09499a59c842a54727d6a5813b1cf590_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

09499a59c842a54727d6a5813b1cf590_JaffaCakes118
Size

838KB
MD5

09499a59c842a54727d6a5813b1cf590
SHA1

b325f21cfd48b3f6f9dbf61f95b45d069999f58c
SHA256

b563bd80f44f9d7bd7c75aab7e5bd2a540f998624346c73335ddd6e19a18495a
SHA512

fd2e5f4ce5839e41c7da197e5b5106ba159b475cd3ee1c080952bc9ad3714ddf5c0690bc9bc05142a45adc431dd55f94b6bf5894a8a6cdebba6d5e1fe8afa019
SSDEEP

24576:q73BWaNzR5JN9T1MDSJegoO0YzsPNdnFxM37:q7RVRn1MjQ0YzEjnFxA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09499a59c842a54727d6a5813b1cf590_JaffaCakes118

Files

09499a59c842a54727d6a5813b1cf590_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f30043289073ad762a89b51269d04979

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

M:\TWRK\98e686ce6075801c\src\MicrogamingInstall\Release\MicrogamingInstall.pdb

Imports

kernel32

MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
WideCharToMultiByte
OutputDebugStringA
CreateProcessW
WaitForSingleObject
OpenProcess
Sleep
CreateProcessA
lstrcmpiA
RemoveDirectoryA
CopyFileA
GetTempFileNameA
GetCurrentProcessId
GetTempPathA
DeleteFileA
GetComputerNameA
FormatMessageA
GetVolumePathNameW
CopyFileW
FormatMessageW
RemoveDirectoryW
GetModuleHandleA
ReleaseMutex
GetDiskFreeSpaceExA
GetVersionExA
DeleteFileW
SetFileAttributesW
SetEvent
GetPrivateProfileStringW
CreateEventA
LoadLibraryA
CreateMutexA
GetDriveTypeA
GetVolumeInformationA
DeviceIoControl
InterlockedDecrement
MoveFileExA
Process32First
TerminateProcess
GetSystemDirectoryA
GetLocalTime
Process32Next
CreateToolhelp32Snapshot
InterlockedIncrement
GetPrivateProfileIntA
InterlockedExchange
GetExitCodeThread
WaitForMultipleObjects
GetCurrentThreadId
CreateThread
CreateSemaphoreA
ReleaseSemaphore
GetLogicalDriveStringsA
GlobalMemoryStatusEx
GetSystemInfo
GetEnvironmentVariableA
SetThreadPriority
GetCurrentThread
lstrcpyA
ResumeThread
InterlockedCompareExchange
QueueUserWorkItem
OpenFileMappingA
lstrcatA
CompareStringW
GetTimeZoneInformation
GetProcessHeap
SetEndOfFile
SetStdHandle
GetStringTypeW
HeapSize
FlushFileBuffers
GetConsoleMode
GetConsoleCP
IsProcessorFeaturePresent
GetCurrentDirectoryW
PeekNamedPipe
GetFileInformationByHandle
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetHandleCount
LCMapStringW
GetCurrentProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapCreate
GetStdHandle
GetFileType
WriteConsoleW
MoveFileA
RaiseException
RtlUnwind
GetFullPathNameA
GetDriveTypeW
SetCurrentDirectoryA
GetCurrentDirectoryA
SetEnvironmentVariableA
FindFirstFileExA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetStartupInfoW
HeapSetInformation
FindNextFileA
GetModuleFileNameA
FindClose
FindFirstFileA
CreateDirectoryA
GetModuleFileNameW
lstrlenW
GetFileAttributesW
lstrcpynW
GetFileAttributesA
lstrcpynA
CreateFileA
lstrlenA
GetFileSize
LocalFree
GetProcAddress
MultiByteToWideChar
CreateFileW
LoadLibraryW
CreateDirectoryW
FreeLibrary
CloseHandle
GetLastError
ReadFile
WriteFile
SetFilePointer
GetThreadTimes
GetCommandLineA
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
ExitThread
GetSystemTimeAsFileTime
ExitProcess
GetModuleHandleW
EncodePointer
DecodePointer
HeapAlloc
HeapFree
SetFileAttributesA

