39facac00aa78d04d999f16cf0437e56_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

39facac00aa78d04d999f16cf0437e56_JaffaCakes118
Size

88KB
MD5

39facac00aa78d04d999f16cf0437e56
SHA1

c2500de3afc31d000c7ec9c47f110804ac455ca3
SHA256

b696ceecb715e0dd70fe817d268727cf2c8a681ea770d482a0c399a01fd78bad
SHA512

aa720cc7281ec850dafdcc8b74222c0c49a2d64f6cf0e228e20322848d2f12c64e0582c409f4a27b45906c77120f1895398ae737e14e44f4c30953e1d058d3cf
SSDEEP

1536:SS21G80qtGGZKZE9cc0Z+N2ez+BLlTiUL8dKVLyQCFKJJ+M3omLkjzhJmq:FJ8VtGxZXc1N3KBLx/8Akd0J+wInhn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
39facac00aa78d04d999f16cf0437e56_JaffaCakes118

Files

39facac00aa78d04d999f16cf0437e56_JaffaCakes118
.exe windows:5 windows x86 arch:x86

4d5697d360399b4f1f3f82238287f7f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

UnregisterDeviceNotification
GetKeyState
PostQuitMessage
SetRectEmpty
GetLastInputInfo
GetClassNameW
RegisterRawInputDevices
CallNextHookEx
SetWindowPlacement
EnableMenuItem
SetWindowsHookExW
RegisterWindowMessageW
UnionRect
wsprintfW
DialogBoxParamW
UpdateWindow
GetCursorPos
GetGUIThreadInfo
GetDesktopWindow
ShowCursor
CopyRect
IsChild
SystemParametersInfoA
MoveWindow
SetWindowRgn
UnregisterClassW
GetCapture
SetScrollPos
MapWindowPoints
CloseWindow
CharLowerW
OffsetRect
SetWindowTextW
LoadIconW
DestroyCursor
GetSysColor
SetForegroundWindow
InflateRect
GetWindowDC
GetRawInputData
ShowScrollBar
RegisterClassExW
DispatchMessageW
SetTimer
RegisterClassW
CallWindowProcW
CreateWindowExW
InvalidateRect
GetWindowRect
LoadStringW
GetClassInfoW
UnregisterHotKey
RegisterHotKey
OpenClipboard
GetForegroundWindow
SetDlgItemTextW
AttachThreadInput
SetParent
GetActiveWindow
FlashWindow
GetClientRect
IntersectRect
GetAsyncKeyState
DefDlgProcW
GetFocus
SetFocus
SetClipboardData
ScreenToClient
MsgWaitForMultipleObjectsEx
GetSysColorBrush
SetCursorPos
BringWindowToTop
GetSystemMenu
CharPrevW
GetClipboardViewer
AdjustWindowRect
SystemParametersInfoW
CreateIconIndirect
MonitorFromWindow
GetKeyboardState
IsDlgButtonChecked
ReleaseDC
CountClipboardFormats
GetWindowThreadProcessId
GetWindowLongW
GetKeyboardLayoutNameW
LoadCursorW
CheckDlgButton
PostThreadMessageW
IsWindow
SetActiveWindow
SetClipboardViewer
IsWindowVisible
SendMessageW
ShowWindow
KillTimer
EndPaint
CreateCursor
ChangeClipboardChain
GetMessageW
GetLastActivePopup
EnableWindow
DestroyWindow
CloseClipboard
MapVirtualKeyW
SetCursor
SetScrollInfo
GetWindowPlacement
GetWindowTextW
EndDeferWindowPos
RegisterDeviceNotificationW
FindWindowExW
EmptyClipboard
GetClipboardFormatNameW
GetWindow
DestroyAcceleratorTable
RegisterClipboardFormatW
PtInRect
CharNextW
LockWindowUpdate
SetCapture
DrawTextW
GetDC
RedrawWindow
GetClipboardData
SetRect
FindWindowW
EndDialog
LoadImageW
EnumClipboardFormats
SetWindowLongW
CreateDialogParamW
SetWindowPos
DrawIconEx
MessageBeep
GetKeyboardLayout
UnhookWindowsHookEx
IsClipboardFormatAvailable
keybd_event
IsIconic
DefWindowProcW
GetMessageExtraInfo
DeferWindowPos
BeginDeferWindowPos
IsZoomed
GetClassInfoExW
GetKeyboardType
GetSystemMetrics
SendInput
FillRect
IsWindowEnabled
PeekMessageW
BeginPaint
CopyIcon
PostMessageW
ClientToScreen
GetDlgItem
GetParent
GetKeyboardLayoutNameA
EqualRect
DestroyIcon
GetMonitorInfoW
ReleaseCapture

