39d6ec1892af37c0fd5c5c2ea89ea782_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

39d6ec1892af37c0fd5c5c2ea89ea782_JaffaCakes118
Size

283KB
MD5

39d6ec1892af37c0fd5c5c2ea89ea782
SHA1

8ec2c72146cbb96c940b6b1d1057b2eb72fc36d0
SHA256

439386a1dfa86c57251f8ee7eeafe15170f6999a97dfeb257ea139829af601c7
SHA512

fd6260b87cfe54a1d81d88d57a49754c6c39bc9c11cd6dbe515fe845958f97a9a2abb3ecd08ed65e8eaec541056b4a7dfe50598b5bd2c807270617a94bec6102
SSDEEP

1536:Pi/RkUpybMbsLs6Hfo0uC3ItNmWPsh4U16wnrg/xSMxWRL7C9ki2FZ9DPnak9P8N:ewznY8ItNHGNr2vW79XIa+5k4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
39d6ec1892af37c0fd5c5c2ea89ea782_JaffaCakes118

Files

39d6ec1892af37c0fd5c5c2ea89ea782_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e28242db9ee32a240d22ee7a94384b35

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh

Imports

urlmon

URLDownloadToFileW

kernel32

GetTickCount
DeleteTimerQueueTimer
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
SwitchToThread
CreateIoCompletionPort
GetModuleFileNameW
TerminateThread
PostQueuedCompletionStatus
DeleteFileW
FlushViewOfFile
GetCurrentProcessId
GetCurrentThreadId
GetQueuedCompletionStatus
WaitForMultipleObjects
Sleep
HeapAlloc
HeapReAlloc
GetProcessHeap
HeapFree
OpenProcess
FindClose
FindNextFileW
FindFirstFileW
LocalFree
CreateProcessW
lstrcmpiW
FlushFileBuffers
WriteFile
GetLastError
SetFilePointer
GetFileSizeEx
ReleaseMutex
CreateMutexW
GetNativeSystemInfo
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleW
ExpandEnvironmentStringsW
CreateTimerQueueTimer
ExitProcess
CopyFileW
SetFileAttributesW
CreateDirectoryW
lstrcmpW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
MoveFileExW
GetDriveTypeW
DeviceIoControl
GetVolumeNameForVolumeMountPointW
GetSystemDirectoryW
GetVolumeInformationW
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
CreateFileA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
HeapSize
InitializeCriticalSectionAndSpinCount
lstrcatW
GetExitCodeThread
lstrlenW
UnmapViewOfFile
CreateFileW
GetFileSize
CreateFileMappingW
MapViewOfFile
LoadLibraryA
GetProcAddress
FileTimeToSystemTime
lstrcpynW
WaitForSingleObject
TerminateProcess
CloseHandle
lstrlenA
GetThreadId
ExitThread
CreateThread
GetSystemTimeAsFileTime
RtlUnwind
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RaiseException
GetCommandLineA
GetStartupInfoA
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStdHandle
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
VirtualAlloc
VirtualFree
HeapCreate

user32

EmptyClipboard
DefWindowProcW
GetClipboardData
GetPriorityClipboardFormat
DefWindowProcA
DispatchMessageW
GetShellWindow
GetWindowThreadProcessId
SetClipboardData
TranslateMessage
GetMessageW
RegisterClassExW
wsprintfW
UnregisterClassW
DestroyWindow
RemoveClipboardFormatListener
AddClipboardFormatListener
CreateWindowExW
PostThreadMessageW
OpenClipboard
CloseClipboard
CharLowerW

advapi32

RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RevertToSelf
ImpersonateLoggedOnUser
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptAcquireContextA
CryptReleaseContext
CryptCreateHash
CryptHashData
CryptVerifySignatureA
CryptDestroyHash
CryptImportKey
CryptGetKeyParam
CryptDestroyKey
OpenProcessToken
RegSetValueExW

shell32

ShellExecuteExW
ord165
SHChangeNotify
SHGetFolderPathW
ShellExecuteW

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize

oleaut32

SysFreeString
SysAllocString

ws2_32

htonl
ntohl
ntohs
htons
recvfrom
setsockopt
sendto
inet_ntoa
freeaddrinfo
closesocket
getsockname
connect
socket
WSAGetLastError
WSARecvFrom
WSASendTo
bind
WSAStartup
WSACleanup
inet_addr
WSASocketW
getaddrinfo

shlwapi

PathCombineW
StrToIntA
StrDupW
PathFindExtensionW
PathFileExistsW
StrStrNIW
StrCmpNIW
StrStrIW
PathAddExtensionW
PathStripToRootW
PathAppendW
PathRemoveFileSpecW

mpr

WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW

wininet

InternetOpenUrlW
InternetCrackUrlW
InternetOpenW
InternetConnectW
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW
HttpQueryInfoW
InternetReadFile
InternetCloseHandle

rpcrt4

UuidCreate

Sections

.text
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 131KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e28242db9ee32a240d22ee7a94384b35

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

urlmon

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

shlwapi

mpr

wininet

rpcrt4

Sections

.text Size: 123KB - Virtual size: 122KB

.rdata Size: 19KB - Virtual size: 18KB

.data Size: 131KB - Virtual size: 137KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 123KB - Virtual size: 122KB

.rdata
Size: 19KB - Virtual size: 18KB

.data
Size: 131KB - Virtual size: 137KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 8KB - Virtual size: 8KB