d69a72bb30a04545e9bf4abe245d3630_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

d69a72bb30a04545e9bf4abe245d3630_JaffaCakes118
Size

175KB
MD5

d69a72bb30a04545e9bf4abe245d3630
SHA1

3fda4656f69f9aab573ee71a5a3fbc4dfa222a0e
SHA256

eb548181ee69a324ac1120beaa1e52449311f861001017294c284b5b7474ade1
SHA512

bde34d26496226809e37549a22508e2461afd72cf139f1aad88173272a54de7d8dbc5ba34b64b2402023792aba49ef45225a67d3e336283cb747559f14ee3e7e
SSDEEP

3072:jbo/D0tSi4V6PecwoCKpY7bYt8m9wF/ZkGq/BdOt8NTH9q+5jkkS9:j4WSpV6Pecdn67bY6/kbjPAr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d69a72bb30a04545e9bf4abe245d3630_JaffaCakes118

Files

d69a72bb30a04545e9bf4abe245d3630_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2767314fbe27486bf221af8be7748ced

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipFree
GdipCreateBitmapFromFileICM
GdipGetImagePixelFormat
GdipCreateBitmapFromFile
GdipDisposeImage
GdipAlloc
GdipCloneImage

user32

GetWindowLongA
DefWindowProcA
GetWindowTextLengthA
RegisterWindowMessageA
SetRect
GetSysColor
SetCapture
DestroyAcceleratorTable
SetWindowTextA
wvsprintfA
MsgWaitForMultipleObjects
GetWindow
ShowWindow
EndPaint
SetParent
UnregisterClassA
CharNextA
CreateAcceleratorTableA
GetActiveWindow
KillTimer
GetClientRect
RedrawWindow
GetDC
GetWindowTextA
CreateDialogParamA
DestroyWindow
DrawTextA
SetFocus
FillRect
ReleaseCapture
SetTimer
SetWindowLongA
MoveWindow
GetClassInfoExA
GetParent
InvalidateRect
ReleaseDC
CallWindowProcA
EnumDisplayDevicesA
IsChild
PostMessageA
InvalidateRgn
BeginPaint
GetDlgItem
PeekMessageA
CopyRect
GetDesktopWindow
SendNotifyMessageA
FindWindowA
SendMessageTimeoutA
GetFocus
SendMessageA
DispatchMessageA
RegisterClassExA
IsWindow
GetQueueStatus
LoadCursorA
GetWindowRect
wsprintfA
CreateWindowExA
PostThreadMessageA
EqualRect
GetClassNameA
SetWindowPos

wininet

InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle

setupapi

SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiGetClassDevsA

version

VerQueryValueW
GetFileVersionInfoA
GetFileVersionInfoW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeW
VerQueryValueA

shell32

SHGetSpecialFolderPathA
SHGetSpecialFolderPathW

kernel32

SizeofResource
GetCurrentThreadId
GetDriveTypeW
InterlockedIncrement
GetSystemInfo
GlobalUnlock
QueryPerformanceCounter
LoadLibraryExA
LoadLibraryW
OutputDebugStringA
OutputDebugStringW
lstrcpyA
CreateThread
LocalFree
GetShortPathNameW
ExitProcess
OpenFileMappingA
CreateFileMappingA
CreateEventA
IsDBCSLeadByte
TerminateProcess
WideCharToMultiByte
GetACP
InitializeCriticalSection
SetThreadPriority
ReadFile
GetCurrentProcess
GetProcessAffinityMask
_llseek
VirtualProtect
lstrcmpA
MapViewOfFile
ResetEvent
LoadResource
MulDiv
IsBadWritePtr
GetFileAttributesW
SetEnvironmentVariableW
GetCurrentThread
RaiseException
CreateFileA
WaitForMultipleObjects
InterlockedDecrement
Beep
DeviceIoControl
VirtualAlloc
WaitForSingleObject
GetSystemTime
LoadLibraryA
IsDebuggerPresent
GlobalSize
CreateSemaphoreA
DeleteFileA
HeapFree
GetProcessHeap
GetModuleFileNameW
DeleteCriticalSection
EnumResourceTypesW
CloseHandle
WriteProcessMemory
GlobalAlloc
GlobalReAlloc
HeapAlloc
GetCurrentProcessId
VirtualFree
GetTempPathW
GetTempPathA
InterlockedExchange
GetFileAttributesA
GetSystemTimeAsFileTime
GetThreadLocale
GetProcAddress
GetThreadPriority
IsBadReadPtr
GetModuleHandleA
EnterCriticalSection
VirtualQuery
MultiByteToWideChar
GetModuleFileNameA
GlobalFree
SetEvent
GlobalLock
GetTickCount
LeaveCriticalSection
GetLocaleInfoA
lstrcmpiA
CreateDirectoryA
WriteFile
FreeLibrary
GetLastError
GetVersionExA
lstrlenA
CreateDirectoryW
FlushInstructionCache
Sleep
lstrcpynA
FindResourceA
GetVolumeInformationW
lstrlenW

ole32

CLSIDFromProgID
CoTaskMemRealloc
StringFromGUID2
CoTaskMemFree
CoGetClassObject
CoCreateInstance
StgOpenStorage
CoUninitialize
CreateStreamOnHGlobal
StgCreateDocfile
CoSetProxyBlanket
OleUninitialize
GetRunningObjectTable
CoTaskMemAlloc
StgIsStorageFile
OleInitialize
OleLockRunning
CreateBindCtx
CreateItemMoniker
CoInitialize
BindMoniker
CoInitializeSecurity
CLSIDFromString

gdi32

CreateFontA
GetDeviceCaps
DeleteDC
CreateDIBSection
GetStockObject
RealizePalette
BitBlt
DeleteObject
CreateDIBitmap
GetObjectA
SetStretchBltMode
ExtEscape
SelectObject
CreateCompatibleBitmap
StretchDIBits
CreateSolidBrush
SelectPalette
GetDIBits
CreateCompatibleDC
SetBkMode

winmm

timeGetTime
timeSetEvent

advapi32

CryptDestroyHash
RegEnumKeyExA
CryptHashData
CryptEncrypt
CryptCreateHash
RegQueryValueExA
CryptGetHashParam
CryptReleaseContext
RegQueryInfoKeyA
CryptImportKey
CryptAcquireContextA
CryptDestroyKey
RegDeleteValueA
RegEnumValueA
RegSetValueExA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegDeleteKeyA

shlwapi

PathFileExistsW
PathCombineW

Sections

.text
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2767314fbe27486bf221af8be7748ced

Headers

File Characteristics

Imports

gdiplus

user32

wininet

setupapi

version

shell32

kernel32

ole32

gdi32

winmm

advapi32

shlwapi

Sections

.text Size: 101KB - Virtual size: 101KB

.rdata Size: 7KB - Virtual size: 6KB

.bss Size: 64KB - Virtual size: 64KB

.tls Size: 1024B - Virtual size: 248KB

.text
Size: 101KB - Virtual size: 101KB

.rdata
Size: 7KB - Virtual size: 6KB

.bss
Size: 64KB - Virtual size: 64KB

.tls
Size: 1024B - Virtual size: 248KB