ws2_32

WSANSPIoctl
WSALookupServiceNextW
WSAIoctl
WSALookupServiceBeginW
WSALookupServiceEnd
freeaddrinfo
getaddrinfo

samlib

SamAddMemberToAlias

credui

CredUIParseUserNameW
CredUIPromptForCredentialsW

wtsapi32

WTSUnRegisterSessionNotification
WTSRegisterSessionNotification

kernel32

SizeofResource
CreateThread
CreateMutexW
GetComputerNameA
LeaveCriticalSection
SetCommTimeouts
WriteFile
lstrlenW
GetCommMask
FreeLibraryAndExitThread
GetTickCount
WaitForMultipleObjects
lstrcmpW
GlobalAlloc
UnlockFile
GetVersionExA
SetCommMask
DisableThreadLibraryCalls
SetCommState
VerifyVersionInfoW
GetVersionExW
GetProcAddress
UnmapViewOfFile
ResumeThread
MoveFileW
DeleteFileW
GetVersion
lstrcpynW
Sleep
GetFileAttributesExW
MapViewOfFile
FindFirstFileW
GetSystemDefaultLangID
GetComputerNameW
GetModuleHandleA
GetFileInformationByHandle
OutputDebugStringA
FindNextChangeNotification
TransmitCommChar
ResetEvent
GetTimeZoneInformation
WaitForMultipleObjectsEx
SearchPathW
GlobalAddAtomW
TerminateProcess
TlsAlloc
BindIoCompletionCallback
SetupComm
GetSystemDirectoryW
SetFileTime
ExpandEnvironmentStringsW
CloseHandle
GetLastError
SetFileAttributesW
FindCloseChangeNotification
WaitCommEvent
GetCommTimeouts
GetCurrentThreadId
GetProcessHeap
LocalAlloc
TlsFree
CreateDirectoryW
VirtualProtect
QueryDosDeviceW
lstrcmpiW
GetCurrentProcessId
GlobalHandle
GetACP
DeviceIoControl
ReadFile
GlobalLock
CreateSemaphoreW
VirtualQuery
VirtualAlloc
SetLastError
ClearCommError
MultiByteToWideChar
GetCommConfig
LockResource
EscapeCommFunction
LoadResource
InterlockedCompareExchange
WaitForSingleObject
CreateEventW
InterlockedDecrement
GlobalSize
GetLocaleInfoW
lstrcmpiA
GetCommProperties
RaiseException
CancelIo
DeleteCriticalSection
HeapFree
LoadLibraryW
InterlockedExchange
InitializeCriticalSection
GetCommState
GetSystemTime
InterlockedIncrement
SetEvent
GetUserDefaultUILanguage
GlobalUnlock
GetSystemTimeAsFileTime
RemoveDirectoryW
FindResourceW
GetTempPathW
UnhandledExceptionFilter
DuplicateHandle
GetOverlappedResult
CreateProcessW
FormatMessageW
GlobalFree
GetProfileStringW
DebugBreak
FindClose
OpenThread
lstrcmpA
CreateFileMappingW
lstrlenA
GetFileSize
GetFullPathNameW
GetDiskFreeSpaceW
GetCurrentProcess
MulDiv
VirtualFree
CreateFileW
GetDriveTypeW
LocalFree
GetModuleHandleExW
ReleaseSemaphore
SystemTimeToFileTime
FindNextFileW
GetSystemInfo
LoadLibraryExW
GetDefaultCommConfigW
LockFileEx
FreeLibrary
GetModuleFileNameW
EnterCriticalSection
PurgeComm
HeapDestroy
WideCharToMultiByte
Beep
GetModuleHandleW
SetUnhandledExceptionFilter
GetSystemDefaultUILanguage
lstrcatW
OutputDebugStringW
GlobalDeleteAtom
QueueUserWorkItem
SetErrorMode
SetFilePointer
lstrcpyW
FindFirstChangeNotificationW
TlsSetValue
FindResourceExW
LoadLibraryA
GetCommModemStatus
GetVolumeInformationW
LockFile
GetTempFileNameW
FreeResource
HeapAlloc
QueryPerformanceCounter
SetEndOfFile
GetFileAttributesW
TlsGetValue
FlushFileBuffers
FlushInstructionCache
GetSystemDirectoryA

