ff5ebc823a1ed8f10c67dd396e4db2ec_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ff5ebc823a1ed8f10c67dd396e4db2ec_JaffaCakes118
Size

348KB
MD5

ff5ebc823a1ed8f10c67dd396e4db2ec
SHA1

03967d8bfad95edcccb161e3605f7d04ac99095f
SHA256

1705ff9109b429aa9f88107e9c0121e137ec80e8508035111cb1f68e6281eb1e
SHA512

27d76871a796cfec34b920e637b8db4a745b2bafab330caa4d3b863c81864d1fe8a0f770f8ecac09b47b4ae7f9f608e3f133b7fa6a8f742e96f3ee4d37afdf7b
SSDEEP

6144:C2YmcI+8TcTsgYCKrgoAK11E0yUxvRuC0pBkR4eYGxDsNg6DyKc/wr23/vaopU:MmDHUagErR9xvcCCkR4eYGxEDhcTpU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff5ebc823a1ed8f10c67dd396e4db2ec_JaffaCakes118

Files

ff5ebc823a1ed8f10c67dd396e4db2ec_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b5c12902bf41a0455456a10e88594714

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AdjustTokenPrivileges
ChangeServiceConfigA
CloseServiceHandle
ControlService
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptReleaseContext
LookupPrivilegeValueA
OpenProcessToken
OpenSCManagerA
OpenServiceA
QueryServiceStatus
RegCloseKey
RegCreateKeyA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
RegFlushKey
RegOpenKeyA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegSetValueExA
StartServiceA

kernel32

GlobalAlloc
GlobalFree
GlobalHandle
GlobalLock
GlobalUnlock
HeapAlloc
HeapDestroy
HeapFree
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
IsDBCSLeadByte
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadResource
LocalAlloc
LocalFree
LocalReAlloc
LockResource
MulDiv
MultiByteToWideChar
OpenEventA
OpenProcess
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
ReleaseMutex
GetVersionExA
ResumeThread
RtlUnwind
SetEndOfFile
SetErrorMode
SetEvent
SetFilePointer
SetLastError
SetPriorityClass
SetUnhandledExceptionFilter
SizeofResource
Sleep
SystemTimeToFileTime
TerminateProcess
TerminateThread
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
WaitForSingleObject
WideCharToMultiByte
WriteFile
WritePrivateProfileStringA
lstrcatA
lstrcmpA
lstrcpyA
lstrcpynA
lstrlenA
lstrlenW
GetUserDefaultLCID
GetTimeFormatA
GetTickCount
GetTempPathA
GetTempFileNameA
GetSystemTimeAsFileTime
GetSystemInfo
GetSystemDirectoryA
GetSystemDefaultLCID
GetStringTypeExA
GetStartupInfoA
GetShortPathNameA
GetProcessHeap
GetProcAddress
GetPrivateProfileStringA
GetPrivateProfileIntA
GetPriorityClass
GetModuleHandleA
GetModuleFileNameA
GetLocalTime
GetLastError
GetFileAttributesA
GetDateFormatA
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetComputerNameA
FreeResource
FreeLibrary
FormatMessageA
FlushInstructionCache
FindResourceA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToSystemTime
EnterCriticalSection
ResetEvent
DuplicateHandle
CompareFileTime
CompareStringA
CreateDirectoryA
DeleteFileA
CreateEventA
CreateFileA
CreateMutexA
CreateProcessA
CreateThread
DeleteCriticalSection
CloseHandle

gdi32

SetWindowOrgEx
SetViewportOrgEx
SetTextColor
SetMapMode
SetBkMode
SetBkColor
SelectPalette
SelectObject
SaveDC
RestoreDC
RealizePalette
PatBlt
MoveToEx
LineTo
LPtoDP
GetTextMetricsA
GetTextExtentPointA
GetTextExtentPoint32A
GetSystemPaletteUse
GetSystemPaletteEntries
GetStockObject
GetObjectA
GetMapMode
GetDeviceCaps
ExtTextOutA
DeleteObject
DeleteDC
CreateSolidBrush
CreateRectRgnIndirect
CreatePen
CreatePalette
CreateFontIndirectA
CreateDIBSection
CreateDCA
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
StretchBlt

user32

EndPaint
EqualRect
ExitWindowsEx
FillRect
FindWindowA
FindWindowExA
FrameRect
GetClassInfoA
GetClassInfoExA
GetClassNameA
GetClientRect
GetCursorPos
GetDC
GetDesktopWindow
GetDlgCtrlID
GetDlgItem
GetDlgItemTextA
GetDoubleClickTime
GetFocus
GetForegroundWindow
GetIconInfo
GetKeyState
GetLastActivePopup
GetMenu
GetMenuItemCount
GetMenuItemID
GetMenuItemInfoA
GetMessageA
GetMessagePos
GetParent
GetScrollPos
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMenu
GetSystemMetrics
GetTopWindow
GetWindow
GetWindowLongA
GetWindowPlacement
GetWindowRect
GetWindowTextA
GetWindowTextLengthA
InSendMessage
InsertMenuA
InsertMenuItemA
IntersectRect
InvalidateRect
InvalidateRgn
IsChild
IsDialogMessageA
IsDlgButtonChecked
IsWindow
IsWindowEnabled
IsWindowVisible
KillTimer
EndDialog
LoadBitmapA
LoadCursorA
LoadIconA
LoadImageA
LoadMenuA
LoadStringA
LoadStringW
MapWindowPoints
MessageBeep
MessageBoxA
ModifyMenuA
MoveWindow
MsgWaitForMultipleObjects
OffsetRect
OpenClipboard
PeekMessageA
PostMessageA
PostThreadMessageA
PtInRect
RedrawWindow
RegisterClassA
RegisterClassExA
RegisterWindowMessageA
ReleaseCapture
ReleaseDC
RemoveMenu
SendDlgItemMessageA
SendMessageA
SendMessageTimeoutA
SetCapture
SetClipboardData
SetCursor
SetCursorPos
SetDlgItemTextA
SetFocus
SetForegroundWindow
SetMenuItemInfoA
SetParent
SetRect
SetTimer
SetWindowLongA
SetWindowPlacement
SetWindowPos
SetWindowRgn
SetWindowTextA
ShowWindow
SystemParametersInfoA
TrackPopupMenu
TrackPopupMenuEx
TranslateAcceleratorA
TranslateMessage
UnionRect
UpdateWindow
WinHelpA
wsprintfA
EndDeferWindowPos
EnableWindow
EnableMenuItem
EmptyClipboard
DrawTextA
DrawIconEx
DrawEdge
DispatchMessageA
DestroyWindow
DialogBoxParamA
CheckDlgButton
DestroyIcon
DestroyAcceleratorTable
DeleteMenu
DeferWindowPos
DefWindowProcA
CreateWindowExA
CreateDialogParamA
CreateAcceleratorTableA
CopyAcceleratorTableA
CloseClipboard
CheckRadioButton
LoadAcceleratorsA
CheckMenuItem
CharUpperBuffA
CharUpperA
CharToOemA
CharNextA
CharLowerA
CallWindowProcA
BeginDeferWindowPos
AppendMenuA
AdjustWindowRectEx
DestroyMenu
BeginPaint

winmm

waveInOpen
waveInGetNumDevs
waveInGetDevCapsA
waveInClose
waveInAddBuffer
waveInPrepareHeader
mmioRead
mmioOpenA
mmioDescend
mmioClose
mmioAscend
mixerSetControlDetails
mixerOpen
mixerGetNumDevs
mixerGetLineInfoA
mixerGetLineControlsA
mixerGetID
mixerGetDevCapsA
mixerGetControlDetailsA
mixerClose
PlaySoundA
waveInReset
waveInStart
waveInUnprepareHeader
waveOutClose
waveOutGetDevCapsA
waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveOutReset
waveOutUnprepareHeader
waveOutWrite
mmioSeek

wsock32

gethostbyname
gethostname
getsockname
ioctlsocket
inet_addr
WSACleanup
WSAStartup

comctl32

ord6
CreateToolbarEx
ImageList_AddMasked
ImageList_Create
ImageList_Destroy
ImageList_DrawEx
ImageList_ReplaceIcon
InitCommonControlsEx
PropertySheetA
ord8

ole32

CoInitializeEx
CoRegisterClassObject
CoRegisterMessageFilter
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoUninitialize
CreateOleAdviseHolder
CreateStreamOnHGlobal
IsAccelerator
OleInitialize
OleLockRunning
OleRegEnumVerbs
OleRegGetMiscStatus
OleRegGetUserType
OleSaveToStream
OleUninitialize
CoCreateInstance
WriteClassStm
CLSIDFromProgID
CLSIDFromString
StringFromCLSID

oleaut32

LoadRegTypeLi
OleCreateFontIndirect
OleCreatePropertyFrame
RegisterTypeLi
SysAllocString
SysAllocStringLen
SysFreeString
SysStringByteLen
SysStringLen
VarUI4FromStr
VariantChangeType
VariantClear
LoadTypeLi

shlwapi

StrChrA
StrCmpNIA

shell32

SHGetPathFromIDListA
Shell_NotifyIconA
SHGetFileInfoA
SHGetMalloc
SHGetSpecialFolderLocation
ShellExecuteA

crypt32

CertCreateCertificateContext
CertOpenSystemStoreA
CertOpenStore
CertNameToStrA
CertGetSubjectCertificateFromStore
CertGetIssuerCertificateFromStore
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore

netapi32

Netbios

Exports

Exports

SqmAddToAverage
SqmAddToStream
SqmAddToStreamDWord
SqmAddToStreamString
SqmAddToStreamV
SqmCleanup
SqmClearFlags
SqmCreateNewId
SqmEndSession
SqmFlushSession
SqmGetEnabled
SqmGetFlags
SqmGetMachineId
SqmGetSession
SqmGetSessionStartTime
SqmGetUserId
SqmIncrement
SqmIsWindowsOptedIn
SqmReadSharedMachineId
SqmReadSharedUserId
SqmSet
SqmSetAppId
SqmSetAppVersion
SqmSetBits
SqmSetBool
SqmSetCurrentTimeAsUploadTime
SqmSetEnabled
SqmSetFlags
SqmSetIfMax
SqmSetIfMin
SqmSetMachineId
SqmSetString
SqmSetUserId
SqmStartSession
SqmStartUpload
SqmSysprepGeneralize
SqmSysprepSpecialize
SqmTimerAccumulate
SqmTimerAddToAverage
SqmTimerRecord
SqmTimerStart
SqmUnattendedSetup
SqmWaitForUploadComplete
SqmWriteSharedMachineId
SqmWriteSharedUserId

Sections

.text
Size: 232KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b5c12902bf41a0455456a10e88594714

Headers

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

winmm

wsock32

comctl32

ole32

oleaut32

shlwapi

shell32

crypt32

netapi32

Exports

Exports

Sections

.text Size: 232KB - Virtual size: 232KB

.rdata Size: 48KB - Virtual size: 48KB

.data Size: 24KB - Virtual size: 1.7MB

.idata Size: 16KB - Virtual size: 16KB

.rsrc Size: 24KB - Virtual size: 24KB

.text
Size: 232KB - Virtual size: 232KB

.rdata
Size: 48KB - Virtual size: 48KB

.data
Size: 24KB - Virtual size: 1.7MB

.idata
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 24KB - Virtual size: 24KB