fb26f2de3e46b99bb4f1c576a3c46f65_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

fb26f2de3e46b99bb4f1c576a3c46f65_JaffaCakes118
Size

256KB
MD5

fb26f2de3e46b99bb4f1c576a3c46f65
SHA1

e928813af32baa53cb37adc9bcf66c58d452b808
SHA256

1d5044e061fe09266788b5964cd0762335d048c39b54688cea4b5952d963fcfd
SHA512

1d9f81cfe2cb52ceafa26b139ac21f6d802b887800130a580e551a920b38c195ea628427f2ed332a58c2810ae96fb699b972e85bbbfda091427b1e15be9899eb
SSDEEP

6144:AiTIJ9YdYSBmWSVcp/5gDDM2IyxMs/qx++9O:zmluzacvgUfO/qV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb26f2de3e46b99bb4f1c576a3c46f65_JaffaCakes118

Files

fb26f2de3e46b99bb4f1c576a3c46f65_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b78ff8f5c984360962b56bea3a29cc03

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStringTypeW
GetStringTypeA
CreateFileA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
SetFilePointer
InitializeCriticalSectionAndSpinCount
VirtualAlloc
HeapReAlloc
HeapSize
HeapAlloc
LoadLibraryA
SetEndOfFile
GetProcessHeap
ReadFile
GetTickCount
GetLocalTime
Sleep
GetModuleFileNameA
GetCommandLineA
GetTempPathA
CreateDirectoryA
DeleteFileA
RemoveDirectoryA
MoveFileA
CreateMutexA
GetLastError
lstrcpyA
lstrcatA
lstrlenA
ExpandEnvironmentStringsA
WriteFile
GetFileAttributesExA
CreateThread
WaitForSingleObject
TerminateThread
CloseHandle
GetLocaleInfoA
FlushFileBuffers
VirtualFree
HeapFree
HeapCreate
HeapDestroy
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
LoadLibraryW
ExitProcess
OutputDebugStringW
GetFileType
WriteConsoleW
OutputDebugStringA
GetStdHandle
DebugBreak
LCMapStringW
LCMapStringA
MultiByteToWideChar
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
SetLastError
TlsFree
GetCurrentThreadId
TlsSetValue
TlsAlloc
GetModuleHandleW
TlsGetValue
GetProcAddress
IsBadReadPtr
HeapValidate
GetStartupInfoA
GetModuleFileNameW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement

user32

GetClassLongA
wsprintfA

advapi32

RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegCloseKey

ole32

CoInitialize

shell32

ShellExecuteA

shlwapi

PathFileExistsA
PathIsDirectoryA
PathRemoveBlanksA
PathGetArgsA
PathFindFileNameA

gdi32

CreateBitmap
EnumFontFamiliesW
GetPixelFormat
CreateDIBPatternBrushPt
SetEnhMetaFileBits
ExtSelectClipRgn
PathToRegion
Ellipse
CreateEnhMetaFileA
GetKerningPairsA
CreateMetaFileW
FlattenPath
CreateEllipticRgn
GetPixel
CreateMetaFileA
PtVisible
GetMetaFileW
SetICMMode
GetTextMetricsA
CreateICW
CreateFontIndirectExW

ws2_32

recv
closesocket
__WSAFDIsSet
select
connect
ioctlsocket
htons
socket
gethostbyname
WSAStartup
send

netapi32

Netbios

comdlg32

PrintDlgW
PageSetupDlgA
CommDlgExtendedError
ChooseFontA
GetSaveFileNameW
ChooseColorA

