539cdedb0063779157b92851fcd87833_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

539cdedb0063779157b92851fcd87833_JaffaCakes118
Size

2.5MB
MD5

539cdedb0063779157b92851fcd87833
SHA1

2d2f5e5511b3ff041c5d1d814e7ebc2f0703d628
SHA256

b82f0d22e0f1961824619865ee65a6fdddc76904630e32eeffe2b0e608d98e43
SHA512

20f67cae0c4d367f53ac1b9c3d54a74269f9a95a14b89528b98c74985319436d9795851959b817c831a966f101b989644c0b67922a7c98e435c6691e1e6a71c3
SSDEEP

49152:l+KPuckDwX0iyep/9VW9iH6SRPKt3T356Gyszb:dD37BKj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
539cdedb0063779157b92851fcd87833_JaffaCakes118

Files

539cdedb0063779157b92851fcd87833_JaffaCakes118
.exe windows:5 windows x86 arch:x86

fb9e417e8ee2e2c79f1a80707e0b6a55

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

getsockname
closesocket
ioctlsocket
gethostbyaddr
WSASocketA
recvfrom
WSASetLastError
gethostbyname
sendto
setsockopt
WSAAsyncSelect
htonl
WSACleanup
WSAStartup
select
__WSAFDIsSet
inet_addr
connect
WSACreateEvent
WSAEventSelect
WSAGetLastError
WSACloseEvent
WSAEnumNetworkEvents
send
accept
recv
htons
socket
bind
listen
getpeername
gethostname

ddraw

DirectDrawCreate

comctl32

InitCommonControlsEx

winmm

sndPlaySoundA

iphlpapi

GetAdaptersInfo

wintrust

WinVerifyTrust

crypt32

CertGetNameStringA
CertFreeCertificateContext
CryptDecodeObject
CryptQueryObject
CryptMsgGetParam
CertCloseStore
CryptMsgClose
CertFindCertificateInStore

kernel32

ResetEvent
FormatMessageA
GetSystemDirectoryA
DefineDosDeviceA
QueryDosDeviceA
GetPrivateProfileStringA
GetPrivateProfileIntA
GlobalUnlock
GlobalLock
SetFilePointer
FlushFileBuffers
SetEndOfFile
GetFullPathNameA
CompareStringA
GetModuleHandleW
InterlockedIncrement
InterlockedDecrement
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
GetExitCodeThread
TlsFree
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFlags
GetCurrentThreadId
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomA
GetLocaleInfoA
GetCPInfo
GetOEMCP
GetCurrentDirectoryA
RtlUnwind
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
HeapSize
GetACP
IsValidCodePage
HeapCreate
GetStdHandle
SetHandleCount
GetFileType
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
GetVersion
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetStringTypeW
GetStringTypeA
GetTimeZoneInformation
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
GetProcessHeap
GlobalFree
GlobalAlloc
WaitForMultipleObjects
SetEvent
OpenEventA
FlushViewOfFile
GetTempPathA
GetFileSize
OpenFileMappingA
CreateEventA
ReleaseMutex
GetVersionExA
InterlockedExchange
GetCurrentProcess
GetLocalTime
SetLocalTime
MoveFileA
lstrcmpA
VirtualAlloc
lstrcpyW
LocalAlloc
LocalFree
VirtualFree
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
RaiseException
CreateMutexA
Beep
SetThreadPriority
ReadFile
EscapeCommFunction
WriteFile
GetCommModemStatus
GetCommState
SetCommState
GetCommTimeouts
SetCommTimeouts
GetModuleFileNameA
CopyFileA
WaitForSingleObject
GetCurrentProcessId
SetLastError
QueryPerformanceCounter
GetLastError
QueryPerformanceFrequency
MultiByteToWideChar
lstrlenA
GetDriveTypeA
GetDiskFreeSpaceExA
FindNextFileA
GetModuleHandleA
DeleteFileA
FindFirstFileA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CloseHandle
CreateFileA
DeviceIoControl
GetTickCount
GetSystemPowerStatus
CreateThread
Sleep
ExitThread
FindClose
LoadLibraryA
GetProcAddress
FreeLibrary
WideCharToMultiByte
LoadResource
LockResource
SizeofResource
FindResourceA
FreeEnvironmentStringsA
TerminateThread
LocalReAlloc

user32

GetClassLongA
GetCapture
WinHelpA
CheckMenuItem
EnableMenuItem
ModifyMenuA
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
DestroyMenu
SetMenu
GetClientRect
GetClassInfoExA
GetClassInfoA
AdjustWindowRectEx
CopyRect
CallWindowProcA
GetMenu
SystemParametersInfoA
GetWindowPlacement
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
SetWindowPos
SetWindowLongA
IsWindow
SetPropA
SetWindowsHookExA
CallNextHookEx
GetKeyState
ValidateRect
GetFocus
ClientToScreen
GetDlgCtrlID
GetWindowRect
GetClassNameA
PtInRect
SetWindowTextA
GetWindowTextA
GetWindowThreadProcessId
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
UnhookWindowsHookEx
GetSysColor
GetSysColorBrush
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
wsprintfA
GetActiveWindow
FindWindowA
ExitWindowsEx
MapVirtualKeyA
SetForegroundWindow
GetWindowInfo
IsIconic
GetDC
DrawFocusRect
ReleaseDC
ShowCursor
GetDlgItem
CreateDialogParamA
LoadImageA
MessageBoxA
KillTimer
SetTimer
PostMessageA
InvalidateRect
PeekMessageA
TranslateMessage
DispatchMessageA
BeginPaint
EndPaint
DestroyWindow
PostQuitMessage
SendMessageA
LoadCursorA
LoadIconA
RegisterClassA
GetSystemMetrics
CreateWindowExA
GetPropA
RemovePropA
GetForegroundWindow
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetFocus
DefWindowProcA
RegisterWindowMessageA
GetWindow

gdi32

RestoreDC
GetClipBox
SaveDC
SetMapMode
SetBkColor
PtVisible
RectVisible
TextOutA
Escape
SetViewportOrgEx
SetViewportExtEx
GetDeviceCaps
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
OffsetViewportOrgEx
CreateBitmap
GetPixel
CreateCompatibleDC
DeleteDC
GetObjectA
GetCharABCWidthsA
CreatePen
CreateFontA
SetTextColor
SetBkMode
ExtTextOutA
SelectObject
GetTextExtentPoint32A
StretchBlt
BitBlt
GetStockObject
DeleteObject

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

advapi32

RegEnumKeyExA
RegOpenKeyA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetUserNameA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

ShellExecuteExA

ole32

CoCreateInstanceEx
CLSIDFromProgID
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

SysFreeString
SysAllocString
VariantClear
VariantInit
VariantChangeType

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 362KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 568KB - Virtual size: 568KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fb9e417e8ee2e2c79f1a80707e0b6a55

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

ddraw

comctl32

winmm

iphlpapi

wintrust

crypt32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 167KB - Virtual size: 166KB

.data Size: 26KB - Virtual size: 362KB

.rsrc Size: 568KB - Virtual size: 568KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 167KB - Virtual size: 166KB

.data
Size: 26KB - Virtual size: 362KB

.rsrc
Size: 568KB - Virtual size: 568KB