JaffaCakes118_bed36802f6123d820c6d25ebc6bedef6

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_bed36802f6123d820c6d25ebc6bedef6
Size

287KB
MD5

bed36802f6123d820c6d25ebc6bedef6
SHA1

e9f1bdeec222bb7482bce978291cd2a2e5808ad5
SHA256

7833602e82739f68224db3ef55692faa0e2418a70047566eea28313749a574a7
SHA512

22e0a5508574c7542ffd4107b382a4f885086558f0a6c8dc0a0731123c3d171cb60fa9a60f4289fd78a0bf6a1ed042e1e6bfb8ac9d97266af6b50a8cdcde76e2
SSDEEP

6144:dtwxm2tOHRMdTBUnUBK2MflHHiezy85dEJkMsOD:6AHRBU6HHiemwEJb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_bed36802f6123d820c6d25ebc6bedef6

Files

JaffaCakes118_bed36802f6123d820c6d25ebc6bedef6
.exe windows:4 windows x86 arch:x86

b3f3781dff9137e502d8d7dff04790ad

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemTimeAsFileTime
CreateFileMappingA
GetFileType
InterlockedPushEntrySList
GlobalUnlock
SetFilePointer
FlushFileBuffers
MulDiv
GetACP
HeapDestroy
GetFileSize
IsDebuggerPresent
GlobalAlloc
FindNextFileW
LoadResource
lstrlenW
FindResourceW
SwitchToThread
CreateFileW
CloseHandle
FlushInstructionCache
MapViewOfFile
LocalFree
ExpandEnvironmentStringsW
FindFirstFileW
FindResourceExW
VirtualAlloc
SetUnhandledExceptionFilter
SizeofResource
DeleteCriticalSection
WideCharToMultiByte
RaiseException
GetFileAttributesExW
TlsAlloc
GetModuleHandleW
LeaveCriticalSection
InterlockedPopEntrySList
DeleteFileW
IsValidCodePage
GetProcessHeap
FormatMessageW
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
LockResource
UnhandledExceptionFilter
HeapSize
UnmapViewOfFile
GlobalLock
GetCurrentThreadId
TlsGetValue
ReadFile
IsProcessorFeaturePresent
HeapAlloc
FindClose
WriteFile
EnterCriticalSection
CreateDirectoryW
lstrcmpiW
SetEndOfFile
TlsFree
SetLastError
FreeLibrary
lstrcmpW
TlsSetValue
HeapReAlloc
GetFullPathNameW
CreateFileA
HeapFree
VirtualFree
QueryPerformanceCounter

shell32

SHGetFolderPathW

gdi32

CreateFontIndirectW
GetDeviceCaps
BitBlt
DeleteDC
GetStockObject
LineTo
CreatePen
CreateSolidBrush
GetObjectW
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
MoveToEx
CreateDCA
CreateDIBSection
CreateFontIndirectExA
CreateMetaFileW
CreateICA
UpdateICMRegKeyA
CreatePalette
CreateColorSpaceA
TranslateCharsetInfo

crypt32

PFXImportCertStore
CryptMemFree
PFXExportCertStoreEx
CertCreateSelfSignCertificate
CertOpenStore
CryptAcquireCertificatePrivateKey
CertAddCertificateContextToStore
CertFreeCertificateContext
CryptMemAlloc
CertStrToNameW
CertEnumCertificatesInStore
CertCloseStore

ole32

CoGetClassObject
CoCreateFreeThreadedMarshaler
CoCreateGuid
OleUninitialize
StringFromGUID2
CreateStreamOnHGlobal
OleInitialize
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
OleLockRunning
CLSIDFromString
CLSIDFromProgID

wininet

InternetCanonicalizeUrlW
InternetCrackUrlW

comctl32

ImageList_Destroy
ImageList_LoadImageW

user32

SetCursorPos
MonitorFromWindow
SendDlgItemMessageW
IntersectRect
ScreenToClient
GetWindow
CreateAcceleratorTableW
MoveWindow
IsWindow
GetWindowRect
ClientToScreen
IsDlgButtonChecked
SetCursor
SendMessageW
SetWindowPos
ShowWindow
GetDlgItem
CreateWindowExW
GetWindowTextLengthW
GetActiveWindow
UnhookWindowsHookEx
DialogBoxIndirectParamW
IsChild
CallWindowProcW
SetTimer
CharNextW
EnableWindow
PtInRect
GetDlgItemTextW
RegisterWindowMessageW
ReleaseDC
GetClassInfoExW
RegisterClassExW
DestroyWindow
GetClientRect
SetFocus
GetFocus
UpdateWindow
LoadCursorW
wsprintfW
SetWindowLongW
IsWindowEnabled
RedrawWindow
SendMessageA
DrawTextExW
GetSysColor
GetWindowInfo
CheckDlgButton
InvalidateRect
GetCursorPos
GetDesktopWindow
SetDlgItemTextW
GetClassNameW
EndPaint
CallNextHookEx
MessageBoxW
EndDialog
DefWindowProcW
KillTimer
MapWindowPoints
DestroyAcceleratorTable
SetWindowTextW
SetWindowsHookExW
DialogBoxParamW
GetMonitorInfoW
GetSystemMetrics
LoadStringW
InvalidateRgn
GetParent
SetCapture
FillRect
GetDC
ReleaseCapture
GetDlgCtrlID
PostMessageW
UnregisterClassA
GetWindowLongW
GetWindowTextW
BeginPaint

advapi32

RegDeleteKeyW
CryptGenKey
CryptExportKey
RegEnumKeyW
RegOpenKeyExW
CryptAcquireContextW
CryptGetProvParam
RegSetValueExW
RegQueryValueExW
CryptEnumProvidersW
CryptGetUserKey
CryptReleaseContext
RegQueryInfoKeyW
RegDeleteValueW
RegCreateKeyExW
RegEnumKeyExW
RegCloseKey
CryptDestroyKey

secur32

GetUserNameExW

oleaut32

OleCreateFontIndirect
SysAllocString
VariantChangeType
SafeArrayGetElement
SysFreeString
VariantInit
UnRegisterTypeLi
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayDestroy
SafeArrayLock
VarUI4FromStr
VariantClear
CreateErrorInfo
RegisterTypeLi
VarBstrCat
SysAllocStringLen
DispCallFunc
GetErrorInfo
SetErrorInfo
SafeArrayGetVartype
LoadTypeLi
SysStringByteLen
SafeArrayGetDim
SysAllocStringByteLen
LoadRegTypeLi
SysStringLen
SafeArrayUnlock

mprdim

ServiceMain

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 254KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b3f3781dff9137e502d8d7dff04790ad

Headers

File Characteristics

Imports

kernel32

shell32

gdi32

crypt32

ole32

wininet

comctl32

user32

advapi32

secur32

oleaut32

mprdim

Sections

.text Size: 16KB - Virtual size: 16KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 254KB - Virtual size: 1.2MB

.rsrc Size: 8KB - Virtual size: 21KB

.text
Size: 16KB - Virtual size: 16KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 254KB - Virtual size: 1.2MB

.rsrc
Size: 8KB - Virtual size: 21KB