1314b7af87eb090501bba3166c7449ec_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

1314b7af87eb090501bba3166c7449ec_JaffaCakes118
Size

93KB
MD5

1314b7af87eb090501bba3166c7449ec
SHA1

2d0b1628c247905f35c3b700e885b4ee83866753
SHA256

fa9dfed5c596114f3057d86186d3c48c79a0aed2fdad74558eaf97fab5ae340f
SHA512

f71b03859fda3f094869925d6bd84738fa1bf931aa092ae177d0692106daedf1b8b35bdb86f7caa4f3f90eade69a8b1727fb977b1cc01caed67c5ef1760b829a
SSDEEP

1536:UwH8Ylr3QF/GTqg8HLhobQLAfm5b8HLljs2mwEhstzWrY8:Rzlr39Og8HlKQLAfMmLljJmwEixWrb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1314b7af87eb090501bba3166c7449ec_JaffaCakes118

Files

1314b7af87eb090501bba3166c7449ec_JaffaCakes118
.exe windows:5 windows x86 arch:x86

608b524939a4ae825f572a36fd684373

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThread
GetProcessHeap
IsBadReadPtr
SetFileTime
VirtualQueryEx
WriteFile
OpenProcess
Thread32First
WideCharToMultiByte
ReadProcessMemory
HeapDestroy
HeapCreate
Thread32Next
ReadFile
GetTimeZoneInformation
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
SetLastError
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
FindClose
LoadLibraryA
GetEnvironmentVariableW
FindNextFileW
HeapFree
CreateToolhelp32Snapshot
GetFileTime
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
CreateThread
ExpandEnvironmentStringsW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLocalTime
SetThreadPriority
GetThreadContext
SetThreadContext
GetProcessId
GetNativeSystemInfo
CreateRemoteThread
Process32FirstW
Process32NextW
GetPrivateProfileStringW
GetPrivateProfileIntW
GlobalLock
GlobalUnlock
ResetEvent
GetUserDefaultUILanguage
GetTickCount
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
MoveFileExW
GetSystemTime
GetTempFileNameW
VirtualProtect
FileTimeToDosDateTime
WriteProcessMemory
LocalFree
GetCurrentProcessId
DuplicateHandle
OpenEventW
GetFileAttributesExW
GetModuleFileNameW
GetVersionExW
VirtualFreeEx
VirtualFree
GetModuleHandleW
WaitForSingleObject
GetComputerNameW
SetErrorMode
GetCommandLineW
WaitForMultipleObjects
CreateEventW
SetFileAttributesW
CloseHandle
lstrcmpiW
WTSGetActiveConsoleSessionId
GetProcAddress
lstrcmpiA
CreateFileW
GetFileAttributesW
Sleep
LoadLibraryW
SetEvent
CreateDirectoryW
FreeLibrary
ExitProcess
RemoveDirectoryW

user32

LoadImageW
MsgWaitForMultipleObjects
CharLowerBuffA
GetCursorPos
CharToOemW
ExitWindowsEx
GetIconInfo
CharLowerA
PeekMessageW
DrawIcon
ToUnicode
GetClipboardData
TranslateMessage
GetKeyboardState
CharLowerW
DispatchMessageW
CharUpperW

advapi32

CryptCreateHash
LookupPrivilegeValueW
SetNamedSecurityInfoW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CreateProcessAsUserW
RegQueryValueExW
CryptReleaseContext
RegCreateKeyExW
GetTokenInformation
GetSidSubAuthorityCount
OpenThreadToken
CryptAcquireContextW
GetSidSubAuthority
OpenProcessToken
CryptGetHashParam
GetLengthSid
IsWellKnownSid
EqualSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
ConvertSidToStringSidW
InitiateSystemShutdownExW

shlwapi

PathRemoveFileSpecW
StrCmpNIW
PathRenameExtensionW
PathRemoveBackslashW
UrlUnescapeA
wvnsprintfW
PathIsDirectoryW
PathFindFileNameW
PathAddBackslashW
SHDeleteValueW
PathSkipRootW
SHDeleteKeyW
PathCombineW
PathAddExtensionW
PathUnquoteSpacesW
PathMatchSpecW
StrCmpNIA
wvnsprintfA
PathQuoteSpacesW
PathIsURLW

shell32

ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

CLSIDFromString
StringFromGUID2

ws2_32

recv
select
getaddrinfo
recvfrom
send
getpeername
listen
WSAIoctl
connect
WSAStartup
WSAGetLastError
shutdown
setsockopt
bind
socket
WSASetLastError
closesocket
freeaddrinfo
WSAEventSelect
getsockname
accept
sendto

crypt32

CertCloseStore
PFXExportCertStoreEx
PFXImportCertStore
CertDeleteCertificateFromStore
CertOpenSystemStoreW
CertEnumCertificatesInStore
CertDuplicateCertificateContext

wininet

InternetQueryDataAvailable
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpAddRequestHeadersA
InternetQueryOptionA
InternetOpenA
HttpOpenRequestA
InternetSetOptionA
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
InternetCloseHandle
HttpSendRequestA
HttpSendRequestW
InternetReadFile
InternetReadFileExA
HttpSendRequestExW
HttpQueryInfoA
HttpSendRequestExA

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

608b524939a4ae825f572a36fd684373

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

ws2_32

crypt32

wininet

netapi32

Sections

.text Size: 87KB - Virtual size: 87KB

.data Size: 512B - Virtual size: 7KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 87KB - Virtual size: 87KB

.data
Size: 512B - Virtual size: 7KB

.reloc
Size: 4KB - Virtual size: 3KB