049e62d55bf545abe4228c7bde279c40_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

049e62d55bf545abe4228c7bde279c40_JaffaCakes118
Size

1.2MB
MD5

049e62d55bf545abe4228c7bde279c40
SHA1

4c790e73b856ba764b8348aa4b0366ac55333d2f
SHA256

aaf99647e537bd4189fba7e8acad159ce0fb6260340cc117113b89aacb54d5ee
SHA512

17afd390a8c71837d976027d01f6cc283c02095137e0dec91e28975b926a18b0daf55470b161f1a0636a3a254a4d8c2360faf4b1bdf118e248fd3eb4defed739
SSDEEP

6144:36o2uppt5pc779RX0kW4nW6lBwKMwzcuJhowW4KY6S4DSS/PSELU:3V2uppt5pc779RpTPzNG14VApnSEL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
049e62d55bf545abe4228c7bde279c40_JaffaCakes118

Files

049e62d55bf545abe4228c7bde279c40_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f617177e23a3dfce98bba977dc66bd03

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetFileTime
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
FlushFileBuffers
SetStdHandle
IsBadCodePtr
IsBadReadPtr
GetStringTypeW
GetStringTypeA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
GetFileType
ExitThread
GetTickCount
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
MultiByteToWideChar
WriteFile
TransactNamedPipe
GetTimeFormatA
GetDateFormatA
GetLastError
CreateThread
FileTimeToSystemTime
FileTimeToLocalFileTime
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetEnvironmentVariableW
HeapFree
HeapAlloc
GetProcessHeap
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
OpenProcess
FormatMessageA
GlobalUnlock
GlobalLock
SetFileTime
CreateProcessA
ExpandEnvironmentStringsA
SetFileAttributesA
GetTempPathA
GetVersionExA
CopyFileA
GetExitCodeProcess
PeekNamedPipe
DuplicateHandle
GetCurrentProcess
CreatePipe
GlobalMemoryStatus
GetSystemDirectoryA
GetLocalTime
WideCharToMultiByte
GetComputerNameA
DeleteFileA
GetCurrentProcessId
WaitForSingleObject
CreateMutexA
TerminateThread
MoveFileA
TerminateProcess
lstrcmpi
GetLocaleInfoA
GetLogicalDrives
RtlUnwind
GetTimeZoneInformation
GetSystemTime
HeapReAlloc
GetStartupInfoA
GetCommandLineA
GetVersion
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
RaiseException
HeapSize
LockResource
GetStdHandle
Module32First
GetDiskFreeSpaceExA
Process32Next
GetLogicalDriveStringsA
Process32First
CreateToolhelp32Snapshot
GetDriveTypeA
SetErrorMode
InitializeCriticalSection
GetProcAddress
LocalFree
RaiseException
LocalAlloc
GetModuleHandleA
LeaveCriticalSection
EnterCriticalSection
DuplicateHandle
GetShortPathNameA
ResumeThread
WriteProcessMemory
GetPrivateProfileSectionA
GetStringTypeA
LCMapStringW
LCMapStringA
RtlUnwind
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
FlushInstructionCache
CloseHandle
CreateFileA
CreateFileW
CreateFileMappingA
CreateFileMappingW
CreateProcessA
DeleteFileA
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
FlushFileBuffers
FormatMessageA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetFileAttributesA
GetFileAttributesW
GetFileInformationByHandle
GetFileSize
GetFileTime
GetFullPathNameA
GetFullPathNameW
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileIntA
GetPrivateProfileSectionNamesA
GetPrivateProfileStringA
GetProcAddress
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempPathA
GetVersionExA
GetTickCount
HeapAlloc
HeapFree
HeapCreate
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
LoadLibraryExA
LoadLibraryA
LocalFree
LockFile
MapViewOfFile
MultiByteToWideChar
RaiseException
ReadFile
SetEvent
SetFilePointer
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
UnlockFile
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WideCharToMultiByte
WriteFile
lstrcmpi
CreateThread

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

ws2_32

WSACleanup
WSAStartup
setsockopt
bind
listen
accept
inet_addr
htons
recv
send
select
__WSAFDIsSet
htons
inet_ntoa
socket
ioctlsocket
connect
closesocket
__WSAFDIsSet
WSAAsyncSelect
htonl
htons
WSACleanup
WSAStartup
WSAGetLastError
getsockname
connect
WSAIoctl
gethostbyaddr
recvfrom
setsockopt
select
htonl
htons
gethostname
recv
listen
bind
inet_addr
send
sendto
socket
gethostbyname
inet_ntoa
accept
closesocket
ioctlsocket
WSASocketA

gdi32

DeleteDC
SelectObject
GetDIBColorTable
DeleteObject
CreateDCA
GetDeviceCaps
CreateDIBSection
BitBlt
CreateCompatibleDC
AddFontResourceA
CreateCompatibleDC
CreateDIBSection
DeleteDC
RemoveFontResourceA
GetObjectA
SelectObject
DeleteObject
BitBlt

wininet

InternetGetConnectedStateEx
InternetCrackUrlA
InternetOpenUrlA
InternetReadFile
InternetGetConnectedState
HttpSendRequestA
InternetOpenA
HttpOpenRequestA
InternetConnectA
InternetCloseHandle

netapi32

NetUserDel
NetShareDel
NetUserAdd
NetShareAdd
NetShareEnum
NetUserEnum
NetMessageBufferSend
NetUserGetInfo
NetApiBufferFree

user32

GetKeyState
ExitWindowsEx
GetForegroundWindow
GetWindowTextA
IsWindow
GetAsyncKeyState
OpenClipboard
GetClipboardData
FindWindowA
CloseClipboard
SendMessageA
DestroyWindow
DefWindowProcA
AdjustWindowRectEx
ChangeDisplaySettingsA
CharUpperBuffA
LoadImageA
MessageBoxA
wsprintfA
wvsprintfA
BeginPaint
EndPaint
GetWindowThreadProcessId
SetActiveWindow
SetForegroundWindow
RegisterClassExA
GetSystemMetrics
CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
DestroyWindow
EnumWindows
PostMessageA

advapi32

OpenServiceA
GetUserNameA
StartServiceA
IsValidSecurityDescriptor
CloseServiceHandle
RegQueryValueExA
ControlService
DeleteService
RegDeleteValueA
RegCreateKeyExA
LookupPrivilegeValueA
EnumServicesStatusA
RegCloseKey
OpenProcessToken
OpenSCManagerA
RegSetValueExA
AdjustTokenPrivileges
RegOpenKeyExA

iphlpapi

IcmpSendEcho
IcmpCreateFile
DeleteIpNetEntry
GetIpNetTable
IcmpCloseHandle

dnsapi

DnsFlushResolverCache

mpr

WNetCancelConnection2W
WNetAddConnection2W

avicap32

capCreateCaptureWindowA
capGetDriverDescriptionA

shell32

ShellExecuteA

odbc32

SQLAllocHandle
SQLExecDirect
SQLFreeHandle
SQLDriverConnect
SQLSetEnvAttr

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f617177e23a3dfce98bba977dc66bd03

Headers

File Characteristics

Imports

kernel32

version

ws2_32

gdi32

wininet

netapi32

user32

advapi32

iphlpapi

dnsapi

mpr

avicap32

shell32

odbc32

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.idata Size: 12KB - Virtual size: 12KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.idata
Size: 12KB - Virtual size: 12KB