af7bc2ae2fa1cd1e8a492006c1fba828_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

af7bc2ae2fa1cd1e8a492006c1fba828_JaffaCakes118
Size

340KB
MD5

af7bc2ae2fa1cd1e8a492006c1fba828
SHA1

fe0324e49160d0b206b23e10d34d6f12cd234da1
SHA256

4f8feb7aa33b137b2ea3670722b29e9d6e4d66b1538a14aa445beaa0875afb63
SHA512

84ae87530686e6b24c6139e2acb1645e67b033002e6fd0031bdda05ea837e4b819439053ce771eaa56d407553420bad163d56f466e39c8601133655fa194a73b
SSDEEP

6144:HtY1LwQ/VVMixib/6+dx040XljnZm766y0:HqdwQ/4qi3dxD+bN6y0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
af7bc2ae2fa1cd1e8a492006c1fba828_JaffaCakes118

Files

af7bc2ae2fa1cd1e8a492006c1fba828_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b1f739b9479072e615ca841e4875470a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CreateDialogParamA
CreateWindowExA
EnumWindows
ExitWindowsEx
GetLastActivePopup
GetParent
GetSystemMetrics
GetWindowRect
IsWindowVisible
LoadIconA
MoveWindow
OemToCharBuffA
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
DrawFrameControl
DrawFocusRect
DrawEdge
DispatchMessageW
DispatchMessageA
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcW
DefMDIChildProcW
DefMDIChildProcA
DefFrameProcW
DefFrameProcA
CreatePopupMenu
CreateMenu
CreateMDIWindowW
CreateIcon
CloseClipboard
ClientToScreen
ChildWindowFromPoint
CheckMenuItem
CharUpperBuffW
CharPrevW
CharNextW
CharLowerBuffW
CallWindowProcW
CallWindowProcA
CallNextHookEx
BringWindowToTop
AttachThreadInput
CharPrevA
CharNextA
CharLowerBuffA
CharLowerA
CharUpperBuffA
CharToOemA
AdjustWindowRectEx
ActivateKeyboardLayout
GetKeyboardType
LoadStringA
MessageBoxA
RedrawWindow
PostMessageA
PeekMessageA
OffsetRect
CharToOemBuffA

advapi32

RegQueryValueExA
RegCloseKey
GetUserNameW
GetUserNameA
GetSidIdentifierAuthority
GetSecurityDescriptorOwner
RegOpenKeyExA

wininet

InternetReadFile
InternetOpenUrlW
InternetOpenW
InternetCloseHandle

comctl32

ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Remove
ImageList_DrawEx
ImageList_Replace
ImageList_Draw
ImageList_DragMove
ImageList_SetBkColor
ImageList_Add
ImageList_SetImageCount
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
ord17
InitCommonControlsEx
ImageList_DragShowNolock
ImageList_GetDragImage
ImageList_Read
ImageList_Write
ImageList_SetIconSize
_TrackMouseEvent
ImageList_GetBkColor
ImageList_GetIconSize

version

VerQueryValueW
VerQueryValueA
GetFileVersionInfoSizeW
GetFileVersionInfoA
GetFileVersionInfoW
GetFileVersionInfoSizeA

netapi32

NetUserAdd

kernel32

GetCPInfo
RtlUnwind
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
InterlockedDecrement
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStdHandle
GetACP
Sleep
GetModuleHandleW
GetModuleHandleA
GetProcAddress
VirtualAlloc
HeapFree
VirtualFree
HeapCreate
DeleteCriticalSection
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LeaveCriticalSection
EnterCriticalSection
GetOEMCP
IsValidCodePage
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
RaiseException
GetStartupInfoA
GetCommandLineA
HeapAlloc
HeapReAlloc
GetLastError
LoadLibraryA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
CloseHandle
GetConsoleOutputCP
SetStdHandle
CreateFileA
ExitProcess
GetSystemTimeAsFileTime
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
lstrlenW
lstrlenA
lstrcpynA
lstrcpyW
lstrcpyA
lstrcmpiA
WriteConsoleW
WriteConsoleA
GetTempPathA

Sections

.text
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 348KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.DATA
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CODE
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 188KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b1f739b9479072e615ca841e4875470a

Headers

DLL Characteristics

File Characteristics

Imports

user32

advapi32

wininet

comctl32

version

netapi32

kernel32

Sections

.text Size: 82KB - Virtual size: 82KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 13KB - Virtual size: 348KB

.DATA Size: 33KB - Virtual size: 33KB

.CODE Size: 1024B - Virtual size: 1008B

.rsrc Size: 188KB - Virtual size: 187KB

.text
Size: 82KB - Virtual size: 82KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 13KB - Virtual size: 348KB

.DATA
Size: 33KB - Virtual size: 33KB

.CODE
Size: 1024B - Virtual size: 1008B

.rsrc
Size: 188KB - Virtual size: 187KB