0fbe84a1c168d89b15e39ef365ad5bf2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0fbe84a1c168d89b15e39ef365ad5bf2_JaffaCakes118
Size

343KB
MD5

0fbe84a1c168d89b15e39ef365ad5bf2
SHA1

8c9b5f021fceb64a4991ba1611a8c093c13d34f9
SHA256

01c1c8ffd9d0529e130d0ec122169059c35ea3d6f12473eca89ef7be077c5964
SHA512

51ff60518d63d29a351e7aa3e5fd008f46ad940a9f143fccb6794581f6c9d401a3eb67e57f294890f23f98927cc220cc1668d1208eb2fe85af998556520f7b98
SSDEEP

6144:EiWgw8XcXpk24eT0R0CYekj4thmkg7JYrK1MsPkCxyNntXTMJ0Ciy9LdOkhD:EzgXMpkazikj4th1gHpXEtXTg0/ELdn9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0fbe84a1c168d89b15e39ef365ad5bf2_JaffaCakes118

Files

0fbe84a1c168d89b15e39ef365ad5bf2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b5f5d8b10ff4d975b6d27d43174c6727

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetDlgItemInt
EnumDisplaySettingsW
GetSystemMetrics
VkKeyScanExA
IsChild
GetMenu
IsMenu
CopyAcceleratorTableW
SetCursor
UnpackDDElParam
IsCharAlphaNumericW
GetMenuItemInfoA
GetTopWindow
CharPrevA
ReleaseCapture
DrawTextExW
LoadCursorW
LoadStringW
UpdateWindow
GetMenuContextHelpId
ToUnicode
LoadIconW
GetWindowRgn
MapVirtualKeyExA
DdeInitializeA
SetCursorPos
SetMenuContextHelpId
CopyIcon
DlgDirListComboBoxW
EnumDisplayDevicesW
GetMenuItemCount
GetWindowPlacement
CharNextA
SetWindowLongA
FrameRect
GetGUIThreadInfo
EnumDesktopsA
IsWindowEnabled
KillTimer
CreateIconFromResource
MessageBoxExW
ArrangeIconicWindows
SetDlgItemTextA
PostThreadMessageW
LoadImageA
CharToOemBuffA
FindWindowA
WaitMessage
CascadeChildWindows
EnumDisplaySettingsA
EnumDesktopWindows
CreateIconIndirect
GetKeyNameTextW
GetMessageA
LoadMenuIndirectA
GetMenuInfo
DdeEnableCallback
ShowOwnedPopups
DispatchMessageA
MapDialogRect
GetMenuDefaultItem
SendMessageCallbackA

shlwapi

ColorAdjustLuma
SHEnumKeyExA
PathIsUNCServerShareW
SHAutoComplete
StrCmpNIA
SHOpenRegStream2A
PathSkipRootA
StrCSpnW
PathParseIconLocationW
SHEnumValueW
SHRegEnumUSKeyW
UrlIsW
PathIsUNCServerShareA
StrToIntA
StrCSpnA
StrRChrIW
PathRemoveFileSpecW
PathCombineW
StrRChrIA
SHQueryInfoKeyA
PathIsLFNFileSpecW
PathIsURLW
StrRStrIA
SHRegGetBoolUSValueW
StrChrA
SHIsLowMemoryMachine
StrNCatW
SHSetThreadRef
StrRetToBufA
SHDeleteValueW
PathIsURLA
AssocQueryKeyA
ColorHLSToRGB
SHDeleteKeyA
PathIsUNCA
StrRetToStrW
SHCreateShellPalette
PathIsDirectoryEmptyW
PathGetDriveNumberA
StrCmpW
SHRegQueryInfoUSKeyW
PathIsDirectoryA
PathQuoteSpacesW
SHRegDeleteEmptyUSKeyA
wnsprintfW
PathIsNetworkPathA
PathAddBackslashW
PathFindSuffixArrayW
PathIsSameRootA
StrChrIW
StrChrW
PathIsContentTypeA
SHRegDeleteUSValueW
PathUndecorateA
SHRegGetUSValueW
SHRegEnumUSValueA
SHRegQueryUSValueA
PathSkipRootW
SHRegQueryUSValueW
PathAddExtensionW
PathCompactPathA
StrPBrkW
PathFileExistsA
PathFileExistsW
StrChrIA
PathRemoveBlanksA

