ef68b7e15e7ee3cb94bd99621fdfb662_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ef68b7e15e7ee3cb94bd99621fdfb662_JaffaCakes118
Size

24.7MB
MD5

ef68b7e15e7ee3cb94bd99621fdfb662
SHA1

4f9cde146e9cd02117996013b33424dcc9a628fd
SHA256

c944325d83a3cd7f8b3e0bf909fac1dbfe91248598146fc23400a95f1031a485
SHA512

8ac23a647db4d73a000d510a538bb9a4937c02927c9e1b4cddd1f8e58a2bd541acb02b56f79d55a3ee3a6aeff1cc613d46e3fbf4afe4563d113ea261cad2d460
SSDEEP

393216:3EjRdJUEuOPEjWYBDW5RcYSdKHQnWlvkKT79BpsFsPyhCnLn9VS1RM017aO6UsM6:SRdFuhWU4RcYTQ+BTCQyh6L9VS1RMctA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef68b7e15e7ee3cb94bd99621fdfb662_JaffaCakes118

Files

ef68b7e15e7ee3cb94bd99621fdfb662_JaffaCakes118
.exe windows:5 windows x86 arch:x86

591268eb7e5894a247719275afcfac7e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

waveOutGetPosition
waveOutReset
waveOutWrite
waveOutPrepareHeader
waveOutOpen
waveOutClose
waveOutGetDevCapsA
waveOutGetNumDevs
waveInGetNumDevs
timeGetTime
timeKillEvent
timeSetEvent
waveOutUnprepareHeader

xinput1_3

ord2
ord5
ord4
ord3

dinput8

DirectInput8Create

d3d9

Direct3DCreate9

d3dx9_42

D3DXCompileShader
D3DXDisassembleShader

binkw32

_BinkGetTrackID@8
_BinkSetVolume@12
_BinkPause@8
_BinkClose@4
_BinkRegisterFrameBuffers@8
_BinkGetFrameBuffersInfo@8
_BinkDoFrame@4
_BinkShouldSkip@4
_BinkNextFrame@4
_BinkWait@4
_BinkOpenDirectSound@4
_BinkSetSoundSystem@8
_BinkSetIOSize@4
_BinkSetMemory@8
_BinkSetIO@4
_BinkSetSoundTrack@8
_BinkOpen@8

msacm32

acmStreamOpen
acmStreamPrepareHeader
acmStreamConvert
acmStreamSize
acmFormatSuggest
acmStreamUnprepareHeader

wtsapi32

WTSUnRegisterSessionNotification
WTSRegisterSessionNotification

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

steam_api

SteamAPI_RestartAppIfNecessary
SteamUtils
SteamUser
SteamClient
SteamAPI_Init
SteamAPI_RunCallbacks
SteamAPI_UnregisterCallResult
SteamAPI_RegisterCallResult
SteamAPI_UnregisterCallback
SteamAPI_Shutdown
SteamUserStats
SteamAPI_RegisterCallback
SteamApps
SteamFriends

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

kernel32

FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetConsoleCtrlHandler
FatalAppExitA
HeapDestroy
HeapCreate
LCMapStringW
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetStdHandle
ExitThread
RtlUnwind
GetModuleHandleW
HeapReAlloc
GetStartupInfoA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetFileType
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
CompareStringA
CompareStringW
GetLocaleInfoW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
SetEndOfFile
SetEnvironmentVariableA
MoveFileA
CreateProcessA
CreatePipe
LCMapStringA
FlushFileBuffers
GetWindowsDirectoryW
GetSystemDirectoryW
GetStartupInfoW
GetCommandLineA
SetEnvironmentVariableW
SetCurrentDirectoryA
GetModuleFileNameA
CloseHandle
OpenMutexA
GetLastError
CreateMutexA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
CreateSemaphoreA
ReleaseSemaphore
WaitForSingleObject
IsDebuggerPresent
SetErrorMode
QueryPerformanceCounter
QueryPerformanceFrequency
GetLocalTime
GetSystemTime
Sleep
SetThreadAffinityMask
GetCurrentThread
InterlockedIncrement
InterlockedDecrement
ResetEvent
CreateEventA
FindClose
FindFirstFileA
GlobalUnlock
GlobalLock
GlobalAlloc
WideCharToMultiByte
GetModuleHandleA
VirtualAlloc
VirtualFree
VirtualQuery
GetSystemInfo
VirtualProtect
FreeLibrary
GetProcAddress
LoadLibraryA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
GetTimeFormatA
RaiseException
SetThreadPriority
GetProcessAffinityMask
GetCurrentProcess
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
SwitchToThread
InterlockedExchange
InterlockedCompareExchange
GetCurrentThreadId
CreateThread
GlobalMemoryStatusEx
ReleaseMutex
UnmapViewOfFile
SetEvent
WaitForMultipleObjects
MultiByteToWideChar
GetVersionExA
GetCurrentProcessId
OpenProcess
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
OpenEventA
GetLocaleInfoA
DuplicateHandle
CreateProcessW
SetFileTime
SystemTimeToFileTime
CreateFileA
GetDateFormatA
GetFileAttributesA
SetFileAttributesA
GetFullPathNameA
GetFileSize
CreateFileW
ReadFile
SetFilePointer
OutputDebugStringA
SetLastError
SetWaitableTimer
CreateWaitableTimerA
GetSystemDirectoryA
OpenFile
FormatMessageA
GetVolumeInformationA
GetDriveTypeA
FindNextFileA
GetCurrentDirectoryA
CreateDirectoryA
WriteFile
GetExitCodeProcess
DeleteFileA
RemoveDirectoryA
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
GetFileTime
SearchPathA
GetModuleFileNameW
LoadResource
FindResourceExA
GetProcessTimes
GetModuleHandleExA
GetComputerNameA
GetTickCount
GetFileInformationByHandle
HeapFree
GetProcessHeap
lstrcmpiW
lstrlenW
GetFullPathNameW
HeapAlloc
HeapSize
ExitProcess
LockResource
SizeofResource
FindResourceW
GetConsoleWindow
GetCurrentDirectoryW
GetEnvironmentStringsW
GetCommandLineW

