fd31ce07d8abb8a0c17842db94a4ade2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fd31ce07d8abb8a0c17842db94a4ade2_JaffaCakes118
Size

88KB
MD5

fd31ce07d8abb8a0c17842db94a4ade2
SHA1

1be999e68405ea56c682b61b3adba1fbae1d6798
SHA256

cc770da2642d1f60fe7e74428196c3d92dc3b89e1712e6790f2b4477b4d75524
SHA512

43af3cde1e711da188c730e8430a7e2d3de7485a59ad2f44151f2f7d2588a928840291209b6438baa3b991ae85fce68c998ad59cb12d7f75ba939291f3822d02
SSDEEP

1536:EgN293jop6wGuMilUqM7yAe5D2YZ6rL8i/3c6txt5++T83QOZg4TPc+wZuWn7:HNEjMGuxMO3DDMH8+pnt1OK4w+wZuWn7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fd31ce07d8abb8a0c17842db94a4ade2_JaffaCakes118

Files

fd31ce07d8abb8a0c17842db94a4ade2_JaffaCakes118
.exe windows:5 windows x86 arch:x86

80d8e43457c85c87aa8a80ed01f22f78

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

secur32

GetUserNameExW

shell32

DragQueryFileW
SHGetFolderPathW
SHChangeNotify
SHGetPathFromIDListW
SHFileOperationW
ShellExecuteW
SHExtractIconsW

comdlg32

GetOpenFileNameW
CommDlgExtendedError

userenv

UnloadUserProfile

msvcrt

rand
_itow
iswctype
wcscmp
memmove
wcsspn
_vsnwprintf
wcschr
wcsncpy
_wcsicmp
mbstowcs
wcsncmp
wcsrchr
_purecall
malloc
free
_initterm
_wcsnicmp
wcspbrk
wcslen
wcstombs
wcsstr
_adjust_fdiv
_except_handler3
wcstoul
setlocale

mpr

WNetGetResourceInformationW
WNetGetNetworkInformationW
WNetGetConnectionW

winmm

auxOutMessage

gdi32

CreateDIBitmap
SelectPalette
DeleteObject
CreateFontIndirectW
SelectObject
GetDeviceCaps
GetObjectW
CreateCompatibleDC
GetStockObject
RealizePalette
BitBlt
DeleteDC
CreatePalette

ntdsapi

DsMakeSpnW

kernel32

GetLocalTime
SetFileTime
GetVersionExW
LoadResource
UnmapViewOfFile
GetSystemTime
CreateFileMappingW
CreateDirectoryW
GlobalReAlloc
lstrcpynW
LeaveCriticalSection
GetComputerNameW
FindFirstFileW
GetCurrentActCtx
GlobalLock
ExpandEnvironmentStringsW
DeleteFileW
SystemTimeToFileTime
lstrcmpiW
ReleaseActCtx
GetEnvironmentVariableW
DeactivateActCtx
GetLocaleInfoW
FileTimeToSystemTime
CreateThread
GlobalFree
GetProcAddress
FreeLibrary
DuplicateHandle
ActivateActCtx
GetTickCount
GetFullPathNameW
GetSystemTimeAsFileTime
GetUserDefaultUILanguage
CompareFileTime
LocalAlloc
CompareStringW
lstrcmpW
DisableThreadLibraryCalls
WriteFile
GetCurrentProcessId
GetTimeFormatW
GetDateFormatW
CloseHandle
OpenProcess
MulDiv
Sleep
SetErrorMode
CreateFileW
SetUnhandledExceptionFilter
InitializeCriticalSection
lstrcmpA
GetFileTime
VirtualAlloc
UnhandledExceptionFilter
LockResource
InterlockedDecrement
SetFilePointer
ReadFile
DeleteCriticalSection
QueryPerformanceCounter
IsBadStringPtrW
GetFileAttributesW
GlobalUnlock
CreateWaitableTimerW
SetFileAttributesW
ExitThread
GlobalAlloc
LocalFree
SetEndOfFile
SetWaitableTimer
LoadLibraryW
IsBadWritePtr
LocalReAlloc
InterlockedIncrement
GetCurrentThreadId
GetCurrentProcess
GetComputerNameExW
GetVolumeInformationW
GetDriveTypeW
GetCurrentThread
WideCharToMultiByte
MapViewOfFile
SetCurrentDirectoryW
GetUserDefaultLCID
lstrlenW
GetFileSize
FindResourceW
CancelWaitableTimer
EnterCriticalSection
FindClose
GetLastError
SearchPathW
FormatMessageW
FindNextFileW
TerminateProcess
GetCurrentDirectoryW

