3b7964b2c990ac4946f8dba9e58524d5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3b7964b2c990ac4946f8dba9e58524d5_JaffaCakes118
Size

272KB
MD5

3b7964b2c990ac4946f8dba9e58524d5
SHA1

f86b901f0e02b6221e23dba21b7d7f1a2aedab3f
SHA256

0aa7776070fa80d74ee0b75b37817e1f453a5ab577e1554798b31e2066a3dd34
SHA512

5d6a5b316f0314cfc721c45930a65665ab5004b22a06fc0c537a6bb6401f1948b38912ca0f1b7d9bc5850aee0990d54a96b075fb2e7a5efe443a8a89f5ce7c48
SSDEEP

6144:f/a2zYXuG6TpNpj6JRuJ8g9kJd0nWLWI:3a2zYp06aFfnWLW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b7964b2c990ac4946f8dba9e58524d5_JaffaCakes118

Files

3b7964b2c990ac4946f8dba9e58524d5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e896d62304f0d51b46b66cb9794b6063

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHFileOperationA

shlwapi

PathIsUNCA
PathIsRelativeW
PathFindExtensionA

kernel32

GlobalFree
SetFilePointerEx
CreateDirectoryA
OutputDebugStringA
GlobalSize
GetFullPathNameA
TlsAlloc
GetFileAttributesW
InitializeCriticalSection
MoveFileExA
IsBadCodePtr
CreateFileMappingA
UnlockFile
LoadLibraryExA
GetQueuedCompletionStatus
Beep
VirtualQueryEx
lstrcatA
WritePrivateProfileSectionA
GetLocalTime
GetLogicalDriveStringsA
HeapFree
SetThreadLocale
FlushInstructionCache
FindFirstFileA
SetStdHandle
IsDBCSLeadByteEx
Sleep
GetTimeFormatA
SystemTimeToTzSpecificLocalTime
OutputDebugStringW
WriteFile
QueryDosDeviceW
TerminateProcess
UnhandledExceptionFilter
QueryDosDeviceA
GetProcAddress
GetOEMCP
TlsSetValue
ResumeThread
EnumCalendarInfoA
FindCloseChangeNotification
GetVolumeInformationW
GlobalAlloc
FindClose
GetFileAttributesExW
FlushFileBuffers
DeviceIoControl
GetUserGeoID
IsBadWritePtr
DeleteTimerQueueTimer
SetCurrentDirectoryW
FindResourceW
LockResource
_lclose
FindNextFileW
CreateEventA
SystemTimeToFileTime
TransactNamedPipe
GetModuleFileNameW
lstrcpyA
OpenFileMappingW
GetLocaleInfoA
GetStringTypeExA
LoadResource
GetFileTime
lstrcmpW
GetPrivateProfileIntW
CreateNamedPipeA
GetProcessHeap
HeapDestroy
CompareStringW
GetStartupInfoA
GetVersion
ExitProcess
GetCurrentThreadId
SetLastError
TlsGetValue
GetLastError
RtlUnwind
GetCurrentProcess
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapCreate
VirtualFree
InterlockedDecrement
InterlockedIncrement
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
HeapReAlloc
LoadLibraryA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
CreateEventW
ExpandEnvironmentStringsW
SearchPathA
SetEndOfFile
GetDiskFreeSpaceW
GetLogicalDrives
CreateSemaphoreW
GetFileInformationByHandle
SetFilePointer
SetFileTime
ReleaseMutex
AddAtomA
_lread
GetCurrentThread
ReadFile
GetModuleHandleA
ExpandEnvironmentStringsA
GlobalFindAtomW
UnmapViewOfFile
WriteProfileStringA
lstrlenA
CreateSemaphoreA
EnumResourceNamesW
DeleteCriticalSection
GlobalGetAtomNameW
IsValidCodePage
RemoveDirectoryA
GetTempPathA
OpenFileMappingA
GetExitCodeThread
_lopen
GetEnvironmentStrings
GetProcessAffinityMask
LockFile
GetShortPathNameW
lstrcmpA
GetCommandLineA
VirtualAlloc
Process32NextW

version

GetFileVersionInfoSizeW

user32

SystemParametersInfoW
ShowScrollBar
GetMenuCheckMarkDimensions
UnionRect
GrayStringW
GetSystemMetrics
GetWindowRgn
IsZoomed
SetRect
WaitMessage
SetProcessDefaultLayout
WinHelpA
FindWindowExW
EnumWindows
SetCursor
GetMenuItemCount
EndDeferWindowPos
GetDC
ValidateRect
InvalidateRgn
DestroyCaret
ReleaseDC
DialogBoxIndirectParamW
AppendMenuW
MonitorFromPoint
PeekMessageW
GetClassNameA
SetActiveWindow
ActivateKeyboardLayout
SetTimer
EnableMenuItem
TabbedTextOutA
BeginPaint
IsCharAlphaW
GetUpdateRgn
MessageBoxW
SetPropW
InsertMenuW
ChildWindowFromPoint
LoadIconA
GetClassInfoW
GetPropA
GetMenuItemInfoW

oleaut32

RegisterTypeLi

ole32

IsAccelerator
OleInitialize
OleRegGetUserType
CoRevokeClassObject

gdi32

CreateHalftonePalette
ExtTextOutA
EnumFontFamiliesExA
EnumMetaFile
GetMetaFileBitsEx
GetObjectA
GdiFlush
StartPage
FillRgn
PtVisible
CreatePolygonRgn
DeleteEnhMetaFile
ExtTextOutW
SetROP2
GetBitmapBits
GetRegionData
GetWindowExtEx
CreateICA
ScaleWindowExtEx
Rectangle

advapi32

CheckTokenMembership
SetSecurityDescriptorOwner
RegSetValueA
RegDeleteKeyA
RegFlushKey
GetLengthSid
RegOpenKeyExA
CryptGetHashParam
RegOpenKeyA
LookupAccountNameW
CryptAcquireContextA
ImpersonateSelf
LookupAccountSidA
GetFileSecurityA
InitializeAcl
RegQueryValueA
LookupPrivilegeValueA
RegQueryValueExW
CryptAcquireContextW
GetSecurityDescriptorControl

comdlg32

GetSaveFileNameA

comctl32

ImageList_Destroy
ImageList_DragShowNolock

Sections

.text
Size: 224KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e896d62304f0d51b46b66cb9794b6063

Headers

File Characteristics

Imports

shell32

shlwapi

kernel32

version

user32

oleaut32

ole32

gdi32

advapi32

comdlg32

comctl32

Sections

.text Size: 224KB - Virtual size: 220KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 20KB - Virtual size: 20KB

.rsrc Size: 4KB - Virtual size: 2KB

.text
Size: 224KB - Virtual size: 220KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 20KB - Virtual size: 20KB

.rsrc
Size: 4KB - Virtual size: 2KB