40ab12943c99591bd7456cd5370ef686_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

40ab12943c99591bd7456cd5370ef686_JaffaCakes118
Size

225KB
MD5

40ab12943c99591bd7456cd5370ef686
SHA1

5955b0d75735ec1c4920d7ea5b3134c7c508a919
SHA256

cebde9d8582382077d8b9bf8a6d54cf6bf7a31ae54e53acf7b95a03c2aeb0746
SHA512

eaea574327125af7d73f07ca57c989a6843021ae816f82ac46352acd8cdc155b80274c19bea51b6a178dc21e5c2aec2fd33c77af34be9a9ff369fa67beaed766
SSDEEP

3072:PhWEtyAlOZyreEwKKoeCX8l3CWMYpkvhCQtGvU4a45nliV6SWE:wEEA9rEdZ3zMYavhCQtGvcy8V6SV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40ab12943c99591bd7456cd5370ef686_JaffaCakes118

Files

40ab12943c99591bd7456cd5370ef686_JaffaCakes118
.exe windows:5 windows x86 arch:x86

06c98d0123e76992c570e0c00bbfd541

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcessId
OpenProcess
MoveFileA
DeleteFileA
GetModuleFileNameA
GetCommandLineA
Sleep
GetLocalTime
MultiByteToWideChar
GetTickCount
GetCurrentThreadId
lstrlenW
lstrcmpiA
WideCharToMultiByte
RaiseException
FlushInstructionCache
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcmpA
MulDiv
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
DeleteCriticalSection
SetEvent
InterlockedDecrement
InitializeCriticalSection
IsProcessorFeaturePresent
InterlockedCompareExchange
ReadFile
GetProcessHeap
SetEndOfFile
LoadLibraryA
GetTempPathA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSectionAndSpinCount
CreateFileA
SetFilePointer
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
GetStdHandle
VirtualFree
HeapCreate
ExitProcess
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetConsoleMode
GetConsoleCP
WriteFile
GetStartupInfoA
HeapFree
CreateDirectoryA
RemoveDirectoryA
CreateMutexA
ExpandEnvironmentStringsA
lstrcpyA
lstrcatA
lstrlenA
GetFileAttributesExA
GetModuleHandleA
DuplicateHandle
GetCurrentProcess
GetExitCodeProcess
GetProcAddress
CreateRemoteThread
GetLastError
CloseHandle
SetLastError
WaitForSingleObject
CreateThread
RtlUnwind
ExitThread
HeapAlloc
HeapReAlloc
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
VirtualProtect
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
ResumeThread

user32

SetLayeredWindowAttributes
SetWindowPos
MessageBoxA
wsprintfA
LoadBitmapA
FillRect
ClientToScreen
BringWindowToTop
PeekMessageA
TranslateMessage
DispatchMessageA
SetWindowLongA
IsWindowVisible
MoveWindow
IsWindow
GetWindowRect
GetFocus
WindowFromPoint
GetForegroundWindow
GetCursorPos
GetWindowThreadProcessId
AttachThreadInput
FindWindowExA
DefWindowProcA
ShowWindow
GetWindowLongA
PostThreadMessageA
DestroyWindow
GetDlgItem
InvalidateRgn
InvalidateRect
SetCapture
ReleaseCapture
ScreenToClient
CreateAcceleratorTableA
GetDC
GetDesktopWindow
ReleaseDC
CharNextA
GetParent
GetClassNameA
RedrawWindow
IsChild
SetFocus
GetWindow
GetSysColor
DestroyAcceleratorTable
SendMessageA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
RegisterWindowMessageA
GetClassInfoExA
LoadCursorA
RegisterClassExA
EndPaint
BeginPaint
GetClientRect
CallWindowProcA
CreateWindowExA
UnregisterClassA

gdi32

CreateSolidBrush
DeleteObject
CreateCompatibleBitmap
GetStockObject
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
GetObjectA
GetDeviceCaps

advapi32

RegDeleteValueA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA

shell32

ShellExecuteA

ole32

CoUninitialize
CoInitialize
OleLockRunning
CoTaskMemAlloc
StringFromGUID2
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoInitializeEx
CoCreateInstance

oleaut32

VariantClear
VariantInit
SysFreeString
LoadRegTypeLi
LoadTypeLi
SysStringLen
DispCallFunc
SysAllocString
SysAllocStringLen
OleCreateFontIndirect

shlwapi

PathGetArgsA
StrStrIW
StrToIntA
UrlUnescapeA
PathIsDirectoryA
PathRemoveBlanksA
PathRemoveFileSpecA
PathFindFileNameA
PathFileExistsA

ws2_32

htons
ioctlsocket
connect
select
__WSAFDIsSet
closesocket
send
recv
gethostbyname
WSAStartup
socket

netapi32

Netbios

psapi

EnumProcesses
GetModuleFileNameExA

Sections

.text
Size: 154KB - Virtual size: 154KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

06c98d0123e76992c570e0c00bbfd541

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

netapi32

psapi

Sections

.text Size: 154KB - Virtual size: 154KB

.rdata Size: 42KB - Virtual size: 41KB

.data Size: 8KB - Virtual size: 16KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 17KB - Virtual size: 16KB

.text
Size: 154KB - Virtual size: 154KB

.rdata
Size: 42KB - Virtual size: 41KB

.data
Size: 8KB - Virtual size: 16KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 17KB - Virtual size: 16KB