shlwapi

PathFindExtensionW
PathFindFileNameW
PathRemoveFileSpecW

comctl32

ImageList_AddMasked
ImageList_Destroy
PropertySheetW
ImageList_Remove
ImageList_SetOverlayImage
ImageList_Create
DestroyPropertySheetPage
InitCommonControlsEx
ImageList_GetIcon
ImageList_ReplaceIcon
CreatePropertySheetPageW

user32

GetDlgItemInt
SetWindowPos
LoadCursorW
SetMenuItemInfoW
KillTimer
EnableMenuItem
EnableWindow
IsWindow
GetDlgItemTextW
GetKeyState
GetSubMenu
LoadStringW
EnumChildWindows
GetSystemMetrics
GetWindowTextLengthW
MessageBoxW
LoadImageW
WinHelpW
GetClassNameW
MapWindowPoints
SetForegroundWindow
GetForegroundWindow
CheckMenuItem
SwitchToThisWindow
GetParent
GetMenuItemCount
GetWindowTextW
ValidateRect
EndDialog
LoadMenuW
ShowWindow
InvalidateRect
GetWindowThreadProcessId
RegisterClassW
DefWindowProcW
MessageBeep
SendDlgItemMessageW
GetLastActivePopup
GetMenuItemInfoW
DestroyMenu
CreateWindowExW
EnumWindows
SetMenuDefaultItem
RegisterClipboardFormatW
DestroyIcon
GetWindowLongW
GetDlgItem
SetDlgItemTextW
RegisterWindowMessageW
DestroyWindow
SetCursor
SetTimer
FindWindowW
DialogBoxParamW
GetWindow
GetMenuItemID
SetWindowTextW
GetClientRect
SetFocus
IsDlgButtonChecked
SetWindowLongW
RemoveMenu
GetDC
SystemParametersInfoW
CheckRadioButton
SendMessageW
ReleaseDC
GetWindowRect
GetClassInfoW
TrackPopupMenu
CheckDlgButton
PostMessageW

rpcrt4

RpcStringFreeW
RpcBindingSetAuthInfoExW
NdrClientCall2
RpcBindingFromStringBindingW
RpcBindingFree
UuidCreate
RpcStringBindingComposeW
RpcEpResolveBinding

advapi32

AllocateAndInitializeSid
FreeSid
LookupAccountSidW
RegOpenKeyExW
OpenSCManagerW
GetSecurityInfo
RegConnectRegistryW
OpenProcessToken
CloseServiceHandle
ControlService
RevertToSelf
CheckTokenMembership
RegCloseKey
AccessCheck
GetUserNameW
GetTokenInformation
SetSecurityDescriptorOwner
RegSetValueExW
LookupPrivilegeValueW
OpenThreadToken
OpenServiceW
StartServiceW
QueryServiceStatus
RegEnumKeyExW
GetFileSecurityW
SetSecurityInfo
AdjustTokenPrivileges
RegQueryValueExW
RegDeleteKeyW
SetEntriesInAclW
ImpersonateSelf
ConvertStringSecurityDescriptorToSecurityDescriptorW

lz32

LZClose

ole32

CoGetCallContext
CoTaskMemAlloc
OleUninitialize
CoCreateInstance
CoTaskMemFree
OleInitialize
ReleaseStgMedium
OleGetClipboard
OleSetClipboard

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

Sections

.textbss
Size: 77KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

80d8e43457c85c87aa8a80ed01f22f78

Headers

DLL Characteristics

File Characteristics

Imports

secur32

shell32

comdlg32

userenv

msvcrt

mpr

winmm

gdi32

ntdsapi

kernel32

shlwapi

comctl32

user32

rpcrt4

advapi32

lz32

ole32

version

Sections

.textbss Size: 77KB - Virtual size: 1.2MB

.text Size: 512B - Virtual size: 420B

.idata Size: 8KB - Virtual size: 8KB

.rdata Size: 512B - Virtual size: 32B

.reloc Size: 512B - Virtual size: 28B

.textbss
Size: 77KB - Virtual size: 1.2MB

.text
Size: 512B - Virtual size: 420B

.idata
Size: 8KB - Virtual size: 8KB

.rdata
Size: 512B - Virtual size: 32B

.reloc
Size: 512B - Virtual size: 28B