user32

ShowCursor
SetCursor
LoadCursorA
GetCursorPos
GetKeyboardState
GetParent
EnumDisplaySettingsA
EnumDisplayDevicesA
MsgWaitForMultipleObjects
GetDesktopWindow
CharLowerBuffA
GetSystemMetrics
GetWindowRect
DefWindowProcA
RegisterWindowMessageA
ShowWindow
DispatchMessageA
BeginPaint
PostQuitMessage
SendInput
EmptyClipboard
GetMonitorInfoA
MonitorFromRect
UpdateWindow
CreateWindowExA
LoadBitmapA
AdjustWindowRect
MessageBoxW
RegisterClassExA
LoadIconA
SetWindowPos
SetWindowLongA
AdjustWindowRectEx
GetWindowLongA
GetClientRect
GetAsyncKeyState
SetClipboardData
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
IsDialogMessageA
wvsprintfW
LoadStringA
MessageBoxA
GetForegroundWindow
PeekMessageA
SetRect
SystemParametersInfoA
TranslateMessage
EndPaint

gdi32

ExtEscape
GetStockObject
DeleteObject
CreateDCA
CreateCompatibleDC
SelectObject
GetObjectA
DeleteDC
BitBlt

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
GetUserNameA
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyA

shell32

SHGetFolderPathA
ShellExecuteA

ole32

CoCreateInstance
CoSetProxyBlanket
CoInitialize
CoUninitialize
StringFromGUID2
PropVariantClear
CoTaskMemFree
CLSIDFromString
CoInitializeEx

oleaut32

SysAllocString
SysFreeString

physxloader

NxGetUtilLib
NxGetCookingLib
NxGetFoundationSDK
NxCreatePhysicsSDK
NxGetPhysicsSDK

apex_release

NxCreateApexSDK
NxGetApexSDK

Exports

Exports

PHYSFSEXT_enumerateFilesWildcard
PHYSFS_SetCacheConfiguration
PHYSFS_SetWin32CaseSensitiveChecking
PHYSFS_TestAndLogCaseSensitiveFileName
PHYSFS_addToSearchPath
PHYSFS_close
PHYSFS_deinit
PHYSFS_delete
PHYSFS_enumerateFiles
PHYSFS_enumerateFilesCallback
PHYSFS_eof
PHYSFS_exists
PHYSFS_fileLength
PHYSFS_flush
PHYSFS_folderSize
PHYSFS_freeList
PHYSFS_getAllocator
PHYSFS_getBaseDir
PHYSFS_getCdRomDirs
PHYSFS_getCdRomDirsCallback
PHYSFS_getDirSeparator
PHYSFS_getLastError
PHYSFS_getLastModTime
PHYSFS_getLinkedVersion
PHYSFS_getMountPoint
PHYSFS_getRealDir
PHYSFS_getSearchPath
PHYSFS_getSearchPathCallback
PHYSFS_getUserDir
PHYSFS_getWriteDir
PHYSFS_init
PHYSFS_isDirectory
PHYSFS_isSymbolicLink
PHYSFS_mkdir
PHYSFS_mount
PHYSFS_mount2
PHYSFS_openAppend
PHYSFS_openRead
PHYSFS_openWrite
PHYSFS_permitSymbolicLinks
PHYSFS_read
PHYSFS_removeFromSearchPath
PHYSFS_seek
PHYSFS_setAllocator
PHYSFS_setBuffer
PHYSFS_setSaneConfig
PHYSFS_setWriteDir
PHYSFS_supportedArchiveTypes
PHYSFS_tell
PHYSFS_write

Sections

ALI213
Size: 23.4MB - Virtual size: 23.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ALI213
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ALI213
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

591268eb7e5894a247719275afcfac7e

Headers

DLL Characteristics

File Characteristics

Imports

winmm

xinput1_3

dinput8

d3d9

d3dx9_42

binkw32

msacm32

wtsapi32

userenv

steam_api

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

physxloader

apex_release

Exports

Exports

Sections

ALI213 Size: 23.4MB - Virtual size: 23.4MB

ALI213 Size: 1.3MB - Virtual size: 1.3MB

ALI213 Size: 4KB - Virtual size: 4KB

ALI213
Size: 23.4MB - Virtual size: 23.4MB

ALI213
Size: 1.3MB - Virtual size: 1.3MB

ALI213
Size: 4KB - Virtual size: 4KB