06af3457e70e544fd168f5b4d4ab84d0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

06af3457e70e544fd168f5b4d4ab84d0_JaffaCakes118
Size

164KB
MD5

06af3457e70e544fd168f5b4d4ab84d0
SHA1

10c835fe73019d55b3b37e914f2bd3846e24a186
SHA256

1bd72e9ae628d18579e99bb0221350158264732c931529ba261552dae5219d9f
SHA512

e745195fca6f9ac4fa34f702cb021a5061d9189e8ef3849ce77f3499a2a8e3e7f4ec267c359d07a90b5a4ce46012b9be5b7e15c2a7bff2ff9ddc6f9868d79ddf
SSDEEP

3072:onsmfHTQbmKUMSHDy+vies1P7wMigwSvmoZYoTm1926nUE:Qs+TwFNSHm+v47qqxCrP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06af3457e70e544fd168f5b4d4ab84d0_JaffaCakes118

Files

06af3457e70e544fd168f5b4d4ab84d0_JaffaCakes118
.exe windows:5 windows x86 arch:x86

76e448eddc704c27b1057fad18a6f3d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetACP
CreateFileMappingW
FreeLibrary
GetCurrentThreadId
HeapFree
VirtualQueryEx
FatalAppExitA
WideCharToMultiByte
GetFileSizeEx
DeleteCriticalSection
CompareStringW
GlobalMemoryStatus
GetSystemTimeAsFileTime
IsDebuggerPresent
WriteConsoleA
SizeofResource
HeapReAlloc
LoadLibraryExW
LocalFree
Module32NextW
GetTimeFormatA
GetTimeZoneInformation
FindFirstFileW
GetTempFileNameW
ExitThread
OpenThread
CompareStringA
InterlockedIncrement
GetConsoleMode
SetConsoleCtrlHandler
SystemTimeToFileTime
FindResourceW
LCMapStringW
Process32FirstW
TlsSetValue
InitializeCriticalSectionAndSpinCount
GetFileSize
SetEnvironmentVariableA
VirtualProtect
GetCommandLineW
ExitProcess
GetCPInfo
WaitForSingleObject
FreeEnvironmentStringsW
HeapAlloc
LCMapStringA
Process32NextW
CreateProcessW
IsValidLocale
TlsFree
IsProcessorFeaturePresent
GetConsoleCP
GetModuleFileNameW
ReadProcessMemory
ExpandEnvironmentStringsW
ReadFile
GetStartupInfoW
CreateEventW
lstrlenW
GetModuleHandleA
WriteFile
lstrcmpiW
GetProcessHeap
GetTempPathW
OpenFileMappingW
GetVolumeInformationW
GetCurrentProcess
LoadResource
FlushFileBuffers
TlsGetValue
InitializeCriticalSection
LockResource
OpenProcess
VirtualFree
GetPrivateProfileSectionW
LeaveCriticalSection
UnmapViewOfFile
WriteConsoleW
FindResourceExW
SetFilePointer
InterlockedCompareExchange
CreateFileW
GetLocaleInfoA
GetModuleHandleW
lstrlenA
LoadLibraryA
GetOEMCP
GetStringTypeW
EnterCriticalSection
TlsAlloc
ProcessIdToSessionId
SetUnhandledExceptionFilter
GetDriveTypeW
VirtualAlloc
GetLocaleInfoW
CreateDirectoryW
GetModuleFileNameA
QueryPerformanceCounter
CreateMutexW
GetEnvironmentVariableW
GlobalAddAtomA
GlobalFindAtomA
VirtualProtectEx
OutputDebugStringA
GetVersion
AreFileApisANSI
GetLogicalDrives
GetCurrentThread
SetStdHandle
HeapSize
GetStartupInfoA
RaiseException
GetProcAddress
GetEnvironmentStringsW
GetConsoleOutputCP
GetPrivateProfileStringW
GetLastError
InterlockedExchange
MapViewOfFile
InterlockedDecrement
HeapCreate
TerminateProcess
GetStringTypeA
GetUserDefaultLCID
DeviceIoControl
GetPrivateProfileIntW
RtlUnwind
MoveFileExW
LoadLibraryW
GetDateFormatA
WritePrivateProfileStringW
GetStdHandle
GetTickCount
GetFileAttributesW
HeapDestroy
IsValidCodePage
SetEndOfFile
Module32FirstW
SetLastError
FlushInstructionCache
Sleep
CreateFileA
GetPrivateProfileSectionNamesW
GetCurrentProcessId
SetHandleCount
CloseHandle
GetVersionExW
DeleteFileW
EnumSystemLocalesA
CreateThread
FindNextFileW
CreateToolhelp32Snapshot
MultiByteToWideChar
UnhandledExceptionFilter
GetDiskFreeSpaceExW
GetLocalTime
GetFileType
RemoveDirectoryW
SetEvent

