ffcf63da86781ad4128c2e76e5c847da_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ffcf63da86781ad4128c2e76e5c847da_JaffaCakes118
Size

261KB
MD5

ffcf63da86781ad4128c2e76e5c847da
SHA1

3ff2f7d2c82d9c3a158971703ce7c7da224de51f
SHA256

25349519d75a86a02063042dc2b9cc45241db0e5d508b144b5c99b0affd9e179
SHA512

001a438ba43be46d16f2a920237b7e1146a610cf80847c896fc7df51b02e91e48962c30b5e283654ef3f677318213a4e1670105ea57a02770f7d08cebfe2ac3d
SSDEEP

6144:0AMkDY/LUar25pMWd9fuL5wZT5I/ew8c:1bCBa52Wd9ckI2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffcf63da86781ad4128c2e76e5c847da_JaffaCakes118

Files

ffcf63da86781ad4128c2e76e5c847da_JaffaCakes118
.exe windows:5 windows x86 arch:x86

03f35e4292d13ea1f640619564607fb1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
GetLocalTime
Sleep
GetModuleFileNameA
GetCommandLineA
GetTempPathA
CreateDirectoryA
DeleteFileA
RemoveDirectoryA
MoveFileA
GetLastError
lstrcpyA
lstrcatA
lstrlenA
ExpandEnvironmentStringsA
GetFileAttributesExA
CreateThread
WriteFile
WaitForSingleObject
TerminateThread
CloseHandle
ReadFile
GetProcessHeap
SetEndOfFile
LoadLibraryA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
CreateFileA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
SetFilePointer
InitializeCriticalSectionAndSpinCount
VirtualAlloc
HeapReAlloc
HeapSize
HeapAlloc
FlushFileBuffers
VirtualFree
HeapFree
HeapCreate
HeapDestroy
CreateMutexA
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
LoadLibraryW
ExitProcess
OutputDebugStringW
GetFileType
WriteConsoleW
OutputDebugStringA
GetStdHandle
DebugBreak
LCMapStringW
LCMapStringA
MultiByteToWideChar
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
SetLastError
TlsFree
GetCurrentThreadId
TlsSetValue
TlsAlloc
GetModuleHandleW
TlsGetValue
GetProcAddress
IsBadReadPtr
HeapValidate
GetStartupInfoA
GetModuleFileNameW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement

user32

wsprintfA
GetClassLongA

advapi32

RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyA
RegCloseKey
RegOpenKeyExA
RegDeleteValueA

ole32

CoInitialize

shell32

ShellExecuteA

shlwapi

PathIsDirectoryA
PathFileExistsA
PathRemoveBlanksA
PathGetArgsA
PathFindFileNameA

gdi32

ExtCreatePen
RoundRect
GdiComment
GetGlyphOutlineA
GetCharWidthI
ColorCorrectPalette
SetDIBitsToDevice
GetPaletteEntries
SelectPalette
CreatePolygonRgn
GetBitmapBits
EndDoc
EnumMetaFile
InvertRgn
DescribePixelFormat
SetPaletteEntries
OffsetWindowOrgEx
SetBitmapBits
GetBitmapDimensionEx
GetCurrentObject
GetBoundsRect
GetMiterLimit
GetKerningPairsA
GdiGradientFill
SetBitmapDimensionEx
RectVisible
CreateBrushIndirect
SetGraphicsMode
CopyMetaFileA
SetWindowExtEx
GetTextFaceW
CreateCompatibleBitmap
EnumFontFamiliesW
GetOutlineTextMetricsW
SetDIBColorTable
CreateColorSpaceW
PolyPolygon
SetPixel
CreateMetaFileW
PolyPolyline
SetMapMode
SelectObject
CombineRgn
SetViewportExtEx
GdiTransparentBlt
StrokePath

ws2_32

recv
closesocket
__WSAFDIsSet
select
connect
ioctlsocket
htons
socket
gethostbyname
WSAStartup
send

