25f13afd34c4038ab7450d34e89bbaf7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

25f13afd34c4038ab7450d34e89bbaf7_JaffaCakes118
Size

93KB
MD5

25f13afd34c4038ab7450d34e89bbaf7
SHA1

c2aaa65a10d4fb012d8a722e42ba4ff1a06c01d7
SHA256

1211767ef9cbc99ce7eac488f70b61975e98beaa4cae20a8868dc57d9b53af48
SHA512

34dba662d61ed86b8fd58e8aa2d4202942194a070c3b342440274d9a18266d3d665c2a1cee79091cc13161016fc09a847d948d8379396201330f2a683574dd0a
SSDEEP

1536:LwH8foH/lr3QF/GTqg8HLhobQLAfm5b8HLljs2mwEhstzWrYh0E:Ggoflr39Og8HlKQLAfMmLljJmwEixWrG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
25f13afd34c4038ab7450d34e89bbaf7_JaffaCakes118

Files

25f13afd34c4038ab7450d34e89bbaf7_JaffaCakes118
.exe windows:5 windows x86 arch:x86

608b524939a4ae825f572a36fd684373

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThread
GetProcessHeap
IsBadReadPtr
SetFileTime
VirtualQueryEx
WriteFile
OpenProcess
Thread32First
WideCharToMultiByte
ReadProcessMemory
HeapDestroy
HeapCreate
Thread32Next
ReadFile
GetTimeZoneInformation
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
SetLastError
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
FindClose
LoadLibraryA
GetEnvironmentVariableW
FindNextFileW
HeapFree
CreateToolhelp32Snapshot
GetFileTime
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
CreateThread
ExpandEnvironmentStringsW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLocalTime
SetThreadPriority
GetThreadContext
SetThreadContext
GetProcessId
GetNativeSystemInfo
CreateRemoteThread
Process32FirstW
Process32NextW
GetPrivateProfileStringW
GetPrivateProfileIntW
GlobalLock
GlobalUnlock
ResetEvent
GetUserDefaultUILanguage
GetTickCount
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
MoveFileExW
GetSystemTime
GetTempFileNameW
VirtualProtect
FileTimeToDosDateTime
WriteProcessMemory
LocalFree
GetCurrentProcessId
DuplicateHandle
OpenEventW
GetFileAttributesExW
GetModuleFileNameW
GetVersionExW
VirtualFreeEx
VirtualFree
GetModuleHandleW
WaitForSingleObject
GetComputerNameW
SetErrorMode
GetCommandLineW
WaitForMultipleObjects
CreateEventW
SetFileAttributesW
CloseHandle
lstrcmpiW
WTSGetActiveConsoleSessionId
GetProcAddress
lstrcmpiA
CreateFileW
GetFileAttributesW
Sleep
LoadLibraryW
SetEvent
CreateDirectoryW
FreeLibrary
ExitProcess
RemoveDirectoryW

user32

LoadImageW
MsgWaitForMultipleObjects
CharLowerBuffA
GetCursorPos
CharToOemW
ExitWindowsEx
GetIconInfo
CharLowerA
PeekMessageW
DrawIcon
ToUnicode
GetClipboardData
TranslateMessage
GetKeyboardState
CharLowerW
DispatchMessageW
CharUpperW

advapi32

CryptCreateHash
LookupPrivilegeValueW
SetNamedSecurityInfoW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CreateProcessAsUserW
RegQueryValueExW
CryptReleaseContext
RegCreateKeyExW
GetTokenInformation
GetSidSubAuthorityCount
OpenThreadToken
CryptAcquireContextW
GetSidSubAuthority
OpenProcessToken
CryptGetHashParam
GetLengthSid
IsWellKnownSid
EqualSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
ConvertSidToStringSidW
InitiateSystemShutdownExW

shlwapi

PathRemoveFileSpecW
StrCmpNIW
PathRenameExtensionW
PathRemoveBackslashW
UrlUnescapeA
wvnsprintfW
PathIsDirectoryW
PathFindFileNameW
PathAddBackslashW
SHDeleteValueW
PathSkipRootW
SHDeleteKeyW
PathCombineW
PathAddExtensionW
PathUnquoteSpacesW
PathMatchSpecW
StrCmpNIA
wvnsprintfA
PathQuoteSpacesW
PathIsURLW

shell32

ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

CLSIDFromString
StringFromGUID2

ws2_32

recv
select
getaddrinfo
recvfrom
send
getpeername
listen
WSAIoctl
connect
WSAStartup
WSAGetLastError
shutdown
setsockopt
bind
socket
WSASetLastError
closesocket
freeaddrinfo
WSAEventSelect
getsockname
accept
sendto

crypt32

CertCloseStore
PFXExportCertStoreEx
PFXImportCertStore
CertDeleteCertificateFromStore
CertOpenSystemStoreW
CertEnumCertificatesInStore
CertDuplicateCertificateContext

wininet

InternetQueryDataAvailable
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpAddRequestHeadersA
InternetQueryOptionA
InternetOpenA
HttpOpenRequestA
InternetSetOptionA
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
InternetCloseHandle
HttpSendRequestA
HttpSendRequestW
InternetReadFile
InternetReadFileExA
HttpSendRequestExW
HttpQueryInfoA
HttpSendRequestExA

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

608b524939a4ae825f572a36fd684373

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

ws2_32

crypt32

wininet

netapi32

Sections

.text Size: 87KB - Virtual size: 87KB

.data Size: 512B - Virtual size: 7KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 87KB - Virtual size: 87KB

.data
Size: 512B - Virtual size: 7KB

.reloc
Size: 4KB - Virtual size: 3KB