user32

PostMessageA
RegisterClassA
ShowWindow
DefWindowProcA
CreateWindowExA
FlashWindowEx
MoveWindow
DefWindowProcW
SetWindowTextA
LoadCursorA
AdjustWindowRect
EnableWindow
UpdateWindow
MapWindowPoints
LoadImageA
IsWindowVisible
GetSystemMetrics
RegisterClassW
MessageBoxW
MessageBoxA
SetFocus
CopyRect
wsprintfW
InvalidateRect
GetDlgCtrlID
GetActiveWindow
DispatchMessageA
CreateWindowExW
CreatePopupMenu
SetLayeredWindowAttributes
GetCursorPos
SetWindowPos
SetWindowLongW
ReleaseDC
PeekMessageA
AppendMenuW
GetWindowLongW
SetWindowLongA
OffsetRect
ChildWindowFromPoint
TranslateMessage
IsDialogMessageA
SendMessageA
GetClientRect
IsWindowEnabled
LoadIconA
SetForegroundWindow
PostThreadMessageA
wsprintfA
wvsprintfA
SendMessageTimeoutA
DestroyWindow
GetMessageA
GetWindowRect
TrackPopupMenu
GetWindowDC

gdi32

DeleteDC
CreateDIBSection
GetDIBits
DeleteObject
SelectObject
CreateCompatibleDC
GetStockObject
BitBlt

advapi32

RegCreateKeyExA
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyW
OpenSCManagerA
CloseServiceHandle
OpenServiceA
RegSetValueExW
RegQueryValueExW
RegSetValueW
RegSetValueA
RegQueryValueW
RegCloseKey
GetUserNameA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
FreeSid
SetEntriesInAclW

shell32

Shell_NotifyIconA
SHGetSpecialFolderLocation
ShellExecuteA
SHGetPathFromIDListW
SHGetFolderPathW
SHGetMalloc
SHChangeNotify
SHGetSpecialFolderPathA

ole32

OleInitialize
OleCreate
OleSetContainedObject
StringFromIID
OleUninitialize
CoCreateInstance
CoCreateGuid
CoTaskMemAlloc
CoSetProxyBlanket
CoUninitialize
CoInitialize
CoTaskMemFree
CLSIDFromProgID

oleaut32

VariantTimeToSystemTime
VariantCopy
VariantChangeType
SysStringLen
SafeArrayUnaccessData
VariantInit
SafeArrayAccessData
SysAllocString
SysAllocStringLen
SysFreeString
VariantClear
SafeArrayCreateVector

wsock32

gethostbyname
gethostbyaddr
inet_addr
ioctlsocket
WSACleanup
htonl
WSAGetLastError
htons
ntohs
getservbyport
getservbyname
WSASetLastError
WSAStartup

wininet

InternetCreateUrlA
InternetOpenW
InternetOpenUrlW
InternetReadFile
InternetConnectA
InternetGetLastResponseInfoA
InternetCrackUrlW
HttpSendRequestA
HttpQueryInfoA
InternetOpenUrlA
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpOpenRequestA
InternetSetOptionA
InternetCrackUrlA

shlwapi

PathAppendA
SHDeleteKeyA
PathCanonicalizeW
PathAppendW
StrStrA
PathCanonicalizeA

psapi

GetModuleFileNameExA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

ws2_32

WSAAddressToStringA

urlmon

CoInternetGetSession

Exports

Exports

?CreateDefaultBrowserInfo@@YGPAVIDefaultBrowserInfo@@XZ
?CreateDirectXVersionInfo@@YGPAVIDirectXVersionInfo@@XZ
?CreateDisplaysDeviceInfo@@YGPAVIDisplayDevicesInfo@@XZ
?CreateFixedDriveInfo@@YGPAVIFixedDriveInfo@@XZ
?CreateFixedDrivesInfo@@YGPAVIFixedDrivesInfo@@XZ
?CreateFlashInfo@@YGPAVIFlashInfo@@XZ
?CreateIEVersionInfo@@YGPAVIIEVersionInfo@@XZ
?CreateMacAddress@@YGPAVIMacAddress@@XZ
?CreateMachineInfo@@YGPAVIMachineInfo@@XZ
?CreateMachineInfoXML@@YGPAVIMachineInfoXML@@XZ
?CreateOSInfo@@YGPAVIOSInfo@@XZ
?CreateProcessorsInfo@@YGPAVIProcessorsInfo@@XZ
?CreateRamInfo@@YGPAVIRamInfo@@XZ
?CreateSoundDevicesInfo@@YGPAVISoundDevicesInfo@@XZ
?CreateUserExperience@@YGPAVIUserExperience@@XZ
?CreateVMInfo@@YGPAVIVMInfo@@XZ

Sections

.text
Size: 413KB - Virtual size: 412KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f30043289073ad762a89b51269d04979

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wsock32

wininet

shlwapi

psapi

version

ws2_32

urlmon

Exports

Exports

Sections

.text Size: 413KB - Virtual size: 412KB

.rdata Size: 62KB - Virtual size: 61KB

.data Size: 72KB - Virtual size: 91KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 413KB - Virtual size: 412KB

.rdata
Size: 62KB - Virtual size: 61KB

.data
Size: 72KB - Virtual size: 91KB

.rsrc
Size: 4KB - Virtual size: 3KB