advapi32

RegCreateKeyA
OpenProcessToken
LookupPrivilegeValueA
InitializeAcl
SetEntriesInAuditListW
RegReplaceKeyW
CryptSetKeyParam
TrusteeAccessToObjectW
CryptDestroyKey
GetServiceDisplayNameW
OpenThreadToken
PrivilegedServiceAuditAlarmA
CreatePrivateObjectSecurity
SetServiceObjectSecurity
AdjustTokenPrivileges
BackupEventLogW
CryptExportKey
RegNotifyChangeKeyValue
SetFileSecurityW
LookupPrivilegeNameA
CryptGetDefaultProviderW
RegCreateKeyExA
RegSetValueExA
AddAce
GetPrivateObjectSecurity
CryptSetProviderExA
LookupPrivilegeValueW
RegisterEventSourceW
ReportEventW
GetAuditedPermissionsFromAclA
OpenServiceA
CreateProcessAsUserW
GetSecurityDescriptorSacl
EnumDependentServicesA
OpenServiceW
ImpersonateSelf
QueryServiceLockStatusW
CryptVerifySignatureA
GetAccessPermissionsForObjectW
BuildImpersonateTrusteeA
OpenSCManagerW
ChangeServiceConfigA
EqualPrefixSid
SetThreadToken
GetNamedSecurityInfoA
GetTrusteeTypeA
RegOpenKeyExW
LookupPrivilegeNameW
RegCreateKeyExW
UnlockServiceDatabase
RegDeleteKeyA
GetSecurityDescriptorLength
LookupAccountSidW
CryptAcquireContextA
RegSaveKeyW
DuplicateToken
GetAclInformation
GetTokenInformation
QueryServiceObjectSecurity
RegSetValueW
ConvertSecurityDescriptorToAccessW
GetNamedSecurityInfoExA

kernel32

OutputDebugStringW
ExpandEnvironmentStringsA
VirtualAlloc
CreateMailslotW
GetConsoleCP
GlobalSize
GetThreadPriorityBoost
GetCurrencyFormatW
ReadConsoleOutputCharacterA
VirtualProtect
GetAtomNameW
LocalFlags
GetCommandLineA
lstrcmpi
GetStartupInfoW
PulseEvent
GetComputerNameA
GetFileAttributesA
FreeEnvironmentStringsA
CopyFileExA
MapViewOfFileEx
MapViewOfFile
GetTapeParameters
TlsGetValue
QueryDosDeviceW
DisableThreadLibraryCalls
SetHandleCount
CreateMutexW
OpenFileMappingA
WriteProcessMemory
SetConsoleActiveScreenBuffer
GetLocaleInfoA
ReadConsoleOutputW
GenerateConsoleCtrlEvent
FlushFileBuffers
HeapUnlock
GetFileAttributesW
FormatMessageW
FileTimeToDosDateTime
GetProcessPriorityBoost
VirtualFreeEx
VirtualQueryEx
ReadFileScatter
MoveFileExA
IsValidCodePage
GlobalFree
GetCurrentProcessId
PurgeComm
CreateFileMappingW
GetCommTimeouts
CancelDeviceWakeupRequest
LocalCompact
GetPrivateProfileSectionW
HeapCompact
WriteProfileSectionA
DuplicateHandle
GetPrivateProfileStringW
GetTimeFormatW

ole32

MkParseDisplayName
CoQueryProxyBlanket
StgOpenStorage
StringFromIID
UtConvertDvtd16toDvtd32
UtGetDvtd16Info
OleRun
UtConvertDvtd32toDvtd16
OleCreateLinkFromData
CoFileTimeToDosDateTime
OleMetafilePictFromIconAndLabel
CoTaskMemAlloc
CoUnmarshalInterface
OleDoAutoConvert
MonikerCommonPrefixWith
PropVariantClear
CoResumeClassObjects
CoTaskMemFree
OleLockRunning
CoCreateInstanceEx
CoRevertToSelf
CoLockObjectExternal
GetHGlobalFromStream
CoRegisterMessageFilter
GetDocumentBitStg
CoGetInstanceFromFile
CoInitializeSecurity
CoLoadLibrary
CoRegisterSurrogate
ReadClassStg
CreateILockBytesOnHGlobal
OleCreateLinkEx
CoReleaseServerProcess
FreePropVariantArray
StgGetIFillLockBytesOnFile
ReadFmtUserTypeStg
OleSave
CreatePointerMoniker
OleDuplicateData
GetConvertStg
CoImpersonateClient
IsEqualGUID
OpenOrCreateStream
OleConvertIStorageToOLESTREAM
CoGetTreatAsClass
OleSetAutoConvert
OleNoteObjectVisible
StringFromGUID2
CoGetMarshalSizeMax
ReadClassStm
OleLoadFromStream
CoQueryAuthenticationServices
CoRevokeMallocSpy
StgCreateDocfile
CoUnmarshalHresult
OleInitialize
WriteClassStm
CoRegisterPSClsid
CoMarshalInterface

Sections

.text
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b5f5d8b10ff4d975b6d27d43174c6727

Headers

DLL Characteristics

File Characteristics

Imports

user32

shlwapi

advapi32

kernel32

ole32

Sections

.text Size: 57KB - Virtual size: 56KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 12KB

.text
Size: 57KB - Virtual size: 56KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 12KB