advapi32

RegQueryValueExW
CryptReleaseContext
RegEnumKeyExW
CredWriteW
GetTraceLoggerHandle
RegCreateKeyW
RegQueryInfoKeyW
RegOpenKeyW
GetUserNameW
CredDeleteW
RegSetValueExA
RegQueryInfoKeyA
RegSetValueExW
RegisterTraceGuidsW
CryptAcquireContextW
RegDeleteKeyW
SetFileSecurityW
CredReadW
GetTraceEnableLevel
RegDeleteValueW
RegOpenKeyExW
RegOpenKeyExA
CredUnmarshalCredentialW
RegConnectRegistryW
GetSecurityDescriptorLength
CryptGenRandom
CredFree
RegDeleteValueA
RegCreateKeyExA
CredWriteDomainCredentialsW
GetUserNameA
CredReadDomainCredentialsW
UnregisterTraceGuids
RegEnumValueW
RegOpenKeyA
TraceMessage
CredGetSessionTypes
RegCloseKey
RegQueryValueExA
GetTraceEnableFlags
RegFlushKey
RegEnumKeyExA
GetFileSecurityW
RegCreateKeyExW

urlmon

CopyStgMedium

ntdll

RtlInitializeCriticalSection
NtWriteFile
NtDeviceIoControlFile
NtAllocateVirtualMemory
RtlDeleteResource
RtlClearBits
RtlFindClearBitsAndSet
RtlLookupElementGenericTable
RtlAreBitsSet
RtlAcquireResourceShared
NtOpenFile
RtlReleaseResource
VerSetConditionMask
RtlUnwind
RtlInsertElementGenericTable
RtlEnumerateGenericTable
RtlInitUnicodeString
RtlInitializeBitMap
RtlGetLastNtStatus
RtlDeleteElementGenericTable
RtlInitializeGenericTable
NtReadFile
RtlAcquireResourceExclusive
RtlInitializeResource

shell32

SHAppBarMessage
DragQueryFileW
Shell_NotifyIconW
ExtractIconW
SHFileOperationW

wininet

InternetGetCookieW

msimg32

GradientFill

netapi32

NetApiBufferFree
NetGetJoinInformation

gdi32

GetMetaFileBitsEx
SetMetaFileBitsEx
StretchBlt
CreateBitmap
CreateBrushIndirect
RealizePalette
DeleteObject
PatBlt
PlayMetaFile
CreateMetaFileW
GetCurrentObject
OffsetClipRgn
GetStockObject
LPtoDP
SetBkMode
CreateDIBitmap
SetTextColor
CreateDCW
CreateRectRgn
DeleteMetaFile
Rectangle
GetNearestPaletteIndex
SetROP2
CreateDIBSection
GetNearestColor
Polygon
CreatePatternBrush
SelectClipRgn
BitBlt
CreatePolygonRgn
GetTextExtentPointW
CreateSolidBrush
GetDIBColorTable
SetWindowOrgEx
GetBrushOrgEx
CreatePen
SetViewportOrgEx
ExtSelectClipRgn
CreateCompatibleDC
SetDCBrushColor
GdiDrawStream
GetTextAlign
FrameRgn
SaveDC
SetTextAlign
GetMapMode
RestoreDC
SelectPalette
DeleteDC
GdiFlush
CreateDIBPatternBrushPt
StretchDIBits
GetDeviceCaps
CombineRgn
SetDIBColorTable
CreateCompatibleBitmap
FillRgn
LineTo
SetWindowExtEx
GetPaletteEntries
GetObjectW
MoveToEx
SetStretchBltMode
GetClipBox
SetBkColor
SetBrushOrgEx
Ellipse
SelectObject
CreatePalette
CreateRectRgnIndirect
SetPolyFillMode
OffsetRgn
CreateFontIndirectW
GetRgnBox
SetBitmapBits
SetRectRgn
CloseMetaFile
GetBkMode
DPtoLP
SetMapMode
UpdateColors

secur32

FreeContextBuffer
QueryContextAttributesW
DeleteSecurityContext
InitializeSecurityContextW
GetUserNameExW
EncryptMessage
AcquireCredentialsHandleW
DecryptMessage
FreeCredentialsHandle
QuerySecurityPackageInfoW

