071e768179aa5abfcad18db0321a21a1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

071e768179aa5abfcad18db0321a21a1_JaffaCakes118
Size

744KB
MD5

071e768179aa5abfcad18db0321a21a1
SHA1

c1423c556836b5b753330575aa6ee4f15e6da14e
SHA256

df05ad71d8cf749fbd52c8cd7849c524337a36986ad29b35afb8f8cc1da95f4c
SHA512

f6804f0c6b9b63e7d1a6da127f5119e7f61288a3108eb80e0a033817748a566c3aff3d6942bd82c935fb81cf32cbcd573cd8556ffe99d2dee20584e4e5b7ab18
SSDEEP

12288:zhmzSUIUszvO3P+FkvyA++OPMxPnpltvp1xx4tMvTlUKLKWl5oj6:1mG/bvO3P+y1uPMdplP1b4tWupq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
071e768179aa5abfcad18db0321a21a1_JaffaCakes118

Files

071e768179aa5abfcad18db0321a21a1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

78960c6d9e1e15cd9173f4f7cfac8914

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Code\Autorun\Release\Autorun.pdb

Imports

kernel32

ExitProcess
RtlUnwind
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetCommandLineA
TerminateProcess
HeapReAlloc
SetStdHandle
GetFileType
ExitThread
CreateThread
HeapSize
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetTimeZoneInformation
GetDriveTypeA
IsBadReadPtr
IsBadCodePtr
SetEnvironmentVariableA
GetTickCount
SetErrorMode
GetFileTime
GetFileAttributesA
CreateFileA
GetFullPathNameA
GetVolumeInformationA
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetOEMCP
GetCPInfo
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
EnterCriticalSection
GlobalHandle
GlobalReAlloc
LeaveCriticalSection
LocalAlloc
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GlobalFlags
GetCurrentDirectoryA
WritePrivateProfileStringA
InterlockedIncrement
CreateEventA
SuspendThread
SetEvent
ResumeThread
SetThreadPriority
InterlockedDecrement
GlobalFree
MulDiv
GlobalUnlock
FindFirstFileA
SetLastError
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileA
FindClose
FreeResource
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
lstrcatA
lstrcmpW
lstrcpynA
GetCurrentThread
GetCurrentThreadId
GlobalLock
GlobalAlloc
FreeLibrary
GlobalDeleteAtom
lstrcmpA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
ConvertDefaultLocale
EnumResourceLanguagesA
lstrcpyA
LoadLibraryA
CompareStringW
CompareStringA
lstrlenA
lstrcmpiA
GetVersion
MultiByteToWideChar
GetWindowsDirectoryA
CreateDirectoryA
GetPrivateProfileStringA
Sleep
GetStartupInfoA
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
CloseHandle
GetLastError
WideCharToMultiByte
FormatMessageA
LocalFree
FindResourceA
LoadResource
LockResource
SizeofResource
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange

user32

RegisterClipboardFormatA
PostThreadMessageA
InvalidateRect
CopyAcceleratorTableA
SetRect
IsRectEmpty
GetSysColorBrush
ReleaseCapture
LoadCursorA
SetCapture
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
wsprintfA
DestroyMenu
CharNextA
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
SetWindowContextHelpId
MapDialogRect
SetMenuItemBitmaps
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
GetMessageA
TranslateMessage
GetCursorPos
ValidateRect
SetCursor
GetDesktopWindow
GetActiveWindow
IsWindowEnabled
GetNextDlgTabItem
EndDialog
GetMenuState
WinHelpA
GetCapture
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SendDlgItemMessageA
GetFocus
IsWindow
SetFocus
IsChild
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageA
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
GetKeyState
SetForegroundWindow
IsWindowVisible
UpdateWindow
GetMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
GetSysColor
AdjustWindowRectEx
GetParent
EqualRect
RegisterClassA
UnregisterClassA
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetWindowLongA
SetWindowLongA
SetWindowPos
OffsetRect
MessageBeep
GetNextDlgGroupItem
CreateDialogIndirectParamA
InvalidateRgn
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
CopyRect
PtInRect
GetWindow
PostQuitMessage
CharUpperA
PostMessageA
GetSystemMetrics
LoadIconA
EnableWindow
GetClientRect
IsIconic
GetSystemMenu
SendMessageA
AppendMenuA
DrawIcon
GetClassInfoA
MessageBoxA
RegisterWindowMessageA

gdi32

GetViewportExtEx
CreateRectRgnIndirect
GetRgnBox
GetMapMode
DeleteObject
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutA
RectVisible
PtVisible
GetClipBox
SetMapMode
RestoreDC
SaveDC
ExtTextOutA
GetTextColor
GetBkColor
GetStockObject
CreateBitmap
GetDeviceCaps
GetObjectA
SetBkColor
SetTextColor
GetWindowExtEx

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegCloseKey
RegEnumKeyA
RegOpenKeyExA
RegOpenKeyA
RegDeleteKeyA
RegQueryValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA

comctl32

ord17

shlwapi

PathFindFileNameA
PathStripToRootA
PathFindExtensionA
PathIsUNCA

oledlg

ord8

ole32

CLSIDFromString
CLSIDFromProgID
CoTaskMemAlloc
CoGetClassObject
CoTaskMemFree
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize

oleaut32

VariantInit
SysAllocString
SystemTimeToVariantTime
SafeArrayDestroy
VariantCopy
OleCreateFontIndirect
SysAllocStringByteLen
SysStringLen
SysFreeString
SysAllocStringLen
VariantChangeType
VariantClear

Sections

.text
Size: 176KB - Virtual size: 175KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 252KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

78960c6d9e1e15cd9173f4f7cfac8914

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

comctl32

shlwapi

oledlg

ole32

oleaut32

Sections

.text Size: 176KB - Virtual size: 175KB

.rdata Size: 48KB - Virtual size: 46KB

.data Size: 8KB - Virtual size: 22KB

.rsrc Size: 184KB - Virtual size: 184KB

.text Size: 252KB - Virtual size: 252KB

.text
Size: 176KB - Virtual size: 175KB

.rdata
Size: 48KB - Virtual size: 46KB

.data
Size: 8KB - Virtual size: 22KB

.rsrc
Size: 184KB - Virtual size: 184KB

.text
Size: 252KB - Virtual size: 252KB