f4dba28aee33910615503944a131549f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f4dba28aee33910615503944a131549f_JaffaCakes118
Size

308KB
MD5

f4dba28aee33910615503944a131549f
SHA1

4aa00766d852b5ac2eb5715872cbcc9c746eb406
SHA256

be8a7e6b22c89d013899804cf93739cad42585c8a79244461030efc553a357ff
SHA512

7b8cf13cfe591b984a73c6f9a5b108490a3f531ad1a57881bd3b9168c9eb57b0194dbd4daa7f30cbdfc2305604ec61556ac9da658a092456f46a3c10f4678517
SSDEEP

6144:UR6m5JDmT0Vs00A3rzTaZdksreouvnRmjAxcSlzIfw:UPxV2ADOC44vMjAGo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f4dba28aee33910615503944a131549f_JaffaCakes118

Files

f4dba28aee33910615503944a131549f_JaffaCakes118
.exe windows:5 windows x86 arch:x86

d2a1fef48db948b5f07fa1c8a9915c14

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

hhsetup.pdb

Imports

msvcrt

_except_handler3
memmove
strcmp
strchr
__RTDynamicCast
_wcsicmp
__CxxFrameHandler
_purecall
_vsnprintf
strstr
memcpy
memset
wcslen
wcscpy
wcsrchr
free
malloc
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
__dllonexit
??2@YAPAXI@Z
_onexit
??3@YAXPAX@Z

advapi32

CloseServiceHandle
GetUserNameW
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
StartServiceA
QueryServiceStatus
OpenServiceA
RegQueryInfoKeyA
OpenSCManagerA
RegCreateKeyExA
RegSetValueExA

kernel32

GetCurrentProcess
HeapDestroy
GetProcessHeap
HeapCreate
FlushInstructionCache
ReleaseMutex
LockResource
GetCurrentDirectoryA
LCMapStringW
LoadResource
GetWindowsDirectoryW
FindResourceA
QueryPerformanceCounter
FindFirstFileA
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapFree
HeapAlloc
VirtualFree
VirtualAlloc
DeleteTimerQueue
OutputDebugStringA
ReadFile
lstrcatA
OpenEventW
SetFileAttributesA
lstrlenA
GetCommandLineA
FindNextFileA
GlobalAlloc
GetCurrentThreadId
GetLocalTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
IsBadWritePtr
IsBadReadPtr
InterlockedDecrement
GetUserDefaultLangID
LocalFree
lstrcpyW
lstrlenW
IsBadStringPtrW
UnregisterWaitEx
IsDebuggerPresent
SetEvent
CloseHandle
UnregisterWait
GetConsoleOutputCP
RegisterWaitForSingleObject
CreateEventA
lstrcmpiW
Sleep
WaitForSingleObject
SetLastError
SetFilePointer
IsBadCodePtr
OpenSemaphoreW
GetUserDefaultUILanguage
FreeEnvironmentStringsA
OpenMutexW
GetTempPathA
DeleteFileA
GetProcAddress
AreFileApisANSI
GetModuleHandleA
FindAtomA
SetCurrentDirectoryA
CreateSemaphoreA
GetLastError
GetSystemDefaultUILanguage
GetThreadLocale
GetSystemDefaultLCID
OpenMutexA
CreateSemaphoreW
ReleaseSemaphore
LocalAlloc
OpenSemaphoreA
FormatMessageA
FreeLibrary
InterlockedCompareExchange
LoadLibraryA
GetUserDefaultLCID
IsBadStringPtrA
GetModuleHandleW
MultiByteToWideChar
FindResourceExW
GetACP
GetComputerNameExW
OpenEventA
FindResourceW
WideCharToMultiByte
TlsSetValue
TlsGetValue
GetModuleFileNameW
GetModuleFileNameA
GetCommandLineW
GetVersion
GetComputerNameW
CreateFileA
GetCurrentProcessId
ExitThread
FreeLibraryAndExitThread
LoadLibraryW
CreateThread
WaitForMultipleObjectsEx
TlsFree
CreateMutexA
WaitForSingleObjectEx
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetSystemDefaultLangID
ResetEvent
GetStartupInfoA
CreateTimerQueue
ChangeTimerQueueTimer
TryEnterCriticalSection
CreateTimerQueueTimer
DeleteTimerQueueTimer
GetTickCount
lstrcatW

ole32

IIDFromString
CoInitializeEx
CoWaitForMultipleHandles
CoUninitialize
CLSIDFromString
StringFromIID
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoCreateFreeThreadedMarshaler

rpcrt4

RpcStringFreeA
RpcBindingFree
RpcStringBindingComposeA
NdrClientCall2
RpcBindingFromStringBindingA

user32

wsprintfW
LoadStringW
GetClipboardOwner
CreateWindowExA
LoadBitmapA
SendMessageA
CountClipboardFormats
UpdateWindow
PostQuitMessage
TranslateMessage
EndDialog
ReleaseDC
GetFocus
DestroyWindow
GetDC
SetWindowLongA
IsWindow
SetDlgItemTextA
DispatchMessageA
GetDoubleClickTime
GetCursor
IsDlgButtonChecked
FindWindowA
LoadStringA
FindWindowExA
DialogBoxParamA
GetActiveWindow
EnumWindows
GetInputState
GetClipboardViewer
GetSystemMetrics
GetProcessDefaultLayout
DefWindowProcA
wsprintfA

wininet

InternetSetCookieA
InternetGetCookieA

winmm

mixerClose
waveOutOpen
waveOutReset
waveOutPrepareHeader
waveOutWrite
waveOutMessage
midiInMessage
midiOutMessage
waveInMessage
mixerGetLineControlsA
mixerOpen
mixerSetControlDetails
mixerGetControlDetailsA
waveOutClose

rtutils

TraceDeregisterA
TraceRegisterExA
TraceVprintfExA

Sections

.text
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 200KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 946B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d2a1fef48db948b5f07fa1c8a9915c14

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

ole32

rpcrt4

user32

wininet

winmm

rtutils

Sections

.text Size: 73KB - Virtual size: 73KB

.data Size: 200KB - Virtual size: 276KB

.bss Size: - Virtual size: 4KB

.tls Size: 1024B - Virtual size: 946B

.rsrc Size: 30KB - Virtual size: 30KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 73KB - Virtual size: 73KB

.data
Size: 200KB - Virtual size: 276KB

.bss
Size: - Virtual size: 4KB

.tls
Size: 1024B - Virtual size: 946B

.rsrc
Size: 30KB - Virtual size: 30KB

.reloc
Size: 3KB - Virtual size: 3KB