user32

GetTopWindow
SetForegroundWindow
LoadIconA
IsWindowEnabled
wsprintfW
GetForegroundWindow
IsWindowUnicode
CharUpperW
GetDesktopWindow
IsWindowVisible
EnableWindow
GetFocus
DispatchMessageW
DestroyCursor
SendMessageW
LoadCursorW
RegisterClassExW
UnregisterClassA
TrackMouseEvent
ReleaseDC
GetMessageW
InvalidateRect
KillTimer
CreatePopupMenu
LoadStringW
GetClassInfoExW
PeekMessageW
SetFocus
MonitorFromWindow
ScreenToClient
PostQuitMessage
DrawTextW
CharNextW
ShowWindow
DestroyWindow
TranslateMessage
GetWindowThreadProcessId
EnumWindows
MonitorFromPoint
RemoveMenu
GetMenuItemInfoW
GetWindowTextW
DestroyMenu
UpdateLayeredWindow
GetClassNameW
SetWindowLongW
CallWindowProcW
GetWindow
PostMessageW
SetTimer
GetWindowLongW
TranslateAcceleratorW
CreateWindowExW
TrackPopupMenuEx
PtInRect
SetWindowTextW
AppendMenuW
SetWindowPos
DefWindowProcW
GetCursorPos
SetCursor
LoadImageW
LoadMenuW
IsWindow
EnumChildWindows
LoadStringA
MapWindowPoints
GetWindowDC
GetParent
GetMenuItemCount
MessageBeep
GetWindowRect
GetMonitorInfoW
LoadAcceleratorsW
GetClientRect

gdi32

AbortPath
AddFontMemResourceEx
SetTextColor
SetBitmapBits
GetBitmapBits
CreateCompatibleBitmap
RestoreDC
CreateDIBSection
CreateCompatibleDC
DeleteObject
DeleteDC
SelectObject
CreateFontW
SetBkMode
SaveDC

advapi32

QueryServiceStatus
RegSetValueExW
RegDeleteKeyW
RegCreateKeyExW
RegDeleteValueW
DeleteService
RegQueryValueExW
RegOpenKeyExW
AdjustTokenPrivileges
SetEntriesInAclW
FreeSid
RegOpenKeyA
SetNamedSecurityInfoW
ControlService
SetTokenInformation
RegCloseKey
StartServiceW
CloseServiceHandle
RegQueryInfoKeyW
OpenProcessToken
AllocateAndInitializeSid
RevertToSelf
OpenSCManagerW
CreateProcessAsUserW
CreateServiceW
LookupPrivilegeValueW
GetNamedSecurityInfoW
OpenServiceW
DuplicateTokenEx
RegEnumValueW
RegEnumKeyExW

shell32

SHFileOperationW
SHGetSpecialFolderPathW

ole32

CoCreateGuid
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize
CoTaskMemRealloc
CoSetProxyBlanket
CoInitializeSecurity
CoInitialize

oleaut32

SysAllocString
SysStringLen
SetErrorInfo
VariantClear
SysAllocStringByteLen
VarUI4FromStr
SysFreeString
VariantChangeType
GetErrorInfo
VariantInit
CreateErrorInfo

winhttp

WinHttpOpen
WinHttpSendRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpReadData
WinHttpReceiveResponse
WinHttpConnect
WinHttpQueryHeaders

comctl32

InitCommonControlsEx

shlwapi

StrStrIW
PathIsDirectoryW
PathRemoveExtensionW
PathFindExtensionW
PathAppendW
PathGetDriveNumberW
SHDeleteKeyW
PathFileExistsW
PathStripPathW
PathFindFileNameW
PathRemoveFileSpecW

msimg32

GradientFill
AlphaBlend

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

iphlpapi

GetIpForwardTable

oledlg

ord8
OleUIBusyW

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW

psapi

QueryWorkingSet
GetProcessMemoryInfo
GetModuleInformation
GetModuleFileNameExW

msvcrt

__set_app_type
_except_handler3
_CIsin

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

Sections

.text
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

76e448eddc704c27b1057fad18a6f3d1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

winhttp

comctl32

shlwapi

msimg32

version

iphlpapi

oledlg

wtsapi32

psapi

msvcrt

userenv

Sections

.text Size: 61KB - Virtual size: 60KB

.rdata Size: 24KB - Virtual size: 24KB

.data Size: 31KB - Virtual size: 35KB

.rsrc Size: 36KB - Virtual size: 35KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 61KB - Virtual size: 60KB

.rdata
Size: 24KB - Virtual size: 24KB

.data
Size: 31KB - Virtual size: 35KB

.rsrc
Size: 36KB - Virtual size: 35KB

.reloc
Size: 10KB - Virtual size: 9KB