f145ded8adffede5b3d53034a30e3e02_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f145ded8adffede5b3d53034a30e3e02_JaffaCakes118
Size

660KB
MD5

f145ded8adffede5b3d53034a30e3e02
SHA1

d505fc84e34375b15500eb872b19e94421ded6b1
SHA256

21280839f181a8a6ec98610ac1892982f615436d181dc3b61c1757110c30d55b
SHA512

7306e149a6bd1c7952705821da0bdd3d83e3827ead79d5f7cea472d641f9b22baad49fa15d6db9c99e54ffa1582b343b6a8215fad4d65bd72197b93b8ba0288d
SSDEEP

12288:tKYQ5LL540CV3UIeLPrleV1F0e8gMA/9L0l3HATpKR4:MYQ5p4f0POF0nkls3opKR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f145ded8adffede5b3d53034a30e3e02_JaffaCakes118

Files

f145ded8adffede5b3d53034a30e3e02_JaffaCakes118
.dll windows:5 windows x64 arch:x64

b40652efa995f87c760965c22bd8ff6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

gdi32

GetBkColor
GetViewportExtEx
GetSystemPaletteUse

psapi

GetModuleFileNameExW

kernel32

IsValidCodePage
GetDiskFreeSpaceExA
GetCurrentProcess
GetBinaryTypeW
GetConsoleOutputCP
GetFileType
FlsGetValue
LocalAlloc
GetLastError
DosDateTimeToFileTime
GetErrorMode
GetProfileStringA
SetHandleCount
FindResourceExW
ExitThread

user32

GetMessagePos
GetKeyboardLayout
GetMenuItemInfoA
GetClassWord
GetScrollBarInfo
IsCharAlphaNumericA
LoadMenuA
DefMDIChildProcW

advapi32

IsWellKnownSid
AreAnyAccessesGranted
RegDisablePredefinedCacheEx
SetThreadToken
GetSecurityDescriptorOwner

Exports

Exports

CloseThreadWaitChainSession
GetThreadWaitChain
OpenThreadWaitChainSession
RegisterWaitChainCOMCallback
WerAddExcludedApplication
WerFreeString
WerRemoveExcludedApplication
WerReportAddDump
WerReportAddFile
WerReportCloseHandle
WerReportCreate
WerReportSetParameter
WerReportSetUIOption
WerReportSubmit
WerStoreClose
WerStoreGetFirstReportKey
WerStoreGetNextReportKey
WerStoreGetReportCount
WerStoreGetSizeOnDisk
WerStoreOpen
WerStorePurge
WerStoreQueryReportMetadataV1
WerStoreQueryReportMetadataV2
WerStoreQueryReportMetadataV3
WerStoreUploadReport
WerSysprepCleanup
WerSysprepGeneralize
WerUnattendedSetup
WerpAddAppCompatData
WerpAddFile
WerpAddFileBuffer
WerpAddFileCallback
WerpAddIfRegisteredForAppLocalDump
WerpAddMemoryBlock
WerpAddRegisteredDataToReport
WerpAddRegisteredDumpsToReport
WerpAddRegisteredMetadataToReport
WerpAddTerminationReason
WerpArchiveReport
WerpAuxmdDumpProcessImages
WerpAuxmdDumpRegisteredBlocks
WerpAuxmdFree
WerpAuxmdFreeCopyBuffer
WerpAuxmdHashVaRanges
WerpAuxmdInitialize
WerpAuxmdMapFile
WerpCancelUpload
WerpCleanWer
WerpCloseStore
WerpCreateIntegratorReportId
WerpCreateMachineStore
WerpDeleteReport
WerpDestroyWerString
WerpEnumerateStoreNext
WerpEnumerateStoreStart
WerpExtractReportFiles
WerpFlushImageCache
WerpForceDeferredCollection
WerpFreeString
WerpFreeUnmappedVaRanges
WerpGetAADTenantInfo
WerpGetBucketId
WerpGetDynamicParameter
WerpGetEventType
WerpGetExtendedDiagData
WerpGetFileByIndex
WerpGetFilePathByIndex
WerