00e78399ec1ea55a81db652ef0697fe0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

00e78399ec1ea55a81db652ef0697fe0_JaffaCakes118
Size

624KB
MD5

00e78399ec1ea55a81db652ef0697fe0
SHA1

afc76a20fc265cc8e5490c2ca2aae01c5bf5b409
SHA256

7292e1518eb5bf8464bd4470ecd049cdd0dbb8bec033833953e29315f678107c
SHA512

f4955643e707bb973d652330e8c7efdc2976cb3cb84983982fefe62630b4d5832e3decccc9a9ec7543e024dca1a332b1ec1bb9a9379400f92d6c4d10833096e7
SSDEEP

6144:5b3lsPQvxPt48r20F6rDs3pGk4egkVM9s/uYGb9QyD97T8B29qLezoZy7rGMixZ0:J3rVNr5TgwtfyDxT8BLeky769xy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00e78399ec1ea55a81db652ef0697fe0_JaffaCakes118

Files

00e78399ec1ea55a81db652ef0697fe0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6c98889da53f79c5344f34ba05dad1ff

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

UuidCreate

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

ws2_32

WSCGetProviderPath
WSACleanup
WSCDeinstallProvider
WSCInstallProvider
WSCEnumProtocols
WSAStartup

msvcr71

_onexit
__dllonexit
__security_error_handler
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_amsg_exit
_wcmdln
_cexit
_XcptFilter
_exit
_c_exit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_controlfp
_access
_unlink
_chsize
_chmod
strtoul
_filelength
_lseek
calloc
_wstat
sprintf
rename
_errno
strstr
strchr
sscanf
wcsncmp
wcstok
_wgetenv
mbstowcs
_purecall
_resetstkoflw
_wgetcwd
_wchdir
printf
_wcsdup
realloc
fflush
fputc
vswprintf
time
srand
rand
memmove
_CxxThrowException
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
??_U@YAPAXI@Z
_wopen
_close
??_V@YAXPAX@Z
_wchmod
_itow
wcschr
swscanf
_wrename
_wcslwr
_wsplitpath
_wunlink
fgetws
wcsstr
_wcsicmp
_wfopen
fputws
fclose
wcsrchr
_wsopen
malloc
_eof
_read
_wcsupr
_waccess
exit
_wtoi
wcscat
free
wcscmp
wcsncat
__CxxFrameHandler
wcslen
??2@YAPAXI@Z
??3@YAXPAX@Z
_except_handler3
swprintf
_snwprintf
wcscpy
wcsncpy
clock
_sopen
_write
_stat

mfc71u

ord2856
ord2985
ord4480
ord3158
ord572
ord587
ord5066
ord5064
ord4611
ord4838
ord4184
ord5178
ord4207
ord4730
ord4884
ord2011
ord1662
ord1661
ord5908
ord1392
ord4238
ord5207
ord4714
ord4256
ord3126
ord6115
ord5829
ord2155
ord2651
ord4861
ord6086
ord2086
ord4234
ord3311
ord741
ord3204
ord1925
ord3157
ord1271
ord3198
ord2366
ord2160
ord630
ord2012
ord3635
ord3435
ord4206
ord4729
ord5199
ord605
ord4574
ord5196
ord4314
ord354
ord1785
ord715
ord1367
ord5699
ord1634
ord1572
ord3286
ord1051
ord1021
ord3065
ord5472
ord1645
ord1589
ord3322
ord3674
ord754
ord2861
ord3793
ord2364
ord1556
ord651
ord416
ord629
ord384
ord3155
ord6013
ord5640
ord589
ord330
ord3280
ord1545
ord3189
ord620
ord3662
ord3547
ord977
ord4119
ord1318
ord2027
ord1573
ord5208
ord4274
ord1512
ord4266
ord721
ord5609
ord4577
ord1047
ord2422
ord4313
ord3661
ord3546
ord5065
ord6232
ord4791
ord718
ord515
ord519
ord4312
ord6061
ord3678
ord3590
ord760
ord1190
ord6116
ord1091
ord3281
ord4117
ord2361
ord3417
ord326
ord4109
ord3395
ord3995
ord5637
ord5636
ord2362
ord1299
ord2167
ord2461
ord280
ord283
ord870
ord577
ord774
ord293
ord4320
ord2009
ord1007
ord5096
ord2261
ord4078
ord776
ord1479
ord2895
ord6111
ord282
ord2926
ord1472
ord1955
ord896
ord899
ord4026
ord2260
ord5558
ord5524
ord4100
ord3990
ord4074
ord2444
ord5485
ord4101
ord3927
ord1536
ord5231
ord5229
ord2384
ord2394
ord2392
ord2390
ord2386
ord2409
ord2397
ord1647
ord1646
ord1590
ord1542
ord6063
ord1582
ord2282
ord3082
ord385
ord2311
ord3877
ord5864
ord5083
ord1058
ord1883
ord5803
ord2657
ord526
ord1106
ord5414
ord3756
ord5171
ord1353
ord4961
ord3339
ord6275
ord3796
ord6273
ord1513
ord2163
ord2169
ord2399
ord2381
ord2379
ord2402
ord2407
ord2388
ord2404
ord931
ord927
ord929
ord925
ord920
ord5956
ord1591
ord4276
ord4716
ord3397
ord5210
ord4179
ord6271
ord5067
ord1899
ord5148
ord4226
ord1393
ord3940
ord1608
ord1611
ord5911
ord2077
ord1894
ord2239
ord757
ord3327
ord4255
ord4475
ord3943
ord2638
ord3703
ord3713
ord3712
ord2527
ord2640
ord2534
ord2832
ord2708
ord4301
ord2829
ord2725
ord2531
ord5562
ord5209
ord5226
ord4562
ord3942
ord5222
ord5220
ord2925
ord1911
ord3826
ord5378
ord6215
ord3800
ord5579
ord2054
ord6274
ord3795
ord6272
ord4008
ord4032
ord1079
ord3677
ord4535
ord1198
ord5727
ord566

kernel32

HeapReAlloc
HeapSize
EnterCriticalSection
HeapDestroy
GetVersionExA
ExitProcess
GetModuleHandleA
CreateFileA
LoadLibraryA
GetSystemTimeAsFileTime
GetCurrentThread
GetCurrentProcess
LoadLibraryExW
WideCharToMultiByte
ExpandEnvironmentStringsA
MultiByteToWideChar
HeapFree
GetProcessHeap
HeapAlloc
LocalAlloc
SetErrorMode
WriteFile
LeaveCriticalSection
GetCurrentProcessId
CreateMutexW
ReleaseMutex
GetLocaleInfoW
SetLastError
GetDriveTypeW
GetStartupInfoW
GetComputerNameW
GlobalAlloc
GlobalFree
GetPrivateProfileIntW
ReadFile
GetSystemDirectoryW
lstrcpynW
SetEvent
TerminateProcess
lstrlenW
lstrcpyW
LocalFree
GetFileTime
GetTickCount
GetSystemTime
SystemTimeToFileTime
QueryPerformanceCounter
FindResourceW
LoadResource
LockResource
GetCurrentThreadId
OpenProcess
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
DeleteFileW
OpenEventW
GetTempPathW
GetDiskFreeSpaceExW
GetFileAttributesW
SetFileAttributesW
ExpandEnvironmentStringsW
GetModuleFileNameW
RemoveDirectoryW
WritePrivateProfileStringW
MoveFileExW
GetWindowsDirectoryW
CreateFileW
GetFileSize
CloseHandle
GetPrivateProfileStringW
GetModuleHandleW
GetShortPathNameW
Sleep
GetCommandLineW
FindFirstFileW
CopyFileW
CreateDirectoryW
FindNextFileW
FindClose
DeleteCriticalSection
InitializeCriticalSection
GetVersionExW
GetLocalTime
GetDateFormatW
GetTimeFormatW
LoadLibraryW
GetLastError
GetProcAddress
FreeLibrary
DeviceIoControl

