fa159ebf02b241b083b311e00c84d1c0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fa159ebf02b241b083b311e00c84d1c0_JaffaCakes118
Size

259KB
MD5

fa159ebf02b241b083b311e00c84d1c0
SHA1

7a4ca4cb10381d31364fe1093fe1de0550fa68f1
SHA256

085f6a4ab24b0547efbdbd80bffd9183e963d0c69e56813a45a88cffcd4823b2
SHA512

1e2fb06c376b9337a5803e9c91e00ec7802fa6477a92b3d5f1295219fe8c046eebcc27ecc9f8b329f1d1f3ff202ec0a66eaa88a9f76b5e19a044eaa99f012ac5
SSDEEP

6144:+980sZPxgfy+4OghoOdbpuiZp2tTHE+li+tJw:xdmg6ybAiH2K+lJt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa159ebf02b241b083b311e00c84d1c0_JaffaCakes118

Files

fa159ebf02b241b083b311e00c84d1c0_JaffaCakes118
.exe windows:5 windows x86 arch:x86

af5fbdf723c2b6ef5e88c53075c541e2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
InitializeCriticalSectionAndSpinCount
SetFilePointer
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateFileA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
SetEndOfFile
GetProcessHeap
ReadFile
GetTickCount
GetLocalTime
Sleep
GetModuleFileNameA
GetCommandLineA
WriteFile
GetTempPathA
CreateDirectoryA
DeleteFileA
RemoveDirectoryA
MoveFileA
CreateMutexA
GetLastError
lstrcpyA
lstrcatA
lstrlenA
ExpandEnvironmentStringsA
GetFileAttributesExA
CreateThread
WaitForSingleObject
TerminateThread
CloseHandle
FlushFileBuffers
VirtualFree
HeapFree
HeapCreate
HeapDestroy
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
LoadLibraryW
ExitProcess
OutputDebugStringW
GetFileType
WriteConsoleW
OutputDebugStringA
GetStdHandle
DebugBreak
LCMapStringW
LCMapStringA
MultiByteToWideChar
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
SetLastError
TlsFree
GetCurrentThreadId
TlsSetValue
TlsAlloc
GetModuleHandleW
TlsGetValue
GetProcAddress
IsBadReadPtr
HeapValidate
GetStartupInfoA
GetModuleFileNameW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement

user32

wsprintfA
GetClassLongA

advapi32

RegOpenKeyA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

ole32

CoInitialize

shell32

ShellExecuteA

shlwapi

PathFileExistsA
PathRemoveBlanksA
PathFindFileNameA
PathGetArgsA
PathIsDirectoryA

gdi32

LineDDA
EnumObjects
GetMetaFileBitsEx
CopyEnhMetaFileA
Pie
ExtCreatePen
GetCharWidth32W
PlayEnhMetaFileRecord
GetGlyphIndicesW
SetEnhMetaFileBits
GetTextExtentExPointW
GdiGetBatchLimit
GetDeviceGammaRamp
ColorCorrectPalette
FlattenPath
CreatePatternBrush
RectVisible
CreateColorSpaceW
OffsetClipRgn
PolyTextOutA
DeleteMetaFile
FloodFill
CreatePalette
Escape
EqualRgn
GetBitmapBits
GetCharacterPlacementW
GetCharWidthI
GetCurrentPositionEx
GetRandomRgn
GetMapMode
GetGlyphOutlineA
GetTextMetricsA
GetMetaRgn
Polygon
GetGlyphIndicesA
GetBkMode
SwapBuffers
PaintRgn
RemoveFontResourceW
StrokePath
SetPixel
AddFontMemResourceEx
GdiSetBatchLimit
GetICMProfileW
PtInRegion
SelectClipPath
ExtEscape
MaskBlt
GetObjectW
SetTextJustification
GdiGradientFill
PlayMetaFileRecord
AddFontResourceA
GetWindowExtEx
GetObjectA
GetEnhMetaFileA
GetBoundsRect
SetDCBrushColor
GetCharABCWidthsFloatA
CreatePolygonRgn
ResetDCA
GetTextExtentPointW
CreateScalableFontResourceA
GetTextCharacterExtra
SetPixelFormat
GetFontData
CreateDIBPatternBrushPt
SetDCPenColor
PolyTextOutW
InvertRgn
LineTo
SetBkColor
GdiComment
SetWindowExtEx
RemoveFontResourceExW
GetMiterLimit
CreateDIBitmap

ws2_32

recv
closesocket
__WSAFDIsSet
select
connect
ioctlsocket
htons
socket
gethostbyname
WSAStartup
send

