fc5e6a82f1af8358881f3a65697e675f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fc5e6a82f1af8358881f3a65697e675f_JaffaCakes118
Size

320KB
MD5

fc5e6a82f1af8358881f3a65697e675f
SHA1

8722ed0e65a085096bc2f3a34573d07ae8f20ff1
SHA256

f7d6a96d1c3bcdce1357408ee57de46e9087287b6981919db037724a7312a588
SHA512

6f3cd3fc161579fbbb2704caa6c6897b2c6fc90393671ae63c85c46ba8d8d47d39b7617d8e0730d23bc983f77a00c399c78bb90b2ac6605d33a93af8a1b5acf4
SSDEEP

6144:RryCee319005mDrWs49+qfD76vHzk3e83:x1nOWsuX7SHo3B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fc5e6a82f1af8358881f3a65697e675f_JaffaCakes118

Files

fc5e6a82f1af8358881f3a65697e675f_JaffaCakes118
.exe windows:5 windows x86 arch:x86

d2a1fef48db948b5f07fa1c8a9915c14

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

hhsetup.pdb

Imports

msvcrt

_except_handler3
memmove
strcmp
strchr
__RTDynamicCast
_wcsicmp
__CxxFrameHandler
_purecall
_vsnprintf
strstr
memcpy
memset
wcslen
wcscpy
wcsrchr
free
malloc
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
__dllonexit
??2@YAPAXI@Z
_onexit
??3@YAXPAX@Z

advapi32

CloseServiceHandle
GetUserNameW
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
StartServiceA
QueryServiceStatus
OpenServiceA
RegQueryInfoKeyA
OpenSCManagerA
RegCreateKeyExA
RegSetValueExA

kernel32

GetCurrentProcess
HeapDestroy
GetProcessHeap
HeapCreate
FlushInstructionCache
ReleaseMutex
LockResource
GetCurrentDirectoryA
LCMapStringW
LoadResource
GetWindowsDirectoryW
FindResourceA
QueryPerformanceCounter
FindFirstFileA
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapFree
HeapAlloc
VirtualFree
VirtualAlloc
DeleteTimerQueue
OutputDebugStringA
ReadFile
lstrcatA
OpenEventW
SetFileAttributesA
lstrlenA
GetCommandLineA
FindNextFileA
GlobalAlloc
GetCurrentThreadId
GetLocalTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
IsBadWritePtr
IsBadReadPtr
InterlockedDecrement
GetUserDefaultLangID
LocalFree
lstrcpyW
lstrlenW
IsBadStringPtrW
UnregisterWaitEx
IsDebuggerPresent
SetEvent
CloseHandle
UnregisterWait
GetConsoleOutputCP
RegisterWaitForSingleObject
CreateEventA
lstrcmpiW
Sleep
WaitForSingleObject
SetLastError
SetFilePointer
IsBadCodePtr
OpenSemaphoreW
GetUserDefaultUILanguage
FreeEnvironmentStringsA
OpenMutexW
GetTempPathA
DeleteFileA
GetProcAddress
AreFileApisANSI
GetModuleHandleA
FindAtomA
SetCurrentDirectoryA
CreateSemaphoreA
GetLastError
GetSystemDefaultUILanguage
GetThreadLocale
GetSystemDefaultLCID
OpenMutexA
CreateSemaphoreW
ReleaseSemaphore
LocalAlloc
OpenSemaphoreA
FormatMessageA
FreeLibrary
InterlockedCompareExchange
LoadLibraryA
GetUserDefaultLCID
IsBadStringPtrA
GetModuleHandleW
MultiByteToWideChar
FindResourceExW
GetACP
GetComputerNameExW
OpenEventA
FindResourceW
WideCharToMultiByte
TlsSetValue
TlsGetValue
GetModuleFileNameW
GetModuleFileNameA
GetCommandLineW
GetVersion
GetComputerNameW
CreateFileA
GetCurrentProcessId
ExitThread
FreeLibraryAndExitThread
LoadLibraryW
CreateThread
WaitForMultipleObjectsEx
TlsFree
CreateMutexA
WaitForSingleObjectEx
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetSystemDefaultLangID
ResetEvent
GetStartupInfoA
CreateTimerQueue
ChangeTimerQueueTimer
TryEnterCriticalSection
CreateTimerQueueTimer
DeleteTimerQueueTimer
GetTickCount
lstrcatW

ole32

IIDFromString
CoInitializeEx
CoWaitForMultipleHandles
CoUninitialize
CLSIDFromString
StringFromIID
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoCreateFreeThreadedMarshaler

rpcrt4

RpcStringFreeA
RpcBindingFree
RpcStringBindingComposeA
NdrClientCall2
RpcBindingFromStringBindingA

user32

wsprintfW
LoadStringW
GetClipboardOwner
CreateWindowExA
LoadBitmapA
SendMessageA
CountClipboardFormats
UpdateWindow
PostQuitMessage
TranslateMessage
EndDialog
ReleaseDC
GetFocus
DestroyWindow
GetDC
SetWindowLongA
IsWindow
SetDlgItemTextA
DispatchMessageA
GetDoubleClickTime
GetCursor
IsDlgButtonChecked
FindWindowA
LoadStringA
FindWindowExA
DialogBoxParamA
GetActiveWindow
EnumWindows
GetInputState
GetClipboardViewer
GetSystemMetrics
GetProcessDefaultLayout
DefWindowProcA
wsprintfA

wininet

InternetSetCookieA
InternetGetCookieA

winmm

mixerClose
waveOutOpen
waveOutReset
waveOutPrepareHeader
waveOutWrite
waveOutMessage
midiInMessage
midiOutMessage
waveInMessage
mixerGetLineControlsA
mixerOpen
mixerSetControlDetails
mixerGetControlDetailsA
waveOutClose

rtutils

TraceDeregisterA
TraceRegisterExA
TraceVprintfExA

Sections

.text
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 211KB - Virtual size: 277KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d2a1fef48db948b5f07fa1c8a9915c14

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

ole32

rpcrt4

user32

wininet

winmm

rtutils

Sections

.text Size: 73KB - Virtual size: 73KB

.data Size: 211KB - Virtual size: 277KB

.bss Size: - Virtual size: 16KB

.tls Size: 1024B - Virtual size: 900B

.rsrc Size: 30KB - Virtual size: 30KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 73KB - Virtual size: 73KB

.data
Size: 211KB - Virtual size: 277KB

.bss
Size: - Virtual size: 16KB

.tls
Size: 1024B - Virtual size: 900B

.rsrc
Size: 30KB - Virtual size: 30KB

.reloc
Size: 3KB - Virtual size: 3KB