0e289b31783231a4e28bfd055734b424_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0e289b31783231a4e28bfd055734b424_JaffaCakes118
Size

84KB
MD5

0e289b31783231a4e28bfd055734b424
SHA1

25c5391767ecccef827867049cfe156de945b7d5
SHA256

e65b40cd3b4cab0da8804516fc997833745fd60a10a741c3a09f170b67558a18
SHA512

2cd8f192dc5353094ea1ab90bdd5581edb4dcaf52ce168f78bcd3427f22a5fa1102fe4f644d88150016140f36f91a380357d39b05b80feb2899e7a5085c27276
SSDEEP

1536:1Wn1xJQfR3K3XGCGMaAaY38PvHpjikIJUa764QKWwcICS4Ar/ZW2h5Y:1Wn1HwNK3PGMaAJRk4UyrQye2h5Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e289b31783231a4e28bfd055734b424_JaffaCakes118

Files

0e289b31783231a4e28bfd055734b424_JaffaCakes118
.exe windows:5 windows x86 arch:x86

bb5dc4a505a6514c48539e0aa3720353

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

??1type_info@@UAE@XZ
strtoul
strncpy
_CIpow
strchr
calloc
free
sprintf
wcstok
atol
strtok
atoi
_wtoi
mbstowcs
_itow
ceil
_wcsupr
_wcslwr
exit
toupper
srand
rand
swprintf

kernel32

lstrlenA
PeekNamedPipe
CreateProcessW
WriteFile
TerminateThread
Sleep
GetExitCodeProcess
TerminateProcess
ReadFile
GetStartupInfoW
DisconnectNamedPipe
CreatePipe
CloseHandle
GetThreadContext
GetFileSize
CreateMutexW
SetThreadContext
WaitForSingleObject
GetModuleHandleW
OpenProcess
GetModuleFileNameW
CreateFileW
GetTempPathW
GetLastError
GetProcAddress
VirtualAllocEx
ReleaseMutex
WriteProcessMemory
ResumeThread
lstrcmpW
lstrcmpA
FindFirstFileW
SetFilePointer
GetDriveTypeW
GetEnvironmentVariableW
GetLogicalDriveStringsW
CreateDirectoryW
lstrlenW
GetFileSizeEx
MoveFileW
FindClose
FindNextFileW
GetDiskFreeSpaceExW
DeleteFileW
ExitProcess
SetPriorityClass
MoveFileExW
GetCurrentProcess
GetCurrentThread
SetProcessPriorityBoost
CopyFileW
SetThreadPriority
GetShortPathNameW
GetDateFormatW
GetTimeFormatW
GetLocalTime
GetCurrentThreadId
CreateThread
GlobalMemoryStatus
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetErrorMode
SetUnhandledExceptionFilter
SetEvent
GlobalAlloc
ResetEvent
CreateEventW
FreeLibrary
LoadLibraryW
GetVersion
GetSystemDirectoryA
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetStdHandle
CreateEventA
GetVolumeInformationW
lstrcpyW
GetSystemTime
lstrcatW
GetLocaleInfoW
GetSystemDirectoryW
GetTickCount
GetComputerNameW
SetFilePointerEx

user32

ExitWindowsEx
GetLastInputInfo
EnumDesktopWindows
PostMessageW
GetClientRect
ShowWindow
IsWindow
SendMessageW
GetWindowThreadProcessId
mouse_event
GetMessageW
GetKeyState
SetCursorPos
TranslateMessage
GetAsyncKeyState
GetKeyNameTextW
PostThreadMessageW
SetWindowsHookExW
UnhookWindowsHookEx
GetDesktopWindow
MapVirtualKeyW
GetWindowDC
GetWindowRect
wvsprintfA
GetSystemMetrics
GetWindowTextW
GetForegroundWindow
PeekMessageW
CharNextW
DispatchMessageW
GetKeyboardState
wsprintfW
GetDCEx
IsWindowVisible
keybd_event
VkKeyScanW
SendInput
CallNextHookEx
SetKeyboardState

gdi32

SetBitmapBits
CreateCompatibleBitmap
DeleteDC
CreateDIBSection
StretchBlt
DeleteObject
SelectObject
CreateCompatibleDC
SetStretchBltMode

advapi32

ControlService
StartServiceW
ChangeServiceConfigW
RegEnumKeyExW
RegQueryInfoKeyW
EnumServicesStatusExW
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
GetUserNameW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyW
RegCloseKey
RegSetValueExW
RegDeleteValueW
RegOpenKeyExW
CloseServiceHandle
DeleteService
QueryServiceConfig2W

shell32

ord680
ShellExecuteExW
SHChangeNotify
SHFileOperationW
ShellExecuteW

ole32

CoInitialize
CoTaskMemFree
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoUninitialize
CreateStreamOnHGlobal

oleaut32

VariantClear
VariantInit

wininet

DeleteUrlCacheEntryW

urlmon

URLDownloadToFileW

setupapi

SetupDiRemoveDevice
SetupDiSetClassInstallParamsW
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdW
SetupDiChangeState
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW

gdiplus

GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdiplusShutdown

ws2_32

send
gethostbyname
gethostbyaddr
closesocket
WSASetLastError
getservbyname
socket
recv
WSACleanup
getservbyport
setsockopt
ntohs
htons
WSAGetLastError
htonl
inet_addr
WSAStartup
inet_ntoa
connect
gethostname
WSAIoctl

winmm

waveInClose
waveInPrepareHeader
waveInOpen
waveInAddBuffer
waveInUnprepareHeader
waveInStart

Sections

.text
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bb5dc4a505a6514c48539e0aa3720353

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wininet

urlmon

setupapi

gdiplus

ws2_32

winmm

Sections

.text Size: 58KB - Virtual size: 58KB

.rdata Size: 21KB - Virtual size: 21KB

.data Size: 3KB - Virtual size: 203KB

.text
Size: 58KB - Virtual size: 58KB

.rdata
Size: 21KB - Virtual size: 21KB

.data
Size: 3KB - Virtual size: 203KB