user32

DrawIconEx
DestroyIcon
FillRect
InflateRect
CopyRect
DrawStateW
GetActiveWindow
GetLastActivePopup
PeekMessageW
DispatchMessageW
TranslateMessage
MapDialogRect
SetRect
GetForegroundWindow
RegisterWindowMessageW
ScreenToClient
PtInRect
GetDC
ReleaseDC
SetCapture
ReleaseCapture
SetWindowLongW
GetSystemMetrics
GetClassNameW
GetClassLongW
SetClassLongW
IsChild
InvalidateRect
GetClientRect
OffsetRect
MessageBeep
SetForegroundWindow
GetDesktopWindow
GetMessagePos
GetWindowRect
SetTimer
GetParent
LoadCursorW
SendMessageW
MessageBoxW
SetCursor
LoadStringW
ExitWindowsEx
PostMessageW
EnableWindow
wsprintfW
LoadImageW
LoadIconW
KillTimer

gdi32

CreateFontIndirectW
GetTextExtentPoint32W
SetPixel
CreateSolidBrush
CreateFontW
GetObjectW
RealizePalette
StretchDIBits
SetDIBitsToDevice
GetDIBits
CreatePalette
GetStockObject
CreatePen
RoundRect
GetPixel

comdlg32

GetOpenFileNameW
CommDlgExtendedError

advapi32

GetTokenInformation
RegOpenKeyExA
RegQueryValueExA
ImpersonateSelf
OpenThreadToken
AddAccessAllowedAce
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
IsValidSecurityDescriptor
AccessCheck
ControlService
StartServiceW
LookupPrivilegeValueW
AdjustTokenPrivileges
SetSecurityDescriptorDacl
CloseServiceHandle
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RevertToSelf
ImpersonateLoggedOnUser
DuplicateTokenEx
OpenProcessToken
SetThreadToken
RegEnumKeyW
RegQueryInfoKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyW
DeleteService
ChangeServiceConfigW
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
RegCreateKeyW
QueryServiceStatus
RegOpenKeyW
CreateServiceW
LookupAccountSidW
RegEnumValueW
GetUserNameW
CreateProcessAsUserW
SetSecurityInfo
SetEntriesInAclW
BuildExplicitAccessWithNameW
GetSecurityDescriptorDacl
GetSecurityInfo
CopySid
GetLengthSid
IsValidSid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
AddAce
InitializeAcl
SetNamedSecurityInfoW
AllocateAndInitializeSid
EqualSid
GetAce
GetAclInformation
GetNamedSecurityInfoW
FreeSid
InitializeSecurityDescriptor

shell32

SHGetSpecialFolderPathW
ShellExecuteW
SHGetMalloc
SHBrowseForFolderW
SHGetPathFromIDListW

comctl32

_TrackMouseEvent

shlwapi

PathIsDirectoryW

ole32

CoUninitialize
CoInitialize
CoCreateInstance
CoGetMalloc
StringFromIID

oleaut32

SysFreeString

msvcp71

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

Sections

.text
Size: 336KB - Virtual size: 333KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 136KB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6c98889da53f79c5344f34ba05dad1ff

Headers

File Characteristics

Imports

rpcrt4

version

ws2_32

msvcr71

mfc71u

kernel32

user32

gdi32

comdlg32

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

msvcp71

Sections

.text Size: 336KB - Virtual size: 333KB

.rdata Size: 88KB - Virtual size: 87KB

.data Size: 136KB - Virtual size: 3.4MB

.rsrc Size: 60KB - Virtual size: 76KB

.text
Size: 336KB - Virtual size: 333KB

.rdata
Size: 88KB - Virtual size: 87KB

.data
Size: 136KB - Virtual size: 3.4MB

.rsrc
Size: 60KB - Virtual size: 76KB