152619e36fc1177304f208a8fa8ad76a_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

152619e36fc1177304f208a8fa8ad76a_JaffaCakes118
Size

310KB
MD5

152619e36fc1177304f208a8fa8ad76a
SHA1

a5dbcaf4396e36a90057c094d3880fc66e64d0ce
SHA256

add775f2079b232d78f26e88604c7b65c4adf0d633987cfd5e180de0fbe13b80
SHA512

d33e8df6f001d1b25a1ead19e85fd9eacc7ef7135d9d3b49161e1ea4030668738f46040913a1b3001bef88247e1f92d73d0f1ad97dfe4ba8c0cdf8f254f86de4
SSDEEP

6144:ehDGwTgVFhAUClRNYgzWC+UrxVw0o7tTMoUkKxFyNStNe672hK:eh6w4umoWKGnTMoUkVctNsc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
152619e36fc1177304f208a8fa8ad76a_JaffaCakes118

Files

152619e36fc1177304f208a8fa8ad76a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

17a3798c38d2df395bc52d8d379ecd88

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

VarUI4FromStr
GetErrorInfo
LoadRegTypeLi
SysStringByteLen
SysAllocString
VariantInit
LoadTypeLi
SysFreeString
SysStringLen
SysAllocStringByteLen
VariantCopy
UnRegisterTypeLi
DispCallFunc
RegisterTypeLi
VariantClear

user32

OpenClipboard
EmptyClipboard
RegisterWindowMessageA
SetClipboardData
LoadImageA
TranslateAcceleratorA
LoadMenuA
TrackPopupMenu
IsZoomed
CallNextHookEx
EnableMenuItem
GetCursorPos
GetWindowThreadProcessId
SetMenuDefaultItem
PostMessageA
GetSubMenu
SetWindowRgn
DrawIconEx
LoadAcceleratorsA
CopyRect
SetFocus
GetParent
EnableWindow
GetWindowRect
SetForegroundWindow
ReleaseDC
RedrawWindow
InflateRect
GetSystemMetrics
SendMessageA
PostQuitMessage
RemoveMenu
SetWindowsHookExA
UpdateWindow
IsWindow
MapDialogRect
SetWindowPos
GetDC
GetClientRect
CloseClipboard
DrawTextA
DestroyIcon
CharNextA
GetForegroundWindow
AttachThreadInput
FindWindowA
GetDesktopWindow
UnhookWindowsHookEx
LoadIconA
IsRectEmpty

advapi32

CopySid
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetSidLengthRequired
RegDeleteValueA
RegNotifyChangeKeyValue
InitializeSid
MakeSelfRelativeSD
GetSecurityDescriptorControl
RegOpenKeyExA
RegSetValueExA
RegQueryInfoKeyA
GetSecurityDescriptorGroup
OpenProcessToken
GetSecurityDescriptorOwner
GetSecurityDescriptorLength
RegEnumKeyExA
RegQueryValueExA
GetSecurityDescriptorSacl
GetLengthSid
MakeAbsoluteSD
GetSidSubAuthority
EqualSid
IsValidSid
RegCreateKeyExA
GetTokenInformation
SetSecurityDescriptorDacl
RegDeleteKeyA
RegCloseKey

ole32

CLSIDFromProgID
CoTaskMemRealloc
CoRegisterClassObject
CoTaskMemAlloc
CoFreeUnusedLibraries
StringFromCLSID
CoUninitialize
CoInitializeSecurity
CoRevokeClassObject
CoCreateInstance
StringFromGUID2
OleRun
OleUninitialize
CoTaskMemFree
CoInitializeEx
CoInitialize
CLSIDFromString

gdi32

CreateRectRgnIndirect
CombineRgn
CreateRectRgn
GetTextExtentExPointA
GetObjectA
SetRectRgn
CreateFontIndirectA

shlwapi

PathFindExtensionA

kernel32

lstrcpyA
GetModuleHandleA
GetProcessHeap
HeapReAlloc
GetTimeFormatA
lstrcatA
lstrcmpiA
HeapAlloc
lstrlenA
FindClose
LocalFree
SetPriorityClass
FindNextFileA
OpenProcess
IsDBCSLeadByte
WaitForMultipleObjects
HeapSize
FindResourceExA
ResetEvent
lstrlenW
GetSystemTimeAsFileTime
LockResource
DeleteFileA
GetThreadLocale
lstrcmpA
DeleteCriticalSection
GetACP
FileTimeToSystemTime
CreateThread
GlobalAlloc
FindResourceA
FormatMessageA
RemoveDirectoryA
HeapDestroy
WaitForSingleObject
LoadLibraryExA
CloseHandle
SystemTimeToFileTime
WideCharToMultiByte
FreeLibrary
GetUserDefaultLangID
SizeofResource
LocalAlloc
lstrcpynA
LeaveCriticalSection
SetLastError
RaiseException
CreateMutexA
EnterCriticalSection
OpenEventA
ReleaseMutex
HeapFree
CreateEventA
GlobalUnlock
FindFirstFileA
SetProcessWorkingSetSize
GlobalLock
GetCurrentThreadId
GetDateFormatA
LoadResource
IsValidCodePage
VirtualAllocEx

shell32

ShellExecuteA
Shell_NotifyIconA

userenv

GetProfileType
UnloadUserProfile
GetDefaultUserProfileDirectoryW
GetProfilesDirectoryA
DestroyEnvironmentBlock
GetAppliedGPOListA

ddrawex

DllUnregisterServer
DllCanUnloadNow

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 263KB - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

17a3798c38d2df395bc52d8d379ecd88

Headers

File Characteristics

Imports

oleaut32

user32

advapi32

ole32

gdi32

shlwapi

kernel32

shell32

userenv

ddrawex

Sections

.text Size: 22KB - Virtual size: 21KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 263KB - Virtual size: 265KB

.rsrc Size: 18KB - Virtual size: 18KB

.text
Size: 22KB - Virtual size: 21KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 263KB - Virtual size: 265KB

.rsrc
Size: 18KB - Virtual size: 18KB