netapi32

Netbios

comdlg32

PageSetupDlgW
GetFileTitleW

comsvcs

CoEnterServiceDomain
RecycleSurrogate
CoCreateActivity
SafeRef

crypt32

CryptMsgClose
CertCreateCRLContext
CryptMemAlloc
CertRemoveStoreFromCollection
CryptCreateAsyncHandle
CryptEnumKeyIdentifierProperties
CryptMsgDuplicate
CryptRegisterOIDInfo
CertRDNValueToStrA
CertRemoveEnhancedKeyUsageIdentifier
CertAddEncodedCertificateToSystemStoreA
CertAddCRLContextToStore
CertEnumCRLsInStore
CryptProtectData
CertSaveStore
CryptGetMessageSignerCount
CertGetPublicKeyLength
CryptHashPublicKeyInfo
CertControlStore
CryptHashToBeSigned
CertSetStoreProperty
CertCompareCertificateName
CertAddCTLContextToStore
CryptGetOIDFunctionValue
CryptRegisterOIDFunction
CertGetNameStringA
CertAddEncodedCertificateToSystemStoreW
CertGetCertificateContextProperty
CryptEnumOIDFunction
CertGetStoreProperty
CertGetIssuerCertificateFromStore
CryptVerifyDetachedMessageSignature
CertDuplicateCRLContext
CertEnumCertificatesInStore
CryptMsgControl
CertCreateCTLContext
CertSetEnhancedKeyUsage
CertEnumCTLsInStore
PFXVerifyPassword
CryptRegisterDefaultOIDFunction
CryptFindOIDInfo
CertDeleteCTLFromStore
CertIsValidCRLForCertificate
CertCompareCertificate
CryptExportPublicKeyInfo
CertSerializeCertificateStoreElement
CertAddCRLLinkToStore
CertComparePublicKeyInfo
CertRegisterPhysicalStore
CryptMsgUpdate
CryptMsgGetParam
CryptVerifyDetachedMessageHash
CryptEncryptMessage
CertFindSubjectInSortedCTL
CertRegisterSystemStore
CryptSignMessage
CertFreeCertificateChainEngine
CertFindRDNAttr
CryptImportPublicKeyInfo
CryptGetAsyncParam
PFXIsPFXBlob
CertVerifyCTLUsage
CryptInitOIDFunctionSet
CertFindExtension
CertFindCTLInStore
CryptHashCertificate
CryptMsgOpenToEncode
CryptSignAndEncodeCertificate
CertNameToStrA
CryptMsgVerifyCountersignatureEncodedEx
CertCompareIntegerBlob
CertAddCertificateContextToStore
PFXImportCertStore
CryptVerifyMessageSignature
CryptFindLocalizedName
CryptEncodeObject
CertOIDToAlgId
CryptVerifyMessageSignatureWithKey
CryptCloseAsyncHandle
CryptAcquireCertificatePrivateKey
CertFreeCertificateContext
CryptDecodeObjectEx
CryptSignCertificate
CertAddEncodedCRLToStore
CryptSetKeyIdentifierProperty
CertDeleteCRLFromStore
CertCreateCertificateContext
CryptSetOIDFunctionValue
CryptInstallOIDFunctionAddress

imm32

ImmGetGuideLineA
ImmGetImeMenuItemsA
ImmGetImeMenuItemsW
ImmIsUIMessageW
ImmGetCompositionStringA
ImmSetCompositionWindow
ImmGetCandidateListW
ImmSetCompositionFontA
ImmGetDescriptionW
ImmSetStatusWindowPos
ImmCreateContext
ImmGetCandidateWindow
ImmConfigureIMEW
ImmGetOpenStatus
ImmUnregisterWordA
ImmSetOpenStatus
ImmGetConversionStatus
ImmGetVirtualKey
ImmGetCompositionWindow
ImmGetRegisterWordStyleA
ImmGetRegisterWordStyleW
ImmGetCompositionFontA
ImmRegisterWordW
ImmSimulateHotKey
ImmDisableIME
ImmIsUIMessageA

iphlpapi

GetPerAdapterInfo
GetTcpStatistics
RestoreMediaSense
GetBestInterface
GetUdpStatisticsEx
DeleteIpForwardEntry
NhpAllocateAndGetInterfaceInfoFromStack
GetUdpTable
GetIcmpStatistics
GetBestRoute
IpRenewAddress
DeleteProxyArpEntry
GetIpNetTable
CancelIPChangeNotify
GetIfTable
GetAdapterOrderMap
GetNetworkParams
DisableMediaSense
GetOwnerModuleFromUdpEntry
GetExtendedUdpTable
GetIpAddrTable
CreateIpForwardEntry
GetUdpStatistics
SendARP
GetInterfaceInfo
GetNumberOfInterfaces
GetTcpTable
GetIpForwardTable
GetIfEntry
GetOwnerModuleFromTcpEntry
GetAdapterIndex
AddIPAddress
CreateIpNetEntry
DeleteIPAddress

msi

ord154
ord247
ord68
ord173
ord72
ord107
ord110
ord193
ord129
ord226
ord131
ord205
ord228
ord111
ord102
ord277
ord217
ord141
ord275
ord84
ord273
ord281
ord11
ord112
ord37
ord89
ord256
ord202
ord266
ord274
ord194
ord90
ord244
ord227
ord95
ord86
ord239
ord81
ord268
ord178
ord181
ord255
ord223
ord16
ord156
ord232
ord67
ord219
ord94
ord93
ord192
ord168
ord10
ord210
ord229
ord224
ord254
ord225
ord108
ord231
ord59
ord43
ord260
ord259
ord5
ord60
ord270

msimg32

GradientFill
AlphaBlend

msvfw32

MCIWndCreateA
ICLocate
DrawDibClose
ICImageCompress
ICGetDisplayFormat
ICOpen
DrawDibOpen
DrawDibGetBuffer
DrawDibSetPalette
DrawDibRealize
ICImageDecompress
DrawDibProfileDisplay
ICInstall
ICCompressorChoose
ICSeqCompressFrame
DrawDibStop
ICDecompress
ICGetInfo
DrawDibBegin
DrawDibStart
ICSeqCompressFrameEnd
MCIWndRegisterClass
ICRemove
ICClose
ICSeqCompressFrameStart

mswsock

GetAcceptExSockaddrs
TransmitFile
AcceptEx

Sections

.text
Size: 170KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

03f35e4292d13ea1f640619564607fb1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

shell32

shlwapi

gdi32

ws2_32

netapi32

comdlg32

comsvcs

crypt32

imm32

iphlpapi

msi

msimg32

msvfw32

mswsock

Sections

.text Size: 170KB - Virtual size: 169KB

.rdata Size: 68KB - Virtual size: 67KB

.data Size: 4KB - Virtual size: 21KB

.reloc Size: 18KB - Virtual size: 17KB

.text
Size: 170KB - Virtual size: 169KB

.rdata
Size: 68KB - Virtual size: 67KB

.data
Size: 4KB - Virtual size: 21KB

.reloc
Size: 18KB - Virtual size: 17KB