52fbd9cf71f2fc67675902982cfcb7d1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

52fbd9cf71f2fc67675902982cfcb7d1_JaffaCakes118
Size

853KB
MD5

52fbd9cf71f2fc67675902982cfcb7d1
SHA1

c55b683ce8e9acf832c00c1323d3c13df12c4784
SHA256

52dee2ffe2c4e0cacd834d3b035b645ad6454a041dc1bc82d5580c2ae0cd33ef
SHA512

af01106d2202138f84ba544cfb6c0ed7f3e422ab9cec5228f5714f500a72d84352bddf2251a58daf9742f5818fbd53632925b8a54162c56b0413452197f231f3
SSDEEP

24576:CsvVZKzGFi3LmZPgDcny89cWI1uBYzKv1mPitQ:CstW3aPgDoJBYzgw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
52fbd9cf71f2fc67675902982cfcb7d1_JaffaCakes118

Files

52fbd9cf71f2fc67675902982cfcb7d1_JaffaCakes118
.exe windows:5 windows x86 arch:x86

368908feefa0aa1ba4668affa866b84d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

M:\TWRK\a234a9b605bf94fa\src\MicrogamingInstall\Release\MicrogamingInstall.pdb

Imports

kernel32

MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
WideCharToMultiByte
OutputDebugStringA
CreateProcessW
WaitForSingleObject
OpenProcess
Sleep
CreateProcessA
lstrcmpiA
RemoveDirectoryA
CopyFileA
GetTempFileNameA
GetCurrentProcessId
GetTempPathA
DeleteFileA
GetComputerNameA
FormatMessageA
GetVolumePathNameW
CopyFileW
FormatMessageW
RemoveDirectoryW
GetModuleHandleA
ReleaseMutex
GetDiskFreeSpaceExA
GetVersionExA
DeleteFileW
SetFileAttributesW
SetEvent
GetPrivateProfileStringW
CreateEventA
LoadLibraryA
CreateMutexA
GetDriveTypeA
GetVolumeInformationA
DeviceIoControl
InterlockedDecrement
MoveFileExA
Process32First
TerminateProcess
GetSystemDirectoryA
GetLocalTime
Process32Next
CreateToolhelp32Snapshot
InterlockedIncrement
GetPrivateProfileIntA
InterlockedExchange
GetExitCodeThread
WaitForMultipleObjects
GetCurrentThreadId
CreateThread
CreateSemaphoreA
ReleaseSemaphore
GetLogicalDriveStringsA
GlobalMemoryStatusEx
GetSystemInfo
GetEnvironmentVariableA
SetThreadPriority
GetCurrentThread
lstrcpyA
ResumeThread
InterlockedCompareExchange
QueueUserWorkItem
OpenFileMappingA
lstrcatA
CompareStringW
GetProcessHeap
SetEndOfFile
SetStdHandle
GetStringTypeW
HeapSize
FlushFileBuffers
GetConsoleMode
GetConsoleCP
IsProcessorFeaturePresent
GetCurrentDirectoryW
PeekNamedPipe
GetFileInformationByHandle
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetHandleCount
LCMapStringW
GetTimeZoneInformation
GetCurrentProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapCreate
GetStdHandle
GetFileType
WriteConsoleW
MoveFileA
RaiseException
RtlUnwind
GetFullPathNameA
GetDriveTypeW
SetCurrentDirectoryA
GetCurrentDirectoryA
SetEnvironmentVariableA
FindFirstFileExA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetStartupInfoW
HeapSetInformation
FindNextFileA
GetModuleFileNameA
FindClose
FindFirstFileA
CreateDirectoryA
GetModuleFileNameW
lstrlenW
GetFileAttributesW
lstrcpynW
GetFileAttributesA
lstrcpynA
CreateFileA
lstrlenA
GetFileSize
LocalFree
GetProcAddress
MultiByteToWideChar
CreateFileW
LoadLibraryW
CreateDirectoryW
FreeLibrary
CloseHandle
GetLastError
ReadFile
WriteFile
SetFilePointer
GetThreadTimes
GetCommandLineA
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
ExitThread
GetSystemTimeAsFileTime
ExitProcess
GetModuleHandleW
EncodePointer
DecodePointer
HeapAlloc
HeapFree
SetFileAttributesA

