f5719fe47fbb57a63fa212cad4f21b08_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f5719fe47fbb57a63fa212cad4f21b08_JaffaCakes118
Size

138KB
MD5

f5719fe47fbb57a63fa212cad4f21b08
SHA1

fc65cc7a2924dba67ffb6ebaa9a3dd68f8570e4f
SHA256

c6e56a414f05fec1934929c9794af757c3deb28c0f54fa322006a71abfe7234f
SHA512

4caadef1cc2a4b85a7c1a7cd2e8da4121345efd1557234ee218ad802876c8ad90d842ba9b9684067cd3eef72d721413d62bc21ebe6ac3138ca67e04d7a98c834
SSDEEP

3072:yjsaLiVa+/FcCLK9nGsoDZJix3WCKM6ujzjKi79dISoDT141Qs:yjsa6IntoHeWCKUui79dI521Qs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f5719fe47fbb57a63fa212cad4f21b08_JaffaCakes118

Files

f5719fe47fbb57a63fa212cad4f21b08_JaffaCakes118
.exe windows:5 windows x86 arch:x86

78ea6b29d7a33ffe506b7adfa122b5c9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineW
SetErrorMode
GetComputerNameW
VirtualFree
OpenEventW
DuplicateHandle
GetCurrentProcessId
WriteProcessMemory
CreateRemoteThread
OpenProcess
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetEnvironmentVariableW
FileTimeToDosDateTime
GetTempFileNameW
HeapReAlloc
FindFirstFileW
SetEndOfFile
CreateProcessW
HeapAlloc
SystemTimeToFileTime
SetFilePointerEx
HeapFree
GetProcessHeap
IsBadReadPtr
SetFileTime
GetThreadContext
Thread32First
GetUserDefaultUILanguage
ReadProcessMemory
HeapDestroy
HeapCreate
Thread32Next
ReadFile
GetTimeZoneInformation
MultiByteToWideChar
GetTempPathW
GetFileSizeEx
OpenMutexW
VirtualProtectEx
VirtualAllocEx
FindClose
RemoveDirectoryW
FindNextFileW
VirtualProtect
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
LocalFree
GetVersionExW
GetModuleFileNameW
MoveFileExW
WaitForMultipleObjects
GetPrivateProfileIntW
FlushFileBuffers
WriteFile
GetPrivateProfileStringW
CreateThread
GetLocalTime
GetNativeSystemInfo
TlsFree
ExpandEnvironmentStringsW
GlobalUnlock
GetTickCount
GlobalLock
SetFileAttributesW
WTSGetActiveConsoleSessionId
CreateFileW
GetFileAttributesW
LoadLibraryW
CreateDirectoryW
ExitProcess
GetProcessId
VirtualAlloc
VirtualFreeEx
WideCharToMultiByte
SetThreadContext
TlsAlloc
GetCurrentThreadId
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
CreateMutexW
Sleep
ReleaseMutex
GetFileAttributesExW
GetModuleHandleW
CloseHandle
CreateEventW
EnterCriticalSection
SetLastError
GetLastError
LeaveCriticalSection
InitializeCriticalSection
ResetEvent
TerminateProcess
TlsSetValue
SetEvent
TlsGetValue
lstrcmpiA
SetThreadPriority
GetCurrentThread
WaitForSingleObject
GetSystemTime
lstrcmpiW
LoadLibraryA
GetProcAddress
VirtualQueryEx
FreeLibrary

user32

SystemParametersInfoW
GetClassNameW
GetMenuState
GetMenuItemCount
HiliteMenuItem
GetUserObjectInformationW
EndMenu
GetWindowThreadProcessId
GetShellWindow
GetSystemMetrics
GetMessageA
RegisterClassExA
SetCapture
DefDlgProcW
DefFrameProcA
OpenInputDesktop
GetCapture
TrackPopupMenuEx
RegisterClassExW
SetCursorPos
GetClipboardData
PeekMessageW
PeekMessageA
DefWindowProcA
DefMDIChildProcW
CharToOemW
DefDlgProcA
DefMDIChildProcA
ReleaseCapture
RegisterClassW
CallWindowProcA
GetTopWindow
ToUnicode
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharLowerA
CharUpperW
SetWindowLongW
GetWindow
DispatchMessageW
MapVirtualKeyW
GetWindowRect
GetParent
GetClassLongW
GetWindowLongW
GetAncestor
SetWindowPos
SendMessageTimeoutW
IsWindow
MapWindowPoints
ExitWindowsEx
CreateDesktopW
SetProcessWindowStation
GetMenu
CloseWindowStation
GetKeyboardState
TranslateMessage
CreateWindowStationW
GetMenuItemRect
CloseDesktop
SetThreadDesktop
GetCursorPos
GetIconInfo
OpenWindowStationW
RegisterWindowMessageW
GetThreadDesktop
GetMenuItemID
CallWindowProcW
GetMessagePos
DefFrameProcW
RegisterClassA
EndPaint
GetUpdateRgn
GetMessageW
GetWindowDC
FillRect
PostMessageW
GetWindowInfo
DrawEdge
BeginPaint
GetUpdateRect
GetDC
IntersectRect
GetDCEx
ReleaseDC
SetKeyboardState
GetSubMenu
OpenDesktopW
MenuItemFromPoint
SwitchDesktop
DrawIcon
CharLowerW
CharLowerBuffA
IsRectEmpty
DefWindowProcW
SendMessageW
PrintWindow
EqualRect
PostThreadMessageW
GetProcessWindowStation

advapi32

ConvertSidToStringSidW
EqualSid
InitiateSystemShutdownExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
IsWellKnownSid
GetLengthSid
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegSetValueExW
CryptHashData

shlwapi

PathIsURLW
PathRemoveFileSpecW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathRemoveBackslashW
PathRenameExtensionW
StrStrIW
StrStrIA
StrCmpNIW
PathQuoteSpacesW

shell32

ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

GetDeviceCaps
CreateCompatibleBitmap
CreateDIBSection
SetViewportOrgEx
DeleteDC
GdiFlush
DeleteObject
SelectObject
SetRectRgn
CreateCompatibleDC
GetDIBits
RestoreDC
SaveDC

ws2_32

recv
sendto
getsockname
select
getaddrinfo
recvfrom
WSAGetLastError
accept
WSAEventSelect
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
shutdown
setsockopt
bind
socket
WSASetLastError
listen
freeaddrinfo
getpeername
WSASend
closesocket
send

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData

wininet

InternetQueryOptionA
InternetSetOptionA
InternetQueryOptionW
InternetOpenA
HttpOpenRequestA
InternetCrackUrlA
InternetConnectA
InternetCloseHandle
HttpSendRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFile
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpQueryInfoA
HttpSendRequestExA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

78ea6b29d7a33ffe506b7adfa122b5c9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 130KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 130KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB