fefa2d3f3f45af6e8c963d5c57a81356_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fefa2d3f3f45af6e8c963d5c57a81356_JaffaCakes118
Size

261KB
MD5

fefa2d3f3f45af6e8c963d5c57a81356
SHA1

b8dcd456abdda7c1b397adf28c56f4cee1c8c64b
SHA256

da2aa35abb851c262acbd7b99816585aca3b590f6694c20dc87b678391deb7ea
SHA512

9535eeb75b25e6fc75e835ee160819535f3d157e74e8c5eeef9907589b82feecaf4aa55c4e3a236b9e07709e1aaf68fa48a0b97e759ff681b98e8a93b9e3eca0
SSDEEP

3072:P0ZI7k3x23eiSq6TrLMNdlxrBpJo96rNVusD7Rjad/vpaDXMyIdzCzc7ZyQA8tPV:Kx0SqiLyPxtoUuChalvcxhp/EpV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fefa2d3f3f45af6e8c963d5c57a81356_JaffaCakes118

Files

fefa2d3f3f45af6e8c963d5c57a81356_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f33c75a476164a529dfffc12b51d3976

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapCreate
HeapFree
VirtualFree
FlushFileBuffers
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
InitializeCriticalSectionAndSpinCount
SetFilePointer
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateFileA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
SetEndOfFile
GetProcessHeap
ReadFile
WriteFile
GetTickCount
GetLocalTime
Sleep
GetModuleFileNameA
GetCommandLineA
GetTempPathA
CreateDirectoryA
DeleteFileA
RemoveDirectoryA
MoveFileA
CreateMutexA
GetLastError
lstrcpyA
lstrcatA
lstrlenA
ExpandEnvironmentStringsA
GetFileAttributesExA
CreateThread
WaitForSingleObject
TerminateThread
CloseHandle
HeapDestroy
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
LoadLibraryW
ExitProcess
OutputDebugStringW
GetFileType
WriteConsoleW
OutputDebugStringA
GetStdHandle
DebugBreak
LCMapStringW
LCMapStringA
MultiByteToWideChar
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
SetLastError
TlsFree
GetCurrentThreadId
TlsSetValue
TlsAlloc
GetModuleHandleW
TlsGetValue
GetProcAddress
IsBadReadPtr
HeapValidate
GetStartupInfoA
GetModuleFileNameW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement

user32

wsprintfA
GetClassLongA

advapi32

RegOpenKeyExA
RegSetValueExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
RegDeleteValueA
RegCreateKeyExA

ole32

CoInitialize

shell32

ShellExecuteA

shlwapi

PathFileExistsA
PathFindFileNameA
PathRemoveBlanksA
PathGetArgsA
PathIsDirectoryA

gdi32

SetMiterLimit
SetColorAdjustment
GetTextExtentExPointI
CreateFontIndirectExW
CreateCompatibleBitmap
SetMetaRgn
GetKerningPairsW
CreateFontW
EnumFontFamiliesA

ws2_32

recv
closesocket
__WSAFDIsSet
select
connect
ioctlsocket
htons
socket
gethostbyname
WSAStartup
send

netapi32

Netbios

comdlg32

ReplaceTextA

comsvcs

SafeRef
RecycleSurrogate
MTSCreateActivity

crypt32

CertAddCRLContextToStore
CryptVerifyMessageHash
CertOIDToAlgId
CertNameToStrA
CryptRegisterDefaultOIDFunction
CertEnumSubjectInSortedCTL
CryptMsgSignCTL
CryptGetOIDFunctionAddress
CryptExportPKCS8
CryptRegisterOIDInfo
CryptFindCertificateKeyProvInfo
CryptDecodeObject
CryptHashCertificate
CryptRegisterOIDFunction
CertEnumCertificatesInStore
CryptUnprotectData
CertAddEncodedCRLToStore
CryptMsgEncodeAndSignCTL
CertDuplicateStore
CertFindCTLInStore
CertAddStoreToCollection
PFXExportCertStore
CertEnumCTLContextProperties
CertCreateCertificateContext
CertSaveStore
CertGetCTLContextProperty
CertFreeCRLContext
CertAddEncodedCertificateToSystemStoreW
CertAddSerializedElementToStore
CertSetCTLContextProperty
PFXImportCertStore
CryptStringToBinaryW
CertGetStoreProperty
CertVerifyCertificateChainPolicy
CertFreeCTLContext
CertVerifyRevocation
CryptVerifyDetachedMessageSignature
CertEnumCRLContextProperties
CertFindAttribute
CertFindSubjectInSortedCTL
CryptInstallOIDFunctionAddress
CertComparePublicKeyInfo
CryptMsgControl
CryptMsgVerifyCountersignatureEncoded
CertGetNameStringW
CertAddEncodedCertificateToSystemStoreA
CertIsRDNAttrsInCertificateName
PFXIsPFXBlob
CertRegisterPhysicalStore
CertDeleteCertificateFromStore
CertAddCTLLinkToStore
CryptFindOIDInfo
CryptSignAndEncodeCertificate
CertDuplicateCertificateChain
CryptVerifyMessageSignature
CertRemoveEnhancedKeyUsageIdentifier
CertGetIssuerCertificateFromStore
CryptCreateKeyIdentifierFromCSP
CryptVerifyCertificateSignature
CryptGetKeyIdentifierProperty
CertCompareCertificateName
CertAddEncodedCTLToStore
CertOpenStore
CryptImportPublicKeyInfo
CertAddCertificateContextToStore
CertCreateSelfSignCertificate
CertNameToStrW
CryptUninstallDefaultContext
CertFindCertificateInStore
CertCreateCTLContext
CryptUnregisterOIDInfo
CryptFindLocalizedName
CryptVerifyCertificateSignatureEx
CryptSignAndEncryptMessage
CryptMsgCountersignEncoded
CertCreateCertificateChainEngine
CryptMsgDuplicate
CryptBinaryToStringW
CertGetCertificateContextProperty
CertFindCertificateInCRL
CertGetCRLContextProperty
CryptEnumOIDInfo
CryptSignMessageWithKey
CertVerifyValidityNesting
CertDuplicateCRLContext
CryptBinaryToStringA
CryptMsgOpenToDecode
CryptGetMessageCertificates
CryptMemFree
CertCompareCertificate
CryptSetOIDFunctionValue
CertVerifyCRLRevocation
CryptInstallDefaultContext
CertCompareIntegerBlob
CryptCreateAsyncHandle
CertGetValidUsages
CryptMsgOpenToEncode
CryptMemRealloc
CertSerializeCRLStoreElement
CryptGetDefaultOIDFunctionAddress
CertCreateContext
CertAddCTLContextToStore
CertEnumSystemStoreLocation
CertRDNValueToStrA
CertGetPublicKeyLength
CertGetCRLFromStore
CertAddCRLLinkToStore
CryptMsgClose
CertAddEnhancedKeyUsageIdentifier
CertVerifySubjectCertificateContext
CertEnumCertificateContextProperties
CryptGetMessageSignerCount
CertVerifyTimeValidity
CertResyncCertificateChainEngine
CryptHashMessage
CertCreateCRLContext
CertSetEnhancedKeyUsage
CertAddEncodedCertificateToStore
CryptExportPublicKeyInfo
CryptEncodeObject
CertFindChainInStore
CryptMsgGetParam
CertCloseStore

iphlpapi

GetNetworkParams
GetBestRoute
SetIpStatistics
GetOwnerModuleFromUdpEntry
GetAdaptersInfo
GetIpErrorString
GetAdapterOrderMap
GetIpForwardTable
DisableMediaSense
GetIcmpStatistics
GetNumberOfInterfaces
AddIPAddress
GetIcmpStatisticsEx
GetTcpTable
CreateIpForwardEntry
IpRenewAddress
NotifyAddrChange
GetUniDirectionalAdapterInfo
GetPerAdapterInfo
GetIfTable
DeleteIPAddress
GetOwnerModuleFromTcpEntry
GetExtendedTcpTable
SetIpNetEntry
EnableRouter
GetIpStatistics
UnenableRouter
NhpAllocateAndGetInterfaceInfoFromStack
GetUdpStatistics
DeleteProxyArpEntry
GetIpNetTable
GetRTTAndHopCount
GetIpAddrTable
GetIpStatisticsEx
GetBestInterface
GetFriendlyIfIndex

msi

ord168
ord107
ord249
ord93
ord228
ord155
ord252
ord108
ord90
ord251
ord10
ord255
ord81
ord70
ord109
ord273
ord59
ord69
ord204
ord238
ord11
ord229
ord60
ord8
ord42
ord239
ord101
ord41
ord213
ord256
ord40
ord177
ord130
ord39
ord96
ord43
ord157
ord244
ord37
ord219
ord176
ord254
ord203
ord215
ord175
ord270
ord16
ord259
ord181
ord250
ord15
ord65
ord225
ord272
ord262
ord281
ord274
ord276
ord264
ord85
ord82
ord89
ord240
ord71
ord202
ord88
ord192
ord242
ord257
ord190
ord110
ord224
ord208

msvfw32

ICOpen
ord2
ICClose
ICOpenFunction
ICCompressorFree
DrawDibEnd
ICInstall
MCIWndCreateA
DrawDibChangePalette
DrawDibGetPalette
ICSeqCompressFrameEnd
ICImageCompress
ICDraw
ICCompressorChoose
MCIWndCreateW
DrawDibRealize
ICRemove
DrawDibStop
ICDrawBegin
ICDecompress
ICInfo
MCIWndRegisterClass
ICGetInfo
DrawDibGetBuffer
DrawDibOpen

mswsock

AcceptEx

Sections

.text
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f33c75a476164a529dfffc12b51d3976

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

shell32

shlwapi

gdi32

ws2_32

netapi32

comdlg32

comsvcs

crypt32

iphlpapi

msi

msvfw32

mswsock

Sections

.text Size: 170KB - Virtual size: 170KB

.rdata Size: 67KB - Virtual size: 66KB

.data Size: 4KB - Virtual size: 21KB

.reloc Size: 18KB - Virtual size: 17KB

.text
Size: 170KB - Virtual size: 170KB

.rdata
Size: 67KB - Virtual size: 66KB

.data
Size: 4KB - Virtual size: 21KB

.reloc
Size: 18KB - Virtual size: 17KB