ce997b2380ebcf6dd77d515d7a91de01_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ce997b2380ebcf6dd77d515d7a91de01_JaffaCakes118
Size

276KB
MD5

ce997b2380ebcf6dd77d515d7a91de01
SHA1

1a0789ed4f8c7f9d93d0941e7f50d2f249fd2cf0
SHA256

4348740fbb50fd6db7474e69a09dc4563a41c11285538c7efa8b9571f57de6ce
SHA512

39b38cd48475b3b55c09f84f4ab1862ace4e087bfe2ba1da915ec1af1fdd42c77ac5902fe3c0b4b2408659a8f450e7a0c05277401fe8a4da86b0c268befd06b7
SSDEEP

6144:m64Zl6iCmkRsbmm4PoK6HOwQlIZZMN6HW+KLLn7mhlIQHQg:mHgKbmme6HOwwIi7LLnSbHHQg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ce997b2380ebcf6dd77d515d7a91de01_JaffaCakes118

Files

ce997b2380ebcf6dd77d515d7a91de01_JaffaCakes118
.exe windows:6 windows x86 arch:x86

6199b3f7b851154bc163fe8a178b52cd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

wsqmcons.pdb

Imports

advapi32

TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegCloseKey
RegDeleteValueW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
UpdateTraceW
ControlTraceW
StopTraceW
EnableTraceEx
StartTraceW
RegQueryValueExW
QueryTraceW
IsValidSid
CloseTrace
ProcessTrace
OpenTraceW
ConvertSidToStringSidW
RegSetValueExW
RegCreateKeyExW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
CopySid
GetLengthSid
GetTokenInformation
CloseServiceHandle
QueryServiceStatus
OpenServiceW
OpenSCManagerW
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetNamedSecurityInfoW
GetSecurityDescriptorOwner
GetSecurityDescriptorDacl
RevertToSelf
ImpersonateLoggedOnUser
RegGetValueW
TraceEvent

kernel32

GetTickCount
SetThreadPriority
GetCurrentThread
CreateMutexW
GetCommandLineW
HeapSetInformation
GetLogicalProcessorInformationEx
LocalFree
FreeLibrary
GetProcAddress
LoadLibraryW
GetUserGeoID
GetSystemDefaultLCID
GetSystemDefaultUILanguage
GlobalMemoryStatusEx
GetSystemInfo
GetActiveProcessorCount
GetProductInfo
CompareFileTime
GetLastError
OpenMutexW
ReleaseMutex
LoadLibraryExW
FindResourceW
SizeofResource
LoadResource
LockResource
FreeResource
GetModuleHandleW
FileTimeToSystemTime
FileTimeToDosDateTime
GetTempFileNameW
GlobalFree
WaitForMultipleObjects
GetTempPathW
GetLongPathNameW
SetLastError
WideCharToMultiByte
CreateDirectoryW
GetFileAttributesW
GetFileSizeEx
SetFilePointerEx
InterlockedDecrement
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
VirtualAlloc
UnmapViewOfFile
VirtualFree
InterlockedIncrement
ResetEvent
CreateThread
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeLibraryAndExitThread
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventW
GetFileSize
ReadFile
DuplicateHandle
SetEvent
EnterCriticalSection
LeaveCriticalSection
RaiseException
GetSystemDirectoryW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
lstrlenW
SystemTimeToFileTime
GetModuleFileNameW
LocalAlloc
GetLocalTime
CreateFileW
SetFileAttributesW
WriteFile
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
CloseHandle
DeleteFileW
GetFileAttributesExW
FindNextFileW
FindFirstFileW
FindClose
MoveFileExW
GetVersionExW
GetSystemTime
GetThreadPriority

user32

LoadStringW
PeekMessageW
MsgWaitForMultipleObjects
DispatchMessageW
TranslateMessage
GetSystemMetrics

msvcrt

_initterm
wcstoul
_controlfp
_except_handler4_common
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
wcstok_s
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
free
_callnewh
malloc
wcschr
memset
__CxxFrameHandler3
towupper
_vsnwprintf
wcsstr
wcsrchr
memcpy
_vsnprintf
memmove
_wcsicmp
realloc
_wcsnicmp
ceil
_ftol2
_purecall

shlwapi

PathRemoveExtensionW
PathFindFileNameW
PathCombineW
StrStrIW
StrToIntExW
PathFileExistsW
ord437
PathAppendW

tdh

TdhGetProperty
TdhGetPropertySize

ole32

CoCreateGuid
StringFromGUID2

shell32

CommandLineToArgvW
SHGetFolderPathW
SHGetFolderPathAndSubDirW

winhttp

WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpSetOption
WinHttpOpen
WinHttpGetDefaultProxyConfiguration
WinHttpWriteData
WinHttpCrackUrl
WinHttpSetTimeouts
WinHttpSetCredentials
WinHttpTimeFromSystemTime
WinHttpCloseHandle
WinHttpReadData
WinHttpSetStatusCallback
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpReceiveResponse
WinHttpConnect
WinHttpSendRequest

wevtapi

EvtClose
EvtNext
EvtQuery
EvtRender
EvtCreateRenderContext

powrprof

PowerDeterminePlatformRole

ntdll

NtQuerySystemTime
RtlFreeHeap
RtlAllocateHeap

oleaut32

SysFreeString
SysAllocString

Sections

.text
Size: 205KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

hzjhzep
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6199b3f7b851154bc163fe8a178b52cd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

shlwapi

tdh

ole32

shell32

winhttp

wevtapi

powrprof

ntdll

oleaut32

Sections

.text Size: 205KB - Virtual size: 204KB

.data Size: 512B - Virtual size: 5KB

.rsrc Size: 29KB - Virtual size: 28KB

.reloc Size: 40KB - Virtual size: 41KB

hzjhzep Size: - Virtual size: 4KB

.text
Size: 205KB - Virtual size: 204KB

.data
Size: 512B - Virtual size: 5KB

.rsrc
Size: 29KB - Virtual size: 28KB

.reloc
Size: 40KB - Virtual size: 41KB

hzjhzep
Size: - Virtual size: 4KB