JaffaCakes118_79e86a6b753911c6e2c061abbf7de210

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_79e86a6b753911c6e2c061abbf7de210
Size

657KB
MD5

79e86a6b753911c6e2c061abbf7de210
SHA1

0b501daba9d469a33b282867e9a4f0825e234a65
SHA256

d9be5a0bb7c45888353a70b44b7667519a41c73c15ae2cab1a21fe32ab90f13e
SHA512

28b0c7868d002f039fdec3048c21ec20b1bf0d818d7152c74f8a6963d034612f9569886d07bd4177e227acc01ca70528f98d636e33f03a4cce9e611522607772
SSDEEP

12288:2Zd4GBqnEx5GvnR+DLahlANLWBWIxsc9yDADM0WMLm0ZLpWAFDYeWOM/:2vFYq5k05CBVqDGpLpWAFDvWOc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/c18d5823f4808a892653eb231e6927e0df8e6e4d

Files

JaffaCakes118_79e86a6b753911c6e2c061abbf7de210
.gz
c18d5823f4808a892653eb231e6927e0df8e6e4d
.exe windows:6 windows x64 arch:x64

8955512f01ba36ed540a01edd29de62e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

msinfo32.pdb

Imports

advapi32

RegQueryValueExW
RegCloseKey
RegGetValueW
RegSetValueExW
RegOpenKeyExW

kernel32

GetSystemWow64DirectoryW
GetModuleHandleW
GetPhysicallyInstalledSystemMemory
CreateFileW
ReadFile
SetFilePointer
FindFirstFileW
FindNextFileW
FindClose
GetTempPathW
CreateDirectoryExW
GetLastError
SetFileAttributesW
DeleteFileW
GetNativeSystemInfo
GetCurrentDirectoryW
SetCurrentDirectoryW
EnterCriticalSection
FormatMessageW
FreeLibrary
InitializeCriticalSection
GlobalUnlock
GetFileSize
LocalFree
GlobalAlloc
GetComputerNameW
GetCommandLineW
HeapSetInformation
RegisterApplicationRestart
MultiByteToWideChar
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
GetLocaleInfoW
TerminateThread
WaitForSingleObject
SetEvent
CreateThread
ResetEvent
CloseHandle
RemoveDirectoryW
DeleteCriticalSection
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
LocalAlloc
CreateEventW
GetTickCount
GetVersionExW
DnsHostnameToComputerNameW
GlobalLock
lstrlenW
LeaveCriticalSection
LoadLibraryW

gdi32

GetObjectW
CreateSolidBrush
SetTextColor
EndDoc
EndPage
StartDocW
CreateFontW
TextOutW
StartPage
GetDeviceCaps
GetTextExtentPoint32W
CreateFontIndirectW

user32

CheckDlgButton
ReleaseDC
DrawFocusRect
GetDCEx
SetFocus
ReleaseCapture
SetCapture
PtInRect
OffsetRect
InflateRect
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
IsWindowEnabled
IsWindowVisible
GetFocus
GetSubMenu
SetCursor
ShowWindow
UpdateWindow
FillRect
ScreenToClient
CopyRect
GetClientRect
SetClassLongPtrW
LoadIconW
SetWindowPlacement
SystemParametersInfoW
LoadAcceleratorsW
MoveWindow
SetMenuItemInfoW
EmptyClipboard
PostMessageW
MessageBoxW
LoadMenuW
SetMenu
SetClipboardData
BeginPaint
LoadCursorW
GetSysColor
GetWindowTextW
EnableWindow
CheckRadioButton
SetDlgItemTextW
KillTimer
IsDlgButtonChecked
SetTimer
DialogBoxParamW
EndDialog
RedrawWindow
EndPaint
PostQuitMessage
CreateDialogParamW
GetMessageW
TranslateAcceleratorW
IsDialogMessageW
TranslateMessage
DispatchMessageW
DestroyAcceleratorTable
InvalidateRect
SendMessageW
GetDlgItem
SetWindowTextW
LoadStringW
SetRect
GetWindowRect

mfc42u

ord1082
ord288
ord1472
ord1544
ord1586
ord812
ord6127
ord6133
ord6243
ord6577
ord6138
ord2574
ord851
ord6707
ord6704
ord5979
ord1358
ord5927
ord2781
ord5951
ord2785
ord1042
ord4502
ord1383
ord1221
ord628
ord5916
ord917
ord422
ord2461
ord1471
ord287
ord1647
ord3790
ord286
ord1574
ord2427
ord3783
ord6887
ord626
ord1040
ord1122
ord1126
ord2975
ord5887
ord4436
ord2629
ord624
ord620
ord1286
ord2846
ord1284
ord6705
ord6886
ord4473
ord1463
ord2783
ord1259
ord6050
ord1606
ord424
ord919
ord4504
ord1223
ord2845
ord420
ord915
ord568
ord1006
ord1355
ord5950
ord4500
ord1219
ord1381
ord5925
ord3579
ord5914
ord6641
ord4523
ord4521
ord6708
ord1264
ord1262
ord1095
ord2841
ord6216
ord2794
ord6880
ord1483
ord3581
ord366
ord3830
ord5986
ord3221
ord3777
ord2408
ord369
ord622
ord4046
ord2849
ord1287
ord2855
ord2801
ord1124
ord336
ord1646

msvcrt

__dllonexit
_lock
_onexit
??1type_info@@UEAA@XZ
_unlock
?terminate@@YAXXZ
memset
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
_callnewh
malloc
_CxxThrowException
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
__CxxFrameHandler3
wcsncpy_s
wcstod
_wtol
_wcsupr
free
iswalpha
wcstoul
wcstol
_wcsicmp
swprintf_s
_purecall
_wcsicoll
_wtoi
_vsnwprintf
??0exception@@QEAA@AEBQEBDH@Z
memcpy

atl

ord30

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WinSqmAddToStream

oleaut32

SysFreeString
SysAllocString
VariantInit
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement
SysStringLen
VariantChangeType
VariantClear
SysAllocStringLen

ole32

CoCreateInstance
CoTaskMemFree
CoInitialize
CoUninitialize
CoInitializeSecurity
CoCreateGuid
StringFromCLSID

shlwapi

StrFormatByteSizeEx

setupapi

SetupIterateCabinetW

comdlg32

PrintDlgExW
GetOpenFileNameW
GetSaveFileNameW

shell32

CommandLineToArgvW

comctl32

InitCommonControlsEx

Sections

.text
Size: 201KB - Virtual size: 200KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 147KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 588KB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8955512f01ba36ed540a01edd29de62e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

mfc42u

msvcrt

atl

ntdll

oleaut32

ole32

shlwapi

setupapi

comdlg32

shell32

comctl32

Sections

.text Size: 201KB - Virtual size: 200KB

.data Size: 7KB - Virtual size: 27KB

.pdata Size: 11KB - Virtual size: 11KB

.rsrc Size: 147KB - Virtual size: 146KB

.reloc Size: 588KB - Virtual size: 2.5MB

.text
Size: 201KB - Virtual size: 200KB

.data
Size: 7KB - Virtual size: 27KB

.pdata
Size: 11KB - Virtual size: 11KB

.rsrc
Size: 147KB - Virtual size: 146KB

.reloc
Size: 588KB - Virtual size: 2.5MB