2df85bbe91f271327138a69c00b99801_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

2df85bbe91f271327138a69c00b99801_JaffaCakes118
Size

101KB
MD5

2df85bbe91f271327138a69c00b99801
SHA1

5f66b954bf97085b9d869785128e59f292a61da5
SHA256

e8a98ee6a2e1d312afd6b2b743a8803527604489a33d808927436764f07e8be4
SHA512

3c95271a9ae2f0fb0d715c513bbd26b565199079baab648b6973220e2b300f539006142441c03d212c7b664f889776a0553fae84d597d75f36afea92ae3a5a0a
SSDEEP

3072:AUNMqgOzC9GXx+ozV4aEs8BLFvyHlDJ8tAL1X:COzyK/zVn83gld8tAR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2df85bbe91f271327138a69c00b99801_JaffaCakes118

Files

2df85bbe91f271327138a69c00b99801_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f6679e1d29a5540c02654d75b2542426

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ddraw

DirectDrawCreate
DirectDrawEnumerateA
DirectDrawCreateEx

shell32

CommandLineToArgvW
ShellExecuteW
SHAppBarMessage
SHGetFolderPathW
FindExecutableW
Shell_NotifyIconW
ShellExecuteExW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

gdi32

SelectObject
DeleteDC
GetDeviceCaps
CreateCompatibleBitmap
BitBlt
GetStockObject
CreateCompatibleDC
DeleteObject
CreateSolidBrush
GetObjectW

ole32

CoAllowSetForegroundWindow
CLSIDFromProgID
StringFromCLSID
CreateStreamOnHGlobal
CoInitializeSecurity
CoTaskMemFree
CLSIDFromString
CoTaskMemAlloc
CoSetProxyBlanket
CoInitializeEx
CoGetClassObject
OleLockRunning
CoCreateInstance
StringFromGUID2
CoUninitialize
OleUninitialize
OleInitialize
CoCreateGuid

shlwapi

UrlApplySchemeW
UrlCanonicalizeW
PathCombineW
UrlCombineW
UrlGetPartW
PathAppendW

kernel32

HeapReAlloc
GetACP
CloseHandle
ResetEvent
LocalFree
GetCurrentProcess
SizeofResource
FindResourceExW
LoadLibraryW
CreateMutexW
GetSystemDirectoryW
IsDebuggerPresent
GetTempPathW
GetProcessHeap
WaitForMultipleObjects
LeaveCriticalSection
WideCharToMultiByte
IsProcessorFeaturePresent
WaitForSingleObject
UnhandledExceptionFilter
GetLocaleInfoW
GlobalHandle
CreateFileW
VirtualAlloc
LoadLibraryA
GetModuleFileNameW
GetLocaleInfoA
VirtualFree
GlobalAlloc
MultiByteToWideChar
QueryPerformanceCounter
GetThreadLocale
GetProcessVersion
HeapSize
lstrlenA
GetProcessId
GetStartupInfoW
HeapSetInformation
GetProcAddress
GetCurrentThreadId
HeapFree
LocalAlloc
LCMapStringW
GetSystemTimeAsFileTime
InterlockedExchange
CreateThread
LockResource
GetLastError
RaiseException
FindResourceW
DeleteCriticalSection
ProcessIdToSessionId
ExitProcess
LoadResource
GetSystemInfo
lstrlenW
GlobalLock
FlushInstructionCache
FreeLibrary
TerminateProcess
VirtualLock
GetComputerNameW
InterlockedIncrement
InterlockedDecrement
MulDiv
HeapAlloc
lstrcmpW
InterlockedCompareExchange
SetLastError
HeapDestroy
GlobalUnlock
GetVersionExA
VirtualUnlock
GlobalFree
EnterCriticalSection
OpenProcess
GetTickCount
GetVersionExW
CreateEventW
SetUnhandledExceptionFilter
ReleaseMutex
FormatMessageW
Sleep
SetEvent
LoadLibraryExW
InitializeCriticalSection
GetModuleHandleW

netapi32

NetUserGetLocalGroups
NetWkstaUserGetInfo
NetUserAdd
NetUserDel
NetApiBufferFree
NetLocalGroupAddMembers
NetUserEnum
NetGetJoinInformation

gdiplus

GdiplusShutdown
GdipFree
GdipCreateHBITMAPFromBitmap
GdipAlloc
GdipCloneImage
GdiplusStartup
GdipCreateBitmapFromFile
GdipDisposeImage
GdipCreateBitmapFromFileICM

secur32

GetUserNameExW

wtsapi32

WTSEnumerateSessionsW
WTSQuerySessionInformationW
WTSFreeMemory
WTSUnRegisterSessionNotification
WTSRegisterSessionNotification

crypt32

CryptUnprotectData
CryptProtectData

user32

SetTimer
GetWindowLongW
SetCapture
GetCursorPos
DestroyIcon
AttachThreadInput
RedrawWindow
GetDlgItem
DispatchMessageW
FindWindowW
SetWindowTextW
IsWindow
ScreenToClient
ClientToScreen
EndDialog
DialogBoxIndirectParamW
ShowWindow
GetWindowRect
GetClientRect
SetWindowPos
AllowSetForegroundWindow
AppendMenuW
IsChild
GetParent
PostQuitMessage
DestroyMenu
InvalidateRect
SetCursor
GetWindowThreadProcessId
LoadCursorW
MonitorFromWindow
CallWindowProcW
PostMessageW
TrackPopupMenu
SetFocus
SendDlgItemMessageW
GetForegroundWindow
BeginPaint
GetWindowTextW
SystemParametersInfoW
UnregisterClassA
DestroyWindow
UnhookWindowsHookEx
CreateAcceleratorTableW
GetMessageW
DestroyAcceleratorTable
RegisterClassExW
RegisterWindowMessageW
SetForegroundWindow
GetClassInfoExW
OpenClipboard
TranslateMessage
GetDC
KillTimer
UpdateLayeredWindow
MoveWindow
GetMonitorInfoW
FillRect
CreateWindowExW
GetClassNameW
CloseClipboard
SetWindowsHookExW
PtInRect
CharNextW
GetFocus
SetProcessDefaultLayout
CreatePopupMenu
SetClipboardData
GetDesktopWindow
GetKeyState
SendMessageW
ReleaseCapture
CallNextHookEx
InvalidateRgn
EndPaint
GetWindowTextLengthW
ReleaseDC
LoadIconW
GetSysColor
MapDialogRect
SetWindowLongW
PeekMessageW
PostThreadMessageW
GetWindow
DefWindowProcW
SetWindowContextHelpId

Sections

.text
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f6679e1d29a5540c02654d75b2542426

Headers

File Characteristics

Imports

ddraw

shell32

version

gdi32

ole32

shlwapi

kernel32

netapi32

gdiplus

secur32

wtsapi32

crypt32

user32

Sections

.text Size: 54KB - Virtual size: 53KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 38KB - Virtual size: 38KB

.rsrc Size: 1024B - Virtual size: 56KB

.text
Size: 54KB - Virtual size: 53KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 38KB - Virtual size: 38KB

.rsrc
Size: 1024B - Virtual size: 56KB