user32

PostMessageA
RegisterClassA
ShowWindow
DefWindowProcA
CreateWindowExA
FlashWindowEx
MoveWindow
DefWindowProcW
SetWindowTextA
LoadCursorA
AdjustWindowRect
EnableWindow
UpdateWindow
MapWindowPoints
LoadImageA
IsWindowVisible
GetSystemMetrics
RegisterClassW
MessageBoxW
MessageBoxA
SetFocus
CopyRect
wsprintfW
InvalidateRect
GetDlgCtrlID
GetActiveWindow
DispatchMessageA
CreateWindowExW
CreatePopupMenu
SetLayeredWindowAttributes
GetCursorPos
SetWindowPos
SetWindowLongW
ReleaseDC
PeekMessageA
AppendMenuW
GetWindowLongW
SetWindowLongA
OffsetRect
ChildWindowFromPoint
TranslateMessage
IsDialogMessageA
SendMessageA
GetClientRect
IsWindowEnabled
LoadIconA
SetForegroundWindow
PostThreadMessageA
wsprintfA
wvsprintfA
SendMessageTimeoutA
DestroyWindow
GetMessageA
GetWindowRect
TrackPopupMenu
GetWindowDC

gdi32

DeleteDC
CreateDIBSection
GetDIBits
DeleteObject
SelectObject
CreateCompatibleDC
GetStockObject
BitBlt

advapi32

RegCreateKeyExA
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyW
OpenSCManagerA
CloseServiceHandle
OpenServiceA
RegSetValueExW
RegQueryValueExW
RegSetValueW
RegSetValueA
RegQueryValueW
RegCloseKey
GetUserNameA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
FreeSid
SetEntriesInAclW

shell32

Shell_NotifyIconA
SHGetSpecialFolderLocation
ShellExecuteA
SHGetPathFromIDListW
SHGetFolderPathW
SHGetMalloc
SHChangeNotify
SHGetSpecialFolderPathA

ole32

OleInitialize
OleCreate
OleSetContainedObject
StringFromIID
OleUninitialize
CoCreateInstance
CoCreateGuid
CoTaskMemAlloc
CoSetProxyBlanket
CoUninitialize
CoInitialize
CoTaskMemFree
CLSIDFromProgID

oleaut32

VariantTimeToSystemTime
VariantCopy
VariantChangeType
SysStringLen
SafeArrayUnaccessData
VariantInit
SafeArrayAccessData
SysAllocString
SysAllocStringLen
SysFreeString
VariantClear
SafeArrayCreateVector

wsock32

gethostbyname
gethostbyaddr
inet_addr
ioctlsocket
WSACleanup
htonl
WSAGetLastError
htons
ntohs
getservbyport
getservbyname
WSASetLastError
WSAStartup

wininet

InternetCreateUrlA
InternetOpenW
InternetOpenUrlW
InternetReadFile
InternetConnectA
InternetGetLastResponseInfoA
InternetCrackUrlW
HttpSendRequestA
HttpQueryInfoA
InternetOpenUrlA
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpOpenRequestA
InternetSetOptionA
InternetCrackUrlA

shlwapi

PathAppendA
SHDeleteKeyA
PathCanonicalizeW
PathAppendW
StrStrA
PathCanonicalizeA

psapi

GetModuleFileNameExA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

ws2_32

WSAAddressToStringA

urlmon

CoInternetGetSession

Exports

Exports

?CreateDefaultBrowserInfo@@YGPAVIDefaultBrowserInfo@@XZ
?CreateDirectXVersionInfo@@YGPAVIDirectXVersionInfo@@XZ
?CreateDisplaysDeviceInfo@@YGPAVIDisplayDevicesInfo@@XZ
?CreateFixedDriveInfo@@YGPAVIFixedDriveInfo@@XZ
?CreateFixedDrivesInfo@@YGPAVIFixedDrivesInfo@@XZ
?CreateFlashInfo@@YGPAVIFlashInfo@@XZ
?CreateIEVersionInfo@@YGPAVIIEVersionInfo@@XZ
?CreateMacAddress@@YGPAVIMacAddress@@XZ
?CreateMachineInfo@@YGPAVIMachineInfo@@XZ
?CreateMachineInfoXML@@YGPAVIMachineInfoXML@@XZ
?CreateOSInfo@@YGPAVIOSInfo@@XZ
?CreateProcessorsInfo@@YGPAVIProcessorsInfo@@XZ
?CreateRamInfo@@YGPAVIRamInfo@@XZ
?CreateSoundDevicesInfo@@YGPAVISoundDevicesInfo@@XZ
?CreateUserExperience@@YGPAVIUserExperience@@XZ
?CreateVMInfo@@YGPAVIVMInfo@@XZ

Sections

.text
Size: 414KB - Virtual size: 413KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 75KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

368908feefa0aa1ba4668affa866b84d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wsock32

wininet

shlwapi

psapi

version

ws2_32

urlmon

Exports

Exports

Sections

.text Size: 414KB - Virtual size: 413KB

.rdata Size: 62KB - Virtual size: 61KB

.data Size: 75KB - Virtual size: 93KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 414KB - Virtual size: 413KB

.rdata
Size: 62KB - Virtual size: 61KB

.data
Size: 75KB - Virtual size: 93KB

.rsrc
Size: 4KB - Virtual size: 3KB