066b79249eb63e79e35d5dad14d3ba38_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

066b79249eb63e79e35d5dad14d3ba38_JaffaCakes118
Size

239KB
MD5

066b79249eb63e79e35d5dad14d3ba38
SHA1

317c0eaef3c36d48d1caf92fc089063de780eed8
SHA256

d712e5109932e5869a101cdd3512d1f6d636da23c54aef21d492900704024ddf
SHA512

b57c8774610e0e6a56e27af1876bf2b49f0e86b68b309809cdb94defc9698256abc616fb884acfffdf7fb03715b767c0c3cbf8579920c377c8aaeef07b7c951c
SSDEEP

6144:z70fXEOhOiHD01RI/TP3phKnC/bG5rYLTRVA+rmRfhfd3sNNw:z73O7D012lhKyC50LN+3TaNw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
066b79249eb63e79e35d5dad14d3ba38_JaffaCakes118

Files

066b79249eb63e79e35d5dad14d3ba38_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e15d31a1382873b0bf89fdea15f598c9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_XcptFilter
malloc
_ultow
_setjmp3
longjmp
_wtoi
_wtol
_vsnprintf
_vsnwprintf
memcpy
memmove
free
_amsg_exit
_initterm
bsearch
_wcsicmp
wcsncmp
_wcsnicmp
memset

user32

SendMessageW
SetWindowPos
SendDlgItemMessageW
LoadStringW
CharNextW
ReleaseDC
GetDC
GetWindowRect
CharPrevW
CharUpperW
GetSystemMetrics
MessageBoxW
MessageBeep
DispatchMessageW
MsgWaitForMultipleObjects
PeekMessageW
ExitWindowsEx
EndDialog
EnableWindow
GetDlgItem
SetWindowTextW
GetDesktopWindow
GetDlgItemTextW
SetDlgItemTextW
DialogBoxParamW
OemToCharA
IsWindow
ShowWindow
DestroyWindow
UpdateWindow
CreateDialogParamW
CharNextA

gdi32

CreateFontIndirectW
GetObjectW
GetStockObject
GetDeviceCaps
DeleteObject

kernel32

GetDiskFreeSpaceW
MulDiv
EnumResourceLanguagesW
MultiByteToWideChar
WideCharToMultiByte
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedCompareExchange
InterlockedExchange
SetFileTime
GetFileTime
ReadFile
WritePrivateProfileSectionW
GetProfileStringW
lstrcmpiA
GetProcessHeap
HeapAlloc
GetLocalTime
HeapFree
GetFullPathNameW
GetSystemInfo
SearchPathW
GetPrivateProfileIntW
FindFirstFileW
FindNextFileW
FindClose
lstrcmpiW
GetCurrentProcess
GetSystemDirectoryW
MoveFileW
MoveFileExW
CopyFileW
GetPrivateProfileSectionW
CreateProcessW
CreateDirectoryW
SetFileAttributesW
GetVolumeInformationW
CompareStringW
ExpandEnvironmentStringsW
GetShortPathNameW
FormatMessageW
RemoveDirectoryW
CreateFileMappingW
GetUserDefaultUILanguage
SetLastError
UnmapViewOfFile
LoadLibraryExW
FindResourceExW
MapViewOfFile
GetLocaleInfoW
GetSystemDefaultUILanguage
Sleep
MapViewOfFileEx
GetLastError
lstrlenW
GetDriveTypeW
LocalFree
GetEnvironmentVariableW
CloseHandle
WriteFile
CreateFileW
WritePrivateProfileStringW
LockResource
LoadResource
SizeofResource
FindResourceW
GetTempFileNameW
GetWindowsDirectoryW
GetTempPathW
LocalAlloc
lstrlenA
SetFilePointer
GetModuleFileNameW
DeleteFileW
LocalReAlloc
GetVersionExW
DisableThreadLibraryCalls
lstrcmpW
GetPrivateProfileStringW
FreeLibrary
GetFileAttributesW
GetProcAddress
GetFileSize
LoadLibraryW

advapi32

RegFlushKey
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegOpenKeyExA
RegQueryValueExA
RegEnumKeyW
RegUnLoadKeyW
RegLoadKeyW
RegSaveKeyW
RegCloseKey
RegDeleteKeyW
EqualSid
GetTokenInformation
RegDeleteValueW
AllocateAndInitializeSid
FreeSid
RegEnumValueW
RegSetValueW
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges

ole32

OleInitialize
OleUninitialize
CoTaskMemFree

version

GetFileVersionInfoSizeW
GetFileVersionInfoA
VerQueryValueW

setupapi

SetupCloseInfFile
SetupDefaultQueueCallbackW
SetupOpenAppendInfFileW
SetupOpenInfFileW
SetupSetDirectoryIdW
SetupGetLineTextW
SetupFindNextLine
SetupFindFirstLineW
SetupGetStringFieldW
SetupCloseFileQueue
SetupTermDefaultQueueCallback
SetupCommitFileQueueW
SetupInitDefaultQueueCallbackEx
SetupQueueCopyW
SetupOpenFileQueue
SetupInstallFromInfSectionW

shlwapi

StrStrIW
StrChrW
PathAddBackslashW
ord215
ord217
StrRChrW
PathFileExistsW
PathAppendW
PathRemoveFileSpecW
PathBuildRootW
PathCombineW

Sections

.text
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ffff
Size: 101KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.yyup
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.jyup
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gyup
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gyep
Size: 512B - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e15d31a1382873b0bf89fdea15f598c9

Headers

File Characteristics

Imports

msvcrt

user32

gdi32

kernel32

advapi32

ole32

version

setupapi

shlwapi

Sections

.text Size: 8KB - Virtual size: 12KB

.rdata Size: 108KB - Virtual size: 108KB

.data Size: 2KB - Virtual size: 4KB

.ffff Size: 101KB - Virtual size: 104KB

.yyup Size: 512B - Virtual size: 4KB

.jyup Size: 512B - Virtual size: 4KB

.gyup Size: 512B - Virtual size: 4KB

.gyep Size: 512B - Virtual size: 288KB

.rsrc Size: 16KB - Virtual size: 16KB

.text
Size: 8KB - Virtual size: 12KB

.rdata
Size: 108KB - Virtual size: 108KB

.data
Size: 2KB - Virtual size: 4KB

.ffff
Size: 101KB - Virtual size: 104KB

.yyup
Size: 512B - Virtual size: 4KB

.jyup
Size: 512B - Virtual size: 4KB

.gyup
Size: 512B - Virtual size: 4KB

.gyep
Size: 512B - Virtual size: 288KB

.rsrc
Size: 16KB - Virtual size: 16KB