10201967feac4cf1602d9618883854ba_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

10201967feac4cf1602d9618883854ba_JaffaCakes118
Size

4.0MB
MD5

10201967feac4cf1602d9618883854ba
SHA1

6b00b4ad419643dc7ed9093d1e94de340f71fa79
SHA256

7508bbee72037dbcaf29a5b252be37947373c6f7c99b05a607f3b22c5ef33e2f
SHA512

1a48fa8f3ad0ac23c8962c32905bebbc33339ba1a5833e6eb37917d51ddaba83f548d3bf82e4659fda1d3f347666947bf14f767e6be6c60de437a129676bdd7d
SSDEEP

49152:G1ox2l+n5fsLgAI4/4rXNSoI/89hUJb2EzgAuMtnE18lpJ:G1Zsn50UFr9e/Awj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
10201967feac4cf1602d9618883854ba_JaffaCakes118

Files

10201967feac4cf1602d9618883854ba_JaffaCakes118
.exe windows:4 windows x86 arch:x86

169307419dc8a0e0976ef3a59334bb3c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegCloseKey

ddraw

DirectDrawCreate

dsound

DirectSoundCreate

gdi32

GetStockObject
CreateDCA
GetObjectA
GetDIBits
CreateCompatibleBitmap
DeleteObject
CreateCompatibleDC
BitBlt
DeleteDC
TextOutA
CreateFontA
SelectObject
SetBkMode
SetTextColor

handes

?DecryptFunc@@YGHPAD0@Z

imm32

ImmSetConversionStatus
ImmGetContext
ImmSetOpenStatus

kernel32

CreateToolhelp32Snapshot
GetCurrentProcessId
GetFileSize
GetSystemDirectoryA
FindNextFileA
FindClose
GetComputerNameA
WriteFile
SetFilePointer
GetLocalTime
SuspendThread
ResumeThread
GetCurrentThreadId
CreateDirectoryA
CopyFileA
DeleteCriticalSection
TerminateThread
GetExitCodeThread
WaitForSingleObject
SetThreadPriority
_hwrite
_lclose
_lcreat
CompareFileTime
GlobalFree
GlobalAlloc
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
FreeLibrary
GetProcAddress
LoadLibraryA
IsDBCSLeadByte
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
TerminateProcess
LocalFree
LocalAlloc
GetLastError
SetEndOfFile
SetEnvironmentVariableA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
IsBadReadPtr
QueryPerformanceCounter
GetSystemInfo
Module32First
lstrcat
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetTimeZoneInformation
LCMapStringW
LCMapStringA
GetCPInfo
GetOEMCP
GetFileType
GetStdHandle
LockResource
HeapSize
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
SetUnhandledExceptionFilter
ExitProcess
GetCommandLineA
GetStartupInfoA
GetSystemTimeAsFileTime
HeapReAlloc
RtlUnwind
HeapFree
HeapAlloc
RaiseException
VirtualQuery
GetSystemDefaultLangID
GetCurrentProcess
GetModuleHandleA
ResetEvent
CreateEventA
SetEvent
GetModuleFileNameA
FindFirstFileA
CreateFileA
ReadFile
CloseHandle
Module32Next
InitializeCriticalSection
GetCurrentThread
GetTickCount
Sleep
EnterCriticalSection
LeaveCriticalSection
ExitThread
lstrlen
lstrcmpi
CompareStringW
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetLocaleInfoA
DeleteFileA
OutputDebugStringA
lstrcmp
VirtualProtect
lstrcpy
InterlockedExchange
GetACP
GetEnvironmentStringsW
CreateThread
CompareStringA
LoadLibraryA
VirtualFree
VirtualAlloc
LoadLibraryA
ExitProcess
GetProcAddress
VirtualFree
VirtualAlloc

shell32

ShellExecuteA

shlwapi

PathFileExistsA

user32

SendMessageA
SetWindowTextA
DefWindowProcA
PostMessageA
SetForegroundWindow
PostQuitMessage
SetFocus
GetForegroundWindow
ReleaseDC
GetWindowTextA
GetDC
DispatchMessageA
TranslateMessage
PeekMessageA
DrawTextA
SetWindowLongA
ShowCursor
UpdateWindow
ShowWindow
CreateWindowExA
LoadBitmapA
CallWindowProcA
RegisterClassA
LoadCursorA
LoadIconA
GetSystemMetrics
GetClassNameA
EnumWindows
FindWindowA
wsprintfA
CharLowerA
SetTimer
OffsetRect
ClientToScreen
GetClientRect
MessageBoxA
GetWindowRect
GetDesktopWindow
wsprintfA
MessageBoxA

wininet

HttpQueryInfoA
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetQueryDataAvailable

winmm

mixerSetControlDetails
timeEndPeriod
timeKillEvent
timeSetEvent
timeBeginPeriod
mmioClose
mmioAscend
mmioRead
mmioDescend
mmioOpenA
mmioSeek
mmioSetInfo
mmioAdvance
mmioGetInfo
mixerClose
mixerOpen
mixerGetDevCapsA
mixerGetControlDetailsA
mixerGetLineControlsA
mixerGetLineInfoA
timeGetTime

ws2_32

WSACleanup
getsockname
accept
inet_ntoa
gethostbyname
closesocket
WSAGetLastError
ioctlsocket
htons
send
WSAAsyncSelect
connect
inet_addr
socket
WSAStartup

wsock32

setsockopt
recv

ole32

CoCreateInstance
CoUninitialize
CoInitialize

Exports

Exports

SetExtChangeZip
UnZipData
UnZipDataToDirectory
UnZipDataToFile
UnZipFile
ZipData
ZipFile
_CloseD3d@0
_InitD3D@4
_smPlayD3D@24
fcEXP

Sections

.text
Size: 2.8MB - Virtual size: 63.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

169307419dc8a0e0976ef3a59334bb3c

Headers

File Characteristics

Imports

advapi32

ddraw

dsound

gdi32

handes

imm32

kernel32

shell32

shlwapi

user32

wininet

winmm

ws2_32

wsock32

ole32

Exports

Exports

Sections

.text Size: 2.8MB - Virtual size: 63.9MB

.rsrc Size: 1.2MB - Virtual size: 1.2MB

.idata Size: 8KB - Virtual size: 8KB

.text
Size: 2.8MB - Virtual size: 63.9MB

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

.idata
Size: 8KB - Virtual size: 8KB