crypt32

CryptHashToBeSigned
CryptRegisterOIDFunction
CertRemoveStoreFromCollection
CertSerializeCRLStoreElement
CertNameToStrW
CertAddStoreToCollection
CryptEncodeObjectEx
CryptEnumOIDInfo
CryptGetDefaultOIDFunctionAddress
CertFindExtension
CertDeleteCRLFromStore
CryptGetOIDFunctionValue
CertFindSubjectInSortedCTL
CryptUnregisterDefaultOIDFunction
CertDuplicateCertificateContext
CertVerifyCertificateChainPolicy
CertSetCertificateContextProperty
CryptRegisterDefaultOIDFunction
CryptMsgOpenToEncode
CertFreeCertificateChainEngine
CertAddEncodedCertificateToSystemStoreW
CertCompareIntegerBlob
CryptSignAndEncryptMessage
CryptInstallDefaultContext
CertSetCertificateContextPropertiesFromCTLEntry
CertAddCertificateLinkToStore
CertComparePublicKeyInfo
CryptGetKeyIdentifierProperty
CertVerifyRevocation
CertGetNameStringA
CertIsRDNAttrsInCertificateName
CertNameToStrA
CertEnumCTLsInStore
CertGetIntendedKeyUsage
CryptSetAsyncParam
CryptMsgEncodeAndSignCTL
CertFreeCTLContext
CertRemoveEnhancedKeyUsageIdentifier
CryptGetMessageCertificates
CertFindRDNAttr
CryptMemFree
CryptVerifyDetachedMessageHash
CryptVerifyDetachedMessageSignature
CertCreateContext
CryptFormatObject
CertUnregisterSystemStore
CryptCloseAsyncHandle
CertSetCRLContextProperty
CryptEnumKeyIdentifierProperties
CryptMsgGetParam
CertAlgIdToOID
CertAddEncodedCertificateToStore
CertEnumCertificatesInStore
PFXVerifyPassword
CryptQueryObject
CertAddEncodedCertificateToSystemStoreA
CertControlStore
CryptEncryptMessage
CertCreateCRLContext
CertIsValidCRLForCertificate
CertDuplicateStore
CryptSignMessageWithKey
CryptSignCertificate
CryptSetOIDFunctionValue
CryptGetOIDFunctionAddress
CertRegisterSystemStore
CryptSetKeyIdentifierProperty
CertResyncCertificateChainEngine
CertGetCertificateChain
CertRDNValueToStrA
CryptUnprotectData
CertDeleteCertificateFromStore
CertSerializeCTLStoreElement
CertGetCRLFromStore
CryptMsgVerifyCountersignatureEncodedEx
CryptStringToBinaryA
CryptDecodeObject
CertFindCertificateInStore
CryptInitOIDFunctionSet
CertSaveStore
CryptMsgVerifyCountersignatureEncoded
CryptBinaryToStringW
CryptImportPublicKeyInfoEx
CryptHashPublicKeyInfo
CertSerializeCertificateStoreElement
CertSetEnhancedKeyUsage
CryptMsgControl
CertFreeCertificateContext
CertCreateCTLContext

iphlpapi

FlushIpNetTable

msi

ord130
ord36
ord95
ord219
ord230
ord96
ord253
ord169
ord252
ord112
ord168
ord226
ord68
ord42
ord237
ord177
ord180
ord113
ord270
ord110
ord39
ord181
ord274
ord229
ord59
ord8
ord203
ord94
ord45
ord269
ord255
ord6
ord102
ord240
ord156
ord111
ord244
ord83
ord214
ord141
ord263
ord172
ord108
ord248
ord265
ord213
ord223
ord277
ord281
ord15
ord202
ord179
ord126
ord93
ord194
ord84
ord232
ord192
ord40
ord217
ord85

msvfw32

ICCompressorChoose
DrawDibGetPalette
DrawDibClose
ICInstall
ICDrawBegin
ord2
ICClose
DrawDibStart
ICDecompress
DrawDibChangePalette
ICInfo

mswsock

WSARecvEx
GetAcceptExSockaddrs

Sections

.text
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b78ff8f5c984360962b56bea3a29cc03

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

shell32

shlwapi

gdi32

ws2_32

netapi32

comdlg32

crypt32

iphlpapi

msi

msvfw32

mswsock

Sections

.text Size: 168KB - Virtual size: 167KB

.rdata Size: 65KB - Virtual size: 64KB

.data Size: 4KB - Virtual size: 21KB

.reloc Size: 17KB - Virtual size: 17KB

.text
Size: 168KB - Virtual size: 167KB

.rdata
Size: 65KB - Virtual size: 64KB

.data
Size: 4KB - Virtual size: 21KB

.reloc
Size: 17KB - Virtual size: 17KB