4014c9af8b10f81dc015144d6e76a117_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4014c9af8b10f81dc015144d6e76a117_JaffaCakes118
Size

983KB
MD5

4014c9af8b10f81dc015144d6e76a117
SHA1

75c7f0239993d733264f756c7df7deb9911bb582
SHA256

d8a6fe647efcc669652bae70c1529811b64341bf0af80a1ede23d4fffd2c19e2
SHA512

f6dc20705bb1e1aa1017d495564a8f709792c43c0676f5f1216d9121f593ed949650d690903b448d993a5bd9003a240814807501cedc3f70407107ea7a05727a
SSDEEP

24576:Vc/OaWgwNjxt10Q7+UbNDLmVeqOnlN1vd0fKc2/PgqN:ioDUVaNifP2n7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4014c9af8b10f81dc015144d6e76a117_JaffaCakes118

Files

4014c9af8b10f81dc015144d6e76a117_JaffaCakes118
.exe windows:5 windows x86 arch:x86

849b2e4aa6159111e5cbd6f1deef9bd8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ILGetSize
ILGetSize
DragQueryFileW
SHGetPathFromIDListW
SHGetFileInfoW
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
SHGetDesktopFolder
SHBrowseForFolderW
ShellExecuteExW
DragAcceptFiles
SHBindToParent
ShellExecuteW
SHGetMalloc
SHFileOperationW

user32

EndDialog
SetCursor
wsprintfW
LoadIconW
IsRectEmpty
wsprintfA
RegisterHotKey
AdjustWindowRectEx
WindowFromPoint
ScreenToClient
LockWindowUpdate
DrawIconEx
DestroyMenu
GetClassInfoW
GetComboBoxInfo
FindWindowExW
SetActiveWindow
OffsetRect
IsClipboardFormatAvailable
GetWindowDC
CloseClipboard
MoveWindow
SendMessageTimeoutW
SetDlgItemTextW
wvsprintfA
GetCursorPos
CheckDlgButton
LoadCursorW
IsZoomed
SetWindowLongW
GetActiveWindow
UpdateLayeredWindow
SetClassLongW
ShowWindow
SetWindowTextW
GetMenu
EnableWindow
EqualRect
MapDialogRect
IsWindowEnabled
SetRectEmpty
OpenClipboard
DestroyIcon
GetClipboardData
GetDlgItemTextW

winmm

mmioClose
mciSendCommandA
mciGetErrorStringW
timeGetTime
mmioOpenW
mmioDescend

gdiplus

GdipCreateHBITMAPFromBitmap
GdipCloneImage
GdipDrawImageRectRect
GdipLoadImageFromFileICM
GdipCreateFromHDC
GdipDeleteGraphics
GdipGetImageWidth
GdipAlloc
GdipFree
GdipGetImageBounds
GdipBitmapGetPixel
GdiplusShutdown
GdipImageRotateFlip
GdiplusStartup
GdipGetImageHeight
GdipGetImageThumbnail
GdipLoadImageFromFile
GdipDisposeImage

shlwapi

PathIsDirectoryW
PathRemoveFileSpecA
PathFileExistsW
PathRemoveFileSpecW
PathCompactPathW
StrStrIW
PathRenameExtensionW
PathIsRelativeW
PathFindExtensionW
StrCmpIW
PathIsRootW
PathAddBackslashW
PathAppendW
PathAppendA
PathFindFileNameW
PathAddExtensionW
PathRemoveExtensionW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

kernel32

GlobalUnlock
GetLocaleInfoW
LeaveCriticalSection
OutputDebugStringW
GlobalLock
GetDiskFreeSpaceExW
SetEvent
lstrlenA
GetModuleFileNameA
Thread32Next
GetLastError
lstrcpyW
FindFirstFileW
LoadLibraryW
GetSystemTime
GetNumberFormatW
GetFileAttributesW
CreateDirectoryW
GetVolumeInformationW
GetTempFileNameW
CreateMutexW
FormatMessageW
CopyFileW
OpenProcess
FindNextFileW
LocalFree
SetFileAttributesW
GetCurrentProcessId
ResetEvent
Sleep
SetFilePointer
FindClose
GlobalFree
CreateEventW
Thread32First
WideCharToMultiByte
GlobalAlloc
EnterCriticalSection
FileTimeToSystemTime
FileTimeToLocalFileTime
FlushFileBuffers
ReleaseMutex
GetVersion
GetPrivateProfileStringW
Process32NextW

comdlg32

CommDlgExtendedError
ChooseFontW
GetFileTitleW
ChooseColorW

advapi32

RegisterEventSourceW
CryptDestroyHash
RegOpenKeyExW
AdjustTokenPrivileges
CryptEncrypt
GetTokenInformation
AllocateAndInitializeSid
RegCreateKeyExA
GetUserNameA
RegSetValueExA
RegCloseKey
RegQueryInfoKeyW
RegEnumValueW
RegQueryValueExA
CryptDeriveKey
CryptHashData
FreeSid
RegQueryValueExW
OpenProcessToken
CryptDestroyKey
RegDeleteKeyW
CryptDecrypt
CryptAcquireContextW
EqualSid
RegEnumKeyExW
ReportEventW
RegCreateKeyExW
LookupPrivilegeValueW
CryptReleaseContext
RegSetValueExW
CryptCreateHash

gdi32

RectVisible
SelectObject
GetDeviceCaps
Rectangle
CreateSolidBrush
CreateCompatibleBitmap
GetObjectW
ExtTextOutW
CreateFontIndirectW
StretchBlt
GetTextExtentPoint32W
CreateBitmap
DeleteDC
CreateCompatibleDC
DeleteObject
TextOutW
PtVisible
CreatePen
BitBlt
Escape

msimg32

AlphaBlend

avifil32

AVIStreamRead
AVIStreamReadFormat
AVIStreamInfoW
AVIFileGetStream
AVIFileOpenW
AVIFileExit
AVIFileRelease
AVIFileInit
AVIStreamRelease

ole32

ReleaseStgMedium
GetRunningObjectTable
CoInitializeSecurity
CoInitialize
OleInitialize
CoCreateInstance
CoTaskMemFree
CoUninitialize
StringFromGUID2
CoSetProxyBlanket
CoTaskMemAlloc
CoGetObject
CreateClassMoniker
OleUninitialize

comctl32

ImageList_DragMove
FlatSB_GetScrollInfo
ImageList_DragEnter
ImageList_BeginDrag
ImageList_GetIcon
ImageList_GetIconSize
ImageList_Replace
ImageList_SetBkColor
ImageList_EndDrag
ImageList_DragLeave
ImageList_AddMasked
_TrackMouseEvent
ImageList_Draw
ImageList_ReplaceIcon

Sections

.text
Size: 623KB - Virtual size: 623KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 319KB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

849b2e4aa6159111e5cbd6f1deef9bd8

Headers

File Characteristics

Imports

shell32

user32

winmm

gdiplus

shlwapi

version

kernel32

comdlg32

advapi32

gdi32

msimg32

avifil32

ole32

comctl32

Sections

.text Size: 623KB - Virtual size: 623KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 319KB - Virtual size: 3.6MB

.rsrc Size: 32KB - Virtual size: 31KB

.text
Size: 623KB - Virtual size: 623KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 319KB - Virtual size: 3.6MB

.rsrc
Size: 32KB - Virtual size: 31KB