ef2ebdbc29ffc50539ef86dc811834ac_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ef2ebdbc29ffc50539ef86dc811834ac_JaffaCakes118
Size

136KB
MD5

ef2ebdbc29ffc50539ef86dc811834ac
SHA1

7eb994882674f7307b19f108bb6d777248761404
SHA256

a866808492de8a611ee78c0706eb15411b2b82b80372d8310533f99d44586d95
SHA512

c5beb1267b8ea0f08c4f839991ce3c1bec66bc1571cd38ab506087229ddcc6c3900440541f9061c9cea849e3b4c0d94182a0c94628132017dda8cff06be4e58f
SSDEEP

3072:Y7f1QLKSKPxNPksOA3+vp+Xjtzs7JQnOJVP6O7:Y7f1QLqPksOA3+vp+XjtzqJQnOrPz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef2ebdbc29ffc50539ef86dc811834ac_JaffaCakes118

Files

ef2ebdbc29ffc50539ef86dc811834ac_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ba5a2c0062f8ad5ce92b9864acf75c7b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetModuleFileNameA
GetLocalTime
WaitForSingleObject
CreateProcessA
GetStartupInfoA
WriteFile
SetFilePointer
ReadFile
GetFileSize
GetTickCount
LCMapStringA
GetProcAddress
LoadLibraryA
lstrlenA
ReadProcessMemory
GetCurrentProcess
LocalFree
RtlFillMemory
LocalAlloc
RtlMoveMemory
lstrcpyn
LocalSize
GetModuleHandleA
FindClose
FindNextFileA
FindFirstFileA
CloseHandle
TerminateThread
GetVersionExA
Sleep
CreateThread
CreateEventA
OpenEventA

user32

GetWindowLongA
SetWindowLongA
PostQuitMessage
CreateWindowExA
SetWindowTextA
GetWindowTextA
GetWindowTextLengthA
EnableWindow
TranslateMessage
ShowWindow
IsWindowVisible
GetWindowRect
CallWindowProcA
ReleaseDC
FillRect
GetSysColor
GetDC
DefWindowProcA
TrackMouseEvent
IntersectRect
GetParent
InvalidateRect
EndPaint
BeginPaint
MoveWindow
LoadCursorA
LoadIconA
RegisterClassExA
GetClassInfoExA
SetTimer
IsWindow
DestroyWindow
SetWindowRgn
SetWindowPos
MessageBoxA
wsprintfA
PeekMessageA
OpenIcon
EqualRect
DispatchMessageA
GetMessageA
UpdateWindow
SendMessageA

urlmon

URLDownloadToFileA

wininet

InternetSetCookieA
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCloseHandle
InternetReadFile
InternetOpenUrlA
InternetOpenA

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA

gdi32

TextOutA
SetBkColor
DeleteObject
CreatePatternBrush
SetTextColor
CreateSolidBrush
DeleteDC
BitBlt
SelectObject
CreateDIBitmap
CreateRectRgn
GetPixel
CombineRgn
StretchBlt
GetObjectA
CreateCompatibleDC

msimg32

TransparentBlt

msvcrt

??3@YAXPAX@Z
strrchr
??2@YAPAXI@Z
strncmp
atoi
_ftol
_CIfmod
sprintf
_CIpow
modf
rand
free
realloc
malloc
strtod
tolower
memmove
_strnicmp
_stricmp
strncpy

advapi32

RegSetValueExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA

ole32

CLSIDFromProgID
CLSIDFromString
CoCreateInstance
OleRun
CoUninitialize
CoInitialize

oleaut32

SafeArrayGetElement
VarR8FromCy
VarR8FromBool
LoadTypeLi
SafeArrayCreate
VariantClear
SafeArrayDestroy
VariantInit
VariantChangeType
RegisterTypeLi
SysAllocString

Sections

.text
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ba5a2c0062f8ad5ce92b9864acf75c7b

Headers

File Characteristics

Imports

kernel32

user32

urlmon

wininet

shell32

gdi32

msimg32

msvcrt

advapi32

ole32

oleaut32

Sections

.text Size: 112KB - Virtual size: 111KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 8KB - Virtual size: 55KB

.rsrc Size: 4KB - Virtual size: 4KB

.text
Size: 112KB - Virtual size: 111KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 8KB - Virtual size: 55KB

.rsrc
Size: 4KB - Virtual size: 4KB