netapi32

Netbios

comdlg32

CommDlgExtendedError
GetSaveFileNameW
ChooseColorA
GetOpenFileNameW
GetSaveFileNameA
PageSetupDlgA

crypt32

CertOpenSystemStoreW
CryptStringToBinaryA
CryptVerifyCertificateSignature
CertDuplicateCRLContext
CertNameToStrA
CryptRegisterDefaultOIDFunction
CertOpenSystemStoreA
CryptInitOIDFunctionSet
CertEnumSubjectInSortedCTL
CertEnumCRLContextProperties
CryptEnumKeyIdentifierProperties
CertDuplicateCTLContext
CryptDecodeObject
CertVerifyCertificateChainPolicy
CertAddEncodedCertificateToSystemStoreW
CryptMsgGetAndVerifySigner
CertAddCRLLinkToStore
CryptCreateAsyncHandle
CertSetStoreProperty
CertGetCertificateContextProperty
CertAddCTLLinkToStore
CryptCloseAsyncHandle
CryptUnprotectData
CertCreateCertificateChainEngine
CertDuplicateCertificateChain
CertSaveStore
CertFreeCRLContext

imm32

ImmRegisterWordW
ImmGetOpenStatus
ImmCreateContext
ImmSetOpenStatus
ImmGetImeMenuItemsA
ImmAssociateContext
ImmConfigureIMEW
ImmGetCandidateWindow
ImmRegisterWordA
ImmGetImeMenuItemsW
ImmSetCompositionFontW
ImmGetCandidateListW
ImmDisableIME
ImmGetCandidateListCountW
ImmDestroyContext
ImmEnumRegisterWordW
ImmGetRegisterWordStyleA
ImmGetDescriptionW
ImmUnregisterWordA
ImmGetCompositionWindow

iphlpapi

GetPerAdapterInfo
GetIcmpStatistics
NotifyAddrChange
GetBestInterfaceEx
GetBestRoute
GetUdpStatisticsEx
CreateIpNetEntry
DeleteIpNetEntry
GetIcmpStatisticsEx
GetIpAddrTable
SetIpForwardEntry
NotifyRouteChange
SetIpStatistics
SetIfEntry
GetIfEntry
CancelIPChangeNotify
CreateProxyArpEntry
IpReleaseAddress
EnableRouter
RestoreMediaSense
CreateIpForwardEntry
GetExtendedUdpTable
GetOwnerModuleFromUdpEntry
GetIpForwardTable
UnenableRouter
AddIPAddress
GetFriendlyIfIndex
SetIpNetEntry
GetRTTAndHopCount
GetTcpTable

msi

ord11
ord203
ord88
ord228
ord38
ord251
ord69
ord81
ord44
ord180
ord141
ord95
ord271
ord104
ord205
ord194
ord240
ord208
ord45
ord277
ord14
ord193
ord169
ord101
ord15
ord37
ord109
ord131
ord137
ord274
ord237
ord275
ord168
ord93
ord262
ord263
ord246
ord281
ord94
ord224
ord172
ord60
ord87
ord226
ord39
ord43
ord59
ord256
ord245
ord42
ord90
ord266
ord249
ord9
ord157
ord269
ord67
ord136
ord268
ord253
ord96
ord178
ord5
ord210
ord272
ord89
ord190
ord219
ord129
ord244
ord7
ord130
ord177
ord267
ord215
ord113
ord110
ord72
ord217
ord232
ord173
ord260
ord252
ord261

msvfw32

ICCompressorChoose
DrawDibClose
ICSeqCompressFrame
ICOpen
ICGetDisplayFormat
DrawDibBegin
ICSendMessage
ICDrawBegin
DrawDibRealize
ICImageCompress
ICImageDecompress
ICClose
ICSeqCompressFrameEnd

mswsock

WSARecvEx
GetAcceptExSockaddrs

Sections

.text
Size: 170KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

af5fbdf723c2b6ef5e88c53075c541e2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

shell32

shlwapi

gdi32

ws2_32

netapi32

comdlg32

crypt32

imm32

iphlpapi

msi

msvfw32

mswsock

Sections

.text Size: 170KB - Virtual size: 169KB

.rdata Size: 66KB - Virtual size: 65KB

.data Size: 4KB - Virtual size: 21KB

.reloc Size: 17KB - Virtual size: 17KB

.text
Size: 170KB - Virtual size: 169KB

.rdata
Size: 66KB - Virtual size: 65KB

.data
Size: 4KB - Virtual size: 21KB

.reloc
Size: 17KB - Virtual size: 17KB