ole32

OleGetClipboard
CreateOleAdviseHolder
OleUninitialize
CoInitialize
OleInitialize
OleLoadFromStream
StringFromCLSID
CoTaskMemFree
WriteClassStm
CoInitializeEx
CoUninitialize
OleIsCurrentClipboard
CoGetMalloc
CLSIDFromString
OleRegGetMiscStatus
CoCreateInstance
OleRegEnumVerbs
CoTaskMemRealloc
OleSetClipboard
OleSaveToStream
CreateDataAdviseHolder
OleRegGetUserType
ReleaseStgMedium
CoTaskMemAlloc

rpcrt4

MesEncodeDynBufferHandleCreate
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Connect
NdrMesTypeEncode2
MesDecodeBufferHandleCreate
NdrDllGetClassObject
IUnknown_Release_Proxy
NdrMesTypeFree2
NdrOleFree
CStdStubBuffer_Disconnect
CStdStubBuffer_CountRefs
NdrMesTypeDecode2
NdrDllUnregisterProxy
IUnknown_QueryInterface_Proxy
NdrDllRegisterProxy
MesHandleFree
CStdStubBuffer_Invoke
NdrDllCanUnloadNow
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_AddRef
NdrCStdStubBuffer_Release
CStdStubBuffer_DebugServerRelease
NdrOleAllocate

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

shlwapi

PathRemoveFileSpecW

winmm

waveOutPrepareHeader
waveOutGetVolume
waveOutClose
waveOutOpen
waveOutReset
waveOutWrite
waveOutGetPitch
waveOutUnprepareHeader
waveOutSetVolume

cryptui

CryptUIDlgViewCertificateW

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInstanceIdW
SetupDiDestroyDeviceInfoList
SetupDiOpenClassRegKeyExW
SetupDiGetClassDevsW
SetupDiOpenDevRegKey
SetupDiCreateDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceInterfaceDetailW
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDeviceInfoW

iphlpapi

GetBestInterfaceEx

msvcrt

fclose
printf
wcsrchr
malloc
_lseeki64
strncmp
_vsnprintf
ceil
_wtol
strtoul
_adjust_fdiv
_errno
_vsnwprintf
_onexit
_write
isleadbyte
_snprintf
wcsstr
iswalnum
_purecall
realloc
memmove
_XcptFilter
strchr
_itoa
__pioinfo
__mb_cur_max
free
iswdigit
memset
_isatty
strtok
time
srand
_wcsnicmp
_iob
_CxxThrowException
_strnicmp
wcschr
bsearch
isdigit
_unlock
_read
ungetc
wctomb
mbtowc
toupper
localeconv
_wcslwr
_lock
memcpy
_initterm
_fileno
_amsg_exit
_wtoi
iswctype
wcspbrk
towlower
isxdigit
calloc
_resetstkoflw
_wcsicmp
ferror
_strlwr
__dllonexit
__badioinfo
wcstombs
wcstok
_stricmp
floor
wcsncmp

crypt32

CertGetEnhancedKeyUsage
CertCloseStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CryptMsgClose
CertCreateCertificateContext
CryptVerifyDetachedMessageSignature
CertOpenStore
CryptProtectData
CertFindExtension
CertFreeCertificateContext
CryptStringToBinaryW
CertFreeCertificateChain
CryptDecodeObject
CryptBinaryToStringW
CryptMsgOpenToDecode
CryptMsgUpdate
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertCompareCertificate
CertFindCertificateInStore
CryptSignMessage
CertDuplicateCertificateChain
CertVerifySubjectCertificateContext
CertAddCertificateContextToStore
CertGetNameStringW

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 292KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4d5697d360399b4f1f3f82238287f7f8

Headers

DLL Characteristics

File Characteristics

Imports

user32

ws2_32

samlib

credui

wtsapi32

kernel32

advapi32

urlmon

ntdll

shell32

wininet

msimg32

netapi32

gdi32

secur32

ole32

rpcrt4

version

shlwapi

winmm

cryptui

setupapi

iphlpapi

msvcrt

crypt32

Sections

.text Size: 19KB - Virtual size: 19KB

.data Size: 292KB - Virtual size: 1.4MB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 24KB - Virtual size: 24KB

.rdata Size: 3KB - Virtual size: 3KB

.text
Size: 19KB - Virtual size: 19KB

.data
Size: 292KB - Virtual size: 1.4MB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 24KB - Virtual size: 24KB

.rdata
Size: 3KB - Virtual size: 3KB