1aa97711314612b3413c935969590bae_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

1aa97711314612b3413c935969590bae_JaffaCakes118
Size

693KB
MD5

1aa97711314612b3413c935969590bae
SHA1

257ebb345989c07bae2b6acddb5bc848d0656bb0
SHA256

d59e0a9e77727cec2c7423c014a9c9dbab64fa54dec2e49482b262e00c9756de
SHA512

d755954df88b17cad3cf5abaa59e250043e2cc03340c3d7452ddf1da96d132c34ecc9a6caa8ba2dbf4b75cabf91a3f33c519dbbc62f765cc8d85f7c5bdacec2b
SSDEEP

12288:Vejv6Ky6XgWqQUElL1Y0UlT52pE/WuJIAu7n7rGPsUFRAp+9ZNN:Vejvg3RLC13UpT+d9yPhRAyNN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
1aa97711314612b3413c935969590bae_JaffaCakes118

Files

1aa97711314612b3413c935969590bae_JaffaCakes118
.exe windows:5 windows x86 arch:x86

7d67b33081b8eb77f6c0f3bbe852a536

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Indexed\Push\Release\Lake.pdb

Imports

kernel32

GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
SetEnvironmentVariableW
SetEnvironmentVariableA
CompareStringW
SetFilePointer
HeapReAlloc
HeapSize
HeapAlloc
GetConsoleMode
GetConsoleCP
FlushFileBuffers
VirtualFree
HeapFree
HeapCreate
HeapDestroy
GetEnvironmentStrings
FreeEnvironmentStringsA
GetCurrentProcessId
QueryPerformanceCounter
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
lstrcpyA
LocalFree
OutputDebugStringA
CreateToolhelp32Snapshot
FindNextFileA
LocalAlloc
CreateFileMappingA
FindClose
SetFileAttributesA
CopyFileA
VirtualAlloc
SetLastError
FindFirstFileA
CreateDirectoryA
SetConsoleTitleA
lstrcatA
GetFileAttributesA
GetConsoleWindow
GetConsoleTitleA
GlobalLock
CreateDirectoryW
VirtualQuery
lstrlenA
CloseHandle
GetModuleHandleA
WaitForMultipleObjects
FindNextChangeNotification
GetLastError
ExitThread
SetHandleCount
InitializeCriticalSectionAndSpinCount
LoadLibraryA
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
GetModuleFileNameA
LoadLibraryW
OutputDebugStringW
GetFileType
WriteConsoleW
GetStdHandle
DebugBreak
GetEnvironmentStringsW
FreeEnvironmentStringsW
MultiByteToWideChar
CompareStringA
GetTimeZoneInformation
TlsFree
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsGetValue
IsBadReadPtr
HeapValidate
RaiseException
RtlUnwind
GetStartupInfoA
GetCommandLineA
WideCharToMultiByte
ReadFile
WriteFile
GetTickCount
FindFirstChangeNotificationW
GetFileSize
ExitProcess
GetProcAddress
GetModuleHandleW
GetSystemTimeAsFileTime
GetModuleFileNameW
CreateThread
ResumeThread
IsDebuggerPresent
CreateFileA
GetTempFileNameW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
Sleep
InterlockedDecrement
InterlockedIncrement

user32

ShowWindow
GetCursorPos
EndDialog
GetDlgItem
ReleaseDC
GetWindowTextA
GetDC
CreateDialogParamA
GetWindowRect
DestroyWindow
DestroyIcon
LoadCursorA
CallWindowProcA
SetCapture
IsWindowVisible
GetSystemMetrics
CreateWindowExW
AppendMenuA
IsDlgButtonChecked
CheckDlgButton
SetWindowPos
GetSysColor
GetFocus
GetDesktopWindow
SetClassLongA
CreateWindowExA
SetRect
DrawFocusRect
SendMessageA
LoadImageA
GetSystemMenu
LoadBitmapA

gdi32

CreatePen
Ellipse
BeginPath
CreateEllipticRgn
MoveToEx
LineTo
SetWindowExtEx
SetTextColor
CreateFontIndirectA
SetBkMode
DeleteObject
SetMapMode
GetMapMode
CreateRoundRectRgn
SetTextAlign
GetObjectA
GetStockObject
TextOutA
SelectObject
CreateCompatibleDC
CreateSolidBrush

comdlg32

FindTextA
GetOpenFileNameA

advapi32

SetSecurityDescriptorDacl
CryptImportKey
CryptEncrypt
CryptGenKey
CryptDestroyKey
CryptExportKey
CryptReleaseContext
FreeSid
SetEntriesInAclW
AllocateAndInitializeSid
CryptDecrypt
InitializeSecurityDescriptor
CryptAcquireContextA

shell32

SHGetFileInfoA

ole32

ReleaseStgMedium
CreateStreamOnHGlobal
MkParseDisplayName
CreateBindCtx
CoGetMalloc

opengl32

glDisable
glLoadIdentity
glMatrixMode
wglDeleteContext
glCullFace
glColor4f
glDeleteLists
glShadeModel

ws2_32

WSAAsyncSelect
ioctlsocket
closesocket
WSAHtonl
WSASocketA
WSAHtons
WSASendTo
inet_addr
htonl
htons
setsockopt
bind
socket
sendto

winmm

waveOutMessage
mixerGetID

crypt32

CertGetNameStringA

comctl32

ImageList_ReplaceIcon
ord17

gdiplus

GdipFree
GdipCreateBitmapFromFileICM
GdipAlloc
GdipDisposeImage
GdipCreateBitmapFromFile
GdipCloneImage
GdiplusStartup

imm32

ImmGetDefaultIMEWnd

setupapi

CM_Get_Class_Key_NameA
SetupDiGetClassDevsA
CM_Get_Child

traffic

TcAddFilter
TcEnumerateInterfaces

tapi32

tapiRequestMediaCallA
phoneSetHookSwitch
tapiRequestDrop

Sections

.text
Size: 284KB - Virtual size: 284KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 338KB - Virtual size: 338KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7d67b33081b8eb77f6c0f3bbe852a536

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

opengl32

ws2_32

winmm

crypt32

comctl32

gdiplus

imm32

setupapi

traffic

tapi32

Sections

.text Size: 284KB - Virtual size: 284KB

.rdata Size: 63KB - Virtual size: 62KB

.data Size: 6KB - Virtual size: 13KB

.rsrc Size: 338KB - Virtual size: 338KB

.text
Size: 284KB - Virtual size: 284KB

.rdata
Size: 63KB - Virtual size: 62KB

.data
Size: 6KB - Virtual size: 13KB

.rsrc
Size: 338KB - Virtual size: 338KB