fffc5b9a6a9568c74555e644a69e3432_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fffc5b9a6a9568c74555e644a69e3432_JaffaCakes118
Size

255KB
MD5

fffc5b9a6a9568c74555e644a69e3432
SHA1

1083eef918e2f010418ccb895bef3bb2226f745a
SHA256

328e65c75917b6035ecf3993bb8fd714b739e23a7be31d4738b0a12a7576fcd6
SHA512

c97b8e13acf96ac406473724dcdb7550eeb95f26ad811e89b0834c10860196e884ec459ee7dfaff0f0bc8b21808ac7450b2fb266e0f68b6f02485952582344f8
SSDEEP

6144:mt+5lyyQJQooCpZEfkmJAmMVr0wtJbox1x:jCChCPEfkmXMVrvta

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fffc5b9a6a9568c74555e644a69e3432_JaffaCakes118

Files

fffc5b9a6a9568c74555e644a69e3432_JaffaCakes118
.exe windows:5 windows x86 arch:x86

957984e29bf429f6de0a1eef856e3111

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FlushFileBuffers
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
InitializeCriticalSectionAndSpinCount
SetFilePointer
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateFileA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
SetEndOfFile
GetProcessHeap
ReadFile
GetTickCount
GetLocalTime
Sleep
GetModuleFileNameA
GetCommandLineA
GetTempPathA
CreateDirectoryA
DeleteFileA
RemoveDirectoryA
MoveFileA
CreateMutexA
GetLastError
lstrcpyA
lstrcatA
lstrlenA
ExpandEnvironmentStringsA
GetFileAttributesExA
CreateThread
WaitForSingleObject
TerminateThread
CloseHandle
WriteFile
VirtualFree
HeapFree
HeapCreate
HeapDestroy
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
LoadLibraryW
ExitProcess
OutputDebugStringW
GetFileType
WriteConsoleW
OutputDebugStringA
GetStdHandle
DebugBreak
LCMapStringW
LCMapStringA
MultiByteToWideChar
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
SetLastError
TlsFree
GetCurrentThreadId
TlsSetValue
TlsAlloc
GetModuleHandleW
TlsGetValue
GetProcAddress
IsBadReadPtr
HeapValidate
GetStartupInfoA
GetModuleFileNameW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement

user32

GetClassLongA
wsprintfA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyA

ole32

CoInitialize

shell32

ShellExecuteA

shlwapi

PathFileExistsA
PathIsDirectoryA
PathRemoveBlanksA
PathGetArgsA
PathFindFileNameA

gdi32

SelectClipRgn
Escape
EnumFontFamiliesA
RestoreDC
GetTextExtentPoint32A
UpdateColors
EnumEnhMetaFile
CreateFontIndirectExW
SetDCPenColor
GetMapMode
CreateColorSpaceW
FrameRgn

ws2_32

recv
closesocket
__WSAFDIsSet
select
connect
ioctlsocket
htons
socket
gethostbyname
WSAStartup
send

netapi32

Netbios

comdlg32

ReplaceTextW
ReplaceTextA

crypt32

CertFindCertificateInStore
CertAddCertificateContextToStore
CryptEnumOIDInfo
CryptMsgSignCTL
CertSetEnhancedKeyUsage
CertAlgIdToOID
CertOpenSystemStoreA
CryptImportPublicKeyInfoEx

imm32

ImmGetStatusWindowPos
ImmSetCompositionStringA
ImmSetCompositionFontW
ImmGetOpenStatus
ImmGetProperty
ImmGetDefaultIMEWnd
ImmAssociateContext
ImmConfigureIMEW
ImmEscapeA
ImmIsUIMessageA
ImmDestroyContext
ImmIsIME
ImmGetConversionListA
ImmConfigureIMEA
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmEnumRegisterWordW
ImmGetImeMenuItemsW
ImmUnregisterWordA
ImmEnumInputContext
ImmAssociateContextEx
ImmGetIMEFileNameW
ImmGetCompositionWindow
ImmGetCompositionFontW
ImmGetVirtualKey
ImmSimulateHotKey
ImmReleaseContext
ImmInstallIMEA
ImmGetDescriptionW
ImmDisableIME
ImmUnregisterWordW
ImmGetCompositionStringA
ImmGetGuideLineA
ImmEnumRegisterWordA
ImmGetDescriptionA
ImmSetCompositionStringW
ImmGetGuideLineW
ImmIsUIMessageW
ImmSetCompositionFontA

iphlpapi

SetIpForwardEntry
GetInterfaceInfo
GetIpStatisticsEx
EnableRouter
SetIpStatistics
SetTcpEntry
GetAdaptersInfo
FlushIpNetTable
NotifyAddrChange
GetOwnerModuleFromUdpEntry
NotifyRouteChange
GetUdpStatistics
GetIcmpStatisticsEx
GetIpAddrTable
CreateProxyArpEntry
DeleteIpNetEntry
IpReleaseAddress
GetAdapterOrderMap
CreateIpForwardEntry
CreateIpNetEntry
GetTcpStatisticsEx
SetIfEntry
GetIfTable
GetFriendlyIfIndex

msi

ord246
ord261
ord230
ord273
ord156
ord65
ord112
ord96
ord154
ord251
ord253
ord66
ord44
ord69
ord72
ord241
ord224
ord87
ord40
ord11
ord181
ord36
ord104
ord192
ord213
ord252
ord38
ord226
ord43
ord264
ord244
ord211
ord168
ord177
ord42
ord259
ord157
ord173
ord267
ord174
ord37
ord205
ord83
ord59
ord155
ord176
ord15
ord129
ord195
ord108
ord232
ord41
ord89
ord217
ord269
ord260
ord242
ord179
ord45
ord223
ord169
ord90
ord107
ord212

msimg32

TransparentBlt

msvfw32

ICImageCompress
ICImageDecompress
ICOpenFunction
DrawDibStart
MCIWndCreateA
DrawDibBegin
ICLocate
ICDraw
ICInstall
ICInfo
DrawDibRealize
ICSeqCompressFrameStart
DrawDibChangePalette
DrawDibTime
DrawDibSetPalette
MCIWndRegisterClass
DrawDibDraw
DrawDibGetPalette
DrawDibOpen
ICDrawBegin

mswsock

GetAcceptExSockaddrs

Sections

.text
Size: 168KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

957984e29bf429f6de0a1eef856e3111

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

shell32

shlwapi

gdi32

ws2_32

netapi32

comdlg32

crypt32

imm32

iphlpapi

msi

msimg32

msvfw32

mswsock

Sections

.text Size: 168KB - Virtual size: 168KB

.rdata Size: 64KB - Virtual size: 63KB

.data Size: 4KB - Virtual size: 21KB

.reloc Size: 17KB - Virtual size: 17KB

.text
Size: 168KB - Virtual size: 168KB

.rdata
Size: 64KB - Virtual size: 63KB

.data
Size: 4KB - Virtual size: 21KB

.reloc
Size: 17KB - Virtual size: 17KB