12c183f65a33aad2a4cb2bceed3bc12b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

12c183f65a33aad2a4cb2bceed3bc12b_JaffaCakes118
Size

6.0MB
MD5

12c183f65a33aad2a4cb2bceed3bc12b
SHA1

44eaae436144200d74b0e7718dd1d268f729a045
SHA256

06c957265b103fc6385709fa4770b3fcfd49f507407e6b89329c3772f0fcd154
SHA512

83f83db4d1396f58d04722121d51de8a82cc815e857da4621fd36161c778f8262141215074fb35005dc8736a59ebf98c6553028c7a23f8ab9766f2808f1489f9
SSDEEP

49152:44l1GFtGrDn4444mmmmmykWqDrtCidfZomaoTWpZUWtKeCPh88qlmyKK9EsyP9B/:44l1ItIYWqdCpH0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
12c183f65a33aad2a4cb2bceed3bc12b_JaffaCakes118

Files

12c183f65a33aad2a4cb2bceed3bc12b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dadc9302f5ee0b288a5b86e4bdb8b189

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetLastError
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
CloseHandle
WaitForSingleObject
GetModuleFileNameW
CreateThread
MoveFileExA
GetTempPathW
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
InterlockedCompareExchange
HeapFree
GetProcessHeap
HeapAlloc
GetProcAddress
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
FlushFileBuffers
CreateFileA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetCurrentThreadId
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
IsValidCodePage
GetOEMCP
GetCPInfo
GetConsoleMode
GetConsoleCP
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
HeapSize
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStdHandle
WriteFile
ExitProcess
HeapCreate
HeapDestroy
GetStartupInfoA
GlobalAlloc
GlobalLock
GlobalUnlock
GetModuleFileNameA
MulDiv
lstrcmpA
GetCurrentProcess
FlushInstructionCache
IsDBCSLeadByte
MultiByteToWideChar
lstrcmpiA
lstrlenA
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
HeapReAlloc
VirtualQuery
GetSystemInfo
VirtualProtect
GetLastError
lstrlenW
WideCharToMultiByte
GetTickCount
Sleep
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
WriteConsoleW

user32

LoadCursorA
SetWindowLongA
GetWindowLongA
CreateWindowExA
SendMessageA
DispatchMessageA
TranslateMessage
PeekMessageA
MessageBoxA
CallWindowProcA
ReleaseDC
GetDC
GetDesktopWindow
CharNextA
DefWindowProcA
GetSysColor
MoveWindow
SetWindowPos
GetClientRect
ClientToScreen
ScreenToClient
InvalidateRect
InvalidateRgn
RedrawWindow
SetCapture
IsChild
GetParent
GetDlgItem
UnregisterClassA
LoadIconA
ShowWindow
SetForegroundWindow
DestroyIcon
GetClassNameA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
CreateAcceleratorTableA
RegisterClassExA
RegisterWindowMessageA
GetClassInfoExA
IsWindow
GetFocus
GetWindow
SetFocus
DestroyAcceleratorTable
BeginPaint
EndPaint
DestroyWindow
FillRect
ReleaseCapture

advapi32

CloseServiceHandle
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
OpenSCManagerW
OpenServiceW
StartServiceW
ControlService
RegDeleteKeyA

ole32

CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoInitialize

oleaut32

SysAllocStringLen
VarUI4FromStr
SysStringByteLen
VariantInit
VariantClear
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
SysStringLen
SysAllocString
SysFreeString

gdi32

GetStockObject
GetObjectA
CreateSolidBrush
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
DeleteDC
GetDeviceCaps

ntdll

NtSetInformationFile
ZwEnumerateKey
_stricmp
RtlAllocateHeap
RtlFreeHeap
NtQuerySystemInformation
RtlUnwind
NtCreateFile
ZwOpenKey
ZwQueryValueKey
NtWriteFile
NtReadFile
NtQueryInformationFile
NtClose

Sections

.text
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dadc9302f5ee0b288a5b86e4bdb8b189

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

gdi32

ntdll

Sections

.text Size: 72KB - Virtual size: 72KB

.rdata Size: 63KB - Virtual size: 62KB

.data Size: 7KB - Virtual size: 14KB

.rsrc Size: 5.9MB - Virtual size: 5.9MB

.text
Size: 72KB - Virtual size: 72KB

.rdata
Size: 63KB - Virtual size: 62KB

.data
Size: 7KB - Virtual size: 14KB

.rsrc
Size: 5.9MB - Virtual size: 5.9MB