ffea6dbd2365a522235d7618dd916b68_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

ffea6dbd2365a522235d7618dd916b68_JaffaCakes118
Size

8.1MB
MD5

ffea6dbd2365a522235d7618dd916b68
SHA1

0ca3c17edd4c3fc96d65f22565a650f8e321b1b7
SHA256

3c1d22d3f68a21d8285b8052d7ae50993d194451af83e9846648f3d06f1deaa6
SHA512

1396bd9760ad166ff663fce01cf670ce75b688939f36ee4c6ce8a97479d846d247a2c75f9b471ac2a746a6615f4efb06e13b5bedb99aea6eae3604b53246faa1
SSDEEP

6144:slxREpAlepdrlbFiGGgiUWWHQCQPj1PBWbSNe10iXI7WTeMlOps4vWs:slopAl+rpZ6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffea6dbd2365a522235d7618dd916b68_JaffaCakes118

Files

ffea6dbd2365a522235d7618dd916b68_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2152e24ccd025c9b7bf1048c7e0538f4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcmpiA
GlobalMemoryStatusEx
CopyFileA
GetModuleHandleA
GetStartupInfoA
GlobalLock
GlobalUnlock
GlobalFree
UnmapViewOfFile
HeapAlloc
HeapFree
MapViewOfFile
GetTickCount
ExpandEnvironmentStringsA
GetLocalTime
WinExec
GetCurrentProcess
SetLastError
GetModuleFileNameA
WriteFile
ReadFile
CreateFileA
GetFileSize
GetLogicalDriveStringsA
CreateEventA
GetDiskFreeSpaceExA
GetFileAttributesA
CreateDirectoryA
GetLastError
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
WideCharToMultiByte
MultiByteToWideChar
FreeLibrary
GetWindowsDirectoryA
CreateMutexA
Sleep
ExitProcess
GetSystemDirectoryA
SetErrorMode
OpenEventA
ReleaseMutex
OpenProcess
GetSystemInfo
lstrlenA
lstrcpyA
VirtualAlloc
GetProcAddress
LeaveCriticalSection
InitializeCriticalSection
LoadLibraryExA
CloseHandle
GetCurrentThreadId

user32

CloseClipboard
SetClipboardData
SetRect
GetDC
GetDesktopWindow
GetCursorPos
mouse_event
WindowFromPoint
DefWindowProcA
CreateWindowExA
RegisterClassExA
LoadIconA
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
IsWindow
MapVirtualKeyA
DispatchMessageA
keybd_event
SystemParametersInfoA
SendMessageA
LoadCursorA
CallNextHookEx
GetKeyNameTextA
PostQuitMessage
TranslateMessage
GetMessageA
CloseWindow
PostMessageA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop

gdi32

DeleteObject
BitBlt
CreateDIBSection
SelectObject
CreateCompatibleBitmap
GetDIBits
CreateCompatibleDC
DeleteDC

advapi32

InitializeAcl
RegQueryValueA
RegCloseKey
LsaFreeMemory
LsaOpenPolicy
LsaRetrievePrivateData
LsaClose
LookupAccountNameA
IsValidSid
OpenServiceA
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
RegOpenKeyA
AdjustTokenPrivileges
OpenProcessToken
FreeSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
GetLengthSid
AllocateAndInitializeSid
RegEnumValueA
QueryServiceConfigA
QueryServiceStatus
ChangeServiceConfigA
LockServiceDatabase
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegQueryInfoKeyA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
LookupAccountSidA
GetTokenInformation
RegOpenKeyExA

shell32

SHGetSpecialFolderPathA

msvcrt

__getmainargs
_strnicmp
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
_strcmpi
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
calloc
_beginthreadex
rand
printf
atoi
realloc
strncat
strncpy
strcat
strcmp
memset
??2@YAPAXI@Z
??3@YAXPAX@Z
memcpy
__CxxFrameHandler
memmove
ceil
_ftol
memcmp
_CxxThrowException
strchr
malloc
strcpy
free
_except_handler3
strlen

winmm

waveOutPrepareHeader
waveOutClose
waveOutUnprepareHeader
waveOutReset
waveInClose
waveInUnprepareHeader
waveInReset
waveInStop
waveOutWrite
waveInStart
waveInAddBuffer
waveInPrepareHeader
waveInOpen
waveInGetNumDevs
waveOutGetNumDevs
waveOutOpen

ws2_32

WSAStartup
WSACleanup
setsockopt
getsockname
gethostname
send
select
recv
ntohs
closesocket
socket
gethostbyname
htons
connect

msvcp60

?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

avicap32

capGetDriverDescriptionA
capCreateCaptureWindowA

msvfw32

ICSeqCompressFrame
ICSeqCompressFrameEnd
ICSeqCompressFrameStart
ICSendMessage
ICOpen
ICClose
ICCompressorFree

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationA

Sections

.text
Size: 76KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2152e24ccd025c9b7bf1048c7e0538f4

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

msvcrt

winmm

ws2_32

msvcp60

avicap32

msvfw32

wtsapi32

Sections

.text Size: 76KB - Virtual size: 72KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 12KB - Virtual size: 10KB

.rsrc Size: 16KB - Virtual size: 13KB

.text
Size: 76KB - Virtual size: 72KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 12KB - Virtual size: 10KB

.rsrc
Size: 16KB - Virtual size: 13KB