0b16a4224b949dd872b445a0d96a9088_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0b16a4224b949dd872b445a0d96a9088_JaffaCakes118
Size

684KB
MD5

0b16a4224b949dd872b445a0d96a9088
SHA1

5d271df736950d911f6ee106cde9ba6e943526e3
SHA256

75fde2f11c05b253a9269fcdfa7aa9d356b5ca1022257fb0df9954c4355d81fc
SHA512

ed7078c150a546ad37d1aacc9e685ccd15084fdbfd343e96b92d0c94693273d6cbaa54ce3e46f7556b37e81cf843843903708ab236b6a49771778c8f586c72e6
SSDEEP

12288:4sQoq+3Qx4R2/jNwuzlYEmHjFXDGHSt8lQf2BbGh3uVUOKB6NlVAtxphJ:4ZIQORqpqDt8/GmUODlAHphJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b16a4224b949dd872b445a0d96a9088_JaffaCakes118

Files

0b16a4224b949dd872b445a0d96a9088_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cf8c8f865e4e574df5122baeb563702e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

CreateSolidBrush
DeleteDC
CreateCompatibleDC
BitBlt
DeleteObject
SelectObject
GetDeviceCaps
CreateCompatibleBitmap
GetStockObject
GetObjectW

msvcrt

_initterm
memset
_amsg_exit
_wtoi64
iswdigit
_controlfp
fabs
_wcmdln
exit
__set_app_type
__wgetmainargs
__p__commode
_exit
?terminate@@YAXXZ
__setusermatherr
_cexit
_initterm
__p__fmode
memcpy
_XcptFilter

gdiplus

GdipCreateBitmapFromFile
GdipCreateHBITMAPFromBitmap
GdiplusShutdown
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdiplusStartup
GdipFree
GdipCreateBitmapFromFileICM

shell32

CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW
FindExecutableW
SHAppBarMessage
Shell_NotifyIconW
ShellExecuteExW

ddraw

DirectDrawCreate
DirectDrawCreateEx

ole32

OleUninitialize
OleInitialize
CoUninitialize
OleLockRunning
StringFromGUID2
CoTaskMemFree
CoAllowSetForegroundWindow
StringFromCLSID
CreateStreamOnHGlobal
CLSIDFromProgID
CoSetProxyBlanket
CoTaskMemAlloc
CoInitializeSecurity
CoCreateInstance
CoInitializeEx
CLSIDFromString
CoGetClassObject
CoCreateGuid

wtsapi32

WTSEnumerateSessionsW
WTSQuerySessionInformationW
WTSUnRegisterSessionNotification
WTSFreeMemory
WTSRegisterSessionNotification

crypt32

CryptUnprotectData
CryptProtectData

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

secur32

GetUserNameExW

shlwapi

UrlGetPartW
UrlCombineW
UrlApplySchemeW
UrlCanonicalizeW
PathCombineW
PathAppendW

kernel32

LoadResource
CreateFileW
CloseHandle
GetLocaleInfoA
ResetEvent
WaitForSingleObject
InterlockedIncrement
FormatMessageW
SetLastError
WideCharToMultiByte
GetCurrentProcess
GetComputerNameW
WaitForMultipleObjects
GetACP
VirtualFree
GlobalUnlock
GetCurrentThreadId
IsProcessorFeaturePresent
GlobalAlloc
MultiByteToWideChar
CreateMutexW
lstrlenW
GetTickCount
ReleaseMutex
MulDiv
SizeofResource
HeapReAlloc
HeapSize
GetSystemTimeAsFileTime
LocalAlloc
GetVersionExA
HeapAlloc
LeaveCriticalSection
QueryPerformanceCounter
VirtualUnlock
GlobalHandle
VirtualLock
GetLocaleInfoW
InterlockedCompareExchange
GetTempPathW
FreeLibrary
DeleteCriticalSection
GetModuleFileNameW
GetVersionExW
InterlockedDecrement
UnhandledExceptionFilter
HeapFree
lstrcmpW
GlobalFree
GetSystemInfo
lstrlenA
GlobalLock
FindResourceExW
RaiseException
SetUnhandledExceptionFilter
FindResourceW
ProcessIdToSessionId
LCMapStringW
TerminateProcess
CreateThread
Sleep
GetThreadLocale
GetLastError
InterlockedExchange
LocalFree
VirtualAlloc
LoadLibraryW
IsDebuggerPresent
HeapSetInformation
InitializeCriticalSection
SetEvent
GetProcessId
LoadLibraryA
CreateEventW
GetProcAddress
GetStartupInfoW
HeapDestroy
GetSystemDirectoryW
FlushInstructionCache
EnterCriticalSection
LockResource
LoadLibraryExW
OpenProcess
GetModuleHandleW

Sections

.text
Size: 373KB - Virtual size: 372KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 290KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cf8c8f865e4e574df5122baeb563702e

Headers

File Characteristics

Imports

gdi32

msvcrt

gdiplus

shell32

ddraw

ole32

wtsapi32

crypt32

version

secur32

shlwapi

kernel32

Sections

.text Size: 373KB - Virtual size: 372KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 290KB - Virtual size: 289KB

.rsrc Size: 15KB - Virtual size: 15KB

.text
Size: 373KB - Virtual size: 372KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 290KB - Virtual size: 289KB

.rsrc
Size: 15KB - Virtual size: 15KB