect
SetRect
SetWindowTextW
GetWindowTextLengthW
CreateAcceleratorTableW
InvalidateRgn
GetPropW
GetShellWindow
GetWindowThreadProcessId
BeginPaint
KillTimer
ReleaseCapture
SetCapture
GetKeyState
GetFocus
SetFocus
UpdateLayeredWindow
EnableWindow
GetWindow
CreateWindowExW
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
LoadCursorW
OffsetRect
UnionRect
SetCursor
SetPropW
SetForegroundWindow
FindWindowExW
GetSystemMetrics
GetParent
PtInRect
IsRectEmpty
MapWindowPoints
ScreenToClient
MsgWaitForMultipleObjects
BringWindowToTop
IsWindowVisible
GetClassInfoExW
CharNextW
LoadStringW
SetWindowLongW
GetWindowLongW
InvalidateRect
SetWindowPos
PostMessageW
SystemParametersInfoW
GetClassNameW
FindWindowW
GetDesktopWindow
WindowFromPoint
GetCursorPos
SetCursorPos
GetWindowRect
RegisterClassExW
RegisterClassW
CallWindowProcW
DefWindowProcW
PeekMessageW
DestroyWindow
wsprintfW
GetWindowTextW
ReleaseDC
GetDC
SetTimer
SendInput
GetClientRect
MoveWindow
ShowWindow
PostQuitMessage
GetUpdateRect
IsWindow
EndPaint

gdi32

GetClipBox
GetTextExtentPoint32W
PtInRegion
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
GetCharABCWidthsW
CreateSolidBrush
CreateRectRgnIndirect
CreateCompatibleBitmap
CreateRectRgn
GetDIBits
CreateDCW
CreateRoundRectRgn
SetWindowOrgEx
GetObjectW
CreateDIBSection
GetTextMetricsW
SelectObject
CreatePenIndirect
CombineRgn
SaveDC
RestoreDC
Rectangle
GetStockObject
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateCompatibleDC
LineTo
BitBlt
TextOutW
MoveToEx
GetObjectA
SetTextColor
SetStretchBltMode
GetDeviceCaps

comdlg32

GetOpenFileNameW

advapi32

OpenProcessToken
SetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupAccountSidW
CreateProcessAsUserW
DuplicateTokenEx
RegEnumKeyW
RegOpenKeyW
SystemFunction036
RevertToSelf
ImpersonateLoggedOnUser
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegEnumValueA
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegQueryInfoKeyW
GetTokenInformation

shell32

SHGetDataFromIDListW
SHGetFolderLocation
ord155
SHGetFileInfoW
SHBindToParent
SHGetSpecialFolderPathW
SHGetFolderPathW
ShellExecuteW
SHGetDesktopFolder

ole32

OleLockRunning
CLSIDFromProgID
CLSIDFromString
RevokeDragDrop
RegisterDragDrop
CoUninitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoInitialize

oleaut32

VarUI4FromStr
VariantInit
SysAllocString
SysFreeString
VariantClear

shlwapi

PathFileExistsW
StrRetToBufW
PathAppendW
ord219

comctl32

ord17
_TrackMouseEvent

gdiplus

GdipCloneImage
GdipFree
GdipSetCompositingQuality
GdipSetCompositingMode
GdipSetPenMode
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipSetSmoothingMode
GdipCloneBrush
GdipAddPathArcI
GdipAddPathLineI
GdipDeletePath
GdipCreatePath
GdipDrawImageRectI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipCreateFromHDC
GdipSetPixelOffsetMode
GdipSetTextRenderingHint
GdipDisposeImage
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipDrawArcI
GdipCreateStringFormat
GdipCreateLineBrushI
GdiplusShutdown
GdiplusStartup
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipFillRectangleI
GdipDrawPath
GdipDrawRectangleI
GdipDeleteBrush
GdipSetInterpolationMode
GdipAlloc

psapi

EnumProcesses
GetModuleFileNameExW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

iphlpapi

GetAdaptersInfo

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wininet

InternetOpenUrlW
InternetCloseHandle
InternetSetOptionW
InternetOpenW
HttpQueryInfoW
InternetReadFile

urlmon

URLDownloadToFileW

ws2_32

ioctlsocket
listen
accept
sendto
recvfrom
select
__WSAFDIsSet
getservbyname
getservbyport
gethostbyname
gethostbyaddr
inet_ntoa
inet_addr
htonl
WSASetLastError
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
socket
closesocket
WSAGetLastError
send
recv
WSACleanup
WSAStartup
gethostname

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 193KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a07c43327cec90c238eaf77d2c329c2f

Headers

DLL Characteristics

File Characteristics

Imports

winmm

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

psapi

userenv

iphlpapi

version

wininet

urlmon

ws2_32

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 10KB - Virtual size: 28KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 193KB - Virtual size: 192KB

.reloc Size: 60KB - Virtual size: 60KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 10KB - Virtual size: 28KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 193KB - Virtual size: 192KB

.reloc
Size: 60KB - Virtual size: 60KB