f9c6c9ef9f450485a3e16f1f0a90b15c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f9c6c9ef9f450485a3e16f1f0a90b15c_JaffaCakes118
Size

170KB
MD5

f9c6c9ef9f450485a3e16f1f0a90b15c
SHA1

bb5f1107fb0667296e18c7645a0283bb556bcc6a
SHA256

cf0fc49e3096c17dcbd2197c231a18c47315eb373775b2e3622b08482b4b029d
SHA512

cf4cb8d2a31f69cf773cc51450a2a58243efbf4fad772d575710ba88aba332400ae8ec6d239aff0d1100163bf81772d38b595ef391dd720f05ada5c5bd09b15b
SSDEEP

3072:xkekpEkrb+OoTVm1vazqyoQtTPMN45Y5mCSYDkj9D/fFGlQj375IfADJEroKB:xkekCOqVm1izqyoVi5Y5KZDf9Gfdro2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9c6c9ef9f450485a3e16f1f0a90b15c_JaffaCakes118

Files

f9c6c9ef9f450485a3e16f1f0a90b15c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

46d9a8fee013f1d964999c276cb052d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
VirtualQueryEx
OpenProcess
Thread32First
WideCharToMultiByte
ReadProcessMemory
HeapDestroy
HeapCreate
Thread32Next
ReadFile
GetTimeZoneInformation
MultiByteToWideChar
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
SetLastError
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
FindClose
GetLocalTime
LoadLibraryA
RemoveDirectoryW
LoadLibraryW
VirtualProtect
IsBadReadPtr
GetFileTime
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
GetSystemTime
CreateThread
ExpandEnvironmentStringsW
GetThreadContext
SetThreadContext
GetProcessId
ResetEvent
CreateRemoteThread
Process32FirstW
Process32NextW
TlsGetValue
TlsSetValue
TerminateProcess
SetThreadPriority
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
CreateDirectoryW
FreeLibrary
GetProcessHeap
GetCurrentThread
HeapFree
SetFilePointerEx
SystemTimeToFileTime
SetUnhandledExceptionFilter
HeapAlloc
CreateProcessW
SetEndOfFile
GetCurrentThreadId
GetNativeSystemInfo
SetFilePointer
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
GetPrivateProfileIntW
FlushFileBuffers
WriteFile
GetPrivateProfileStringW
SetFileAttributesW
WTSGetActiveConsoleSessionId
lstrcmpiA
CreateToolhelp32Snapshot
CreateFileW
GetUserDefaultUILanguage
GetFileAttributesW
MoveFileExW
EnterCriticalSection
GlobalUnlock
LeaveCriticalSection
InitializeCriticalSection
GetTickCount
GlobalLock
WriteProcessMemory
LocalFree
GetCurrentProcessId
CloseHandle
DuplicateHandle
OpenEventW
GetFileAttributesExW
lstrcmpiW
WaitForMultipleObjects
CreateEventW
GetProcAddress
GetModuleFileNameW
GetVersionExW
Sleep
VirtualFreeEx
VirtualFree
GetModuleHandleW
SetEvent
GetComputerNameW
WaitForSingleObject
GetCommandLineW
FindNextFileW
ExitProcess

user32

DefWindowProcW
DefFrameProcW
RegisterClassA
GetMessageA
GetWindowRect
GetMessageW
SetCapture
GetParent
GetWindowInfo
GetClassLongW
GetCapture
SetCursorPos
GetAncestor
PeekMessageA
SetWindowPos
GetCursorPos
IsWindow
RegisterWindowMessageW
SendMessageW
MapWindowPoints
GetMessagePos
GetWindowThreadProcessId
IsRectEmpty
GetSystemMetrics
MapVirtualKeyW
GetUpdateRgn
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
GetDC
GetMenuItemID
SetKeyboardState
EndPaint
GetSubMenu
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetMenuState
GetMenuItemCount
HiliteMenuItem
EndMenu
GetShellWindow
CharLowerBuffA
CharLowerW
FillRect
DrawEdge
IntersectRect
GetClassNameW
PostThreadMessageW
EqualRect
PrintWindow
DrawIcon
RegisterClassExA
CallWindowProcA
GetWindowDC
DefDlgProcW
GetIconInfo
ReleaseCapture
DefFrameProcA
CallWindowProcW
BeginPaint
GetUpdateRect
MessageBoxW
ExitWindowsEx
RegisterClassExW
GetDCEx
DefWindowProcA
DefMDIChildProcW
GetWindowLongW
CharLowerA
PeekMessageW
ReleaseDC
CharUpperW
SetWindowLongW
SendMessageTimeoutW
GetWindow
DispatchMessageW
CharToOemW
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
SwitchDesktop
DefDlgProcA
DefMDIChildProcA
RegisterClassW
PostMessageW
MessageBeep
ToUnicode
GetClipboardData
GetKeyboardState
TranslateMessage
OpenWindowStationW
GetUserObjectInformationW
SetThreadDesktop
CloseDesktop
OpenInputDesktop

advapi32

IsWellKnownSid
GetLengthSid
ConvertSidToStringSidW
EqualSid
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
InitiateSystemShutdownExW
RegEnumKeyExW

shlwapi

PathRemoveFileSpecW
PathRemoveBackslashW
PathQuoteSpacesW
StrStrIW
StrStrIA
PathIsURLW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
StrCmpNIW
PathRenameExtensionW

shell32

ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

CreateCompatibleDC
SetRectRgn
SaveDC
DeleteDC
SetViewportOrgEx
RestoreDC
SelectObject
CreateDIBSection
GetDeviceCaps
GetDIBits
DeleteObject
GdiFlush
CreateCompatibleBitmap

ws2_32

getaddrinfo
recvfrom
getpeername
accept
WSAEventSelect
listen
send
closesocket
WSASend
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
WSAGetLastError
shutdown
setsockopt
bind
socket
select
getsockname
sendto
recv
freeaddrinfo
WSASetLastError

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
PFXImportCertStore
CryptUnprotectData

wininet

HttpAddRequestHeadersA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetQueryOptionA
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
HttpQueryInfoA
InternetCloseHandle

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

46d9a8fee013f1d964999c276cb052d1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 160KB - Virtual size: 160KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 160KB - Virtual size: 160KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 7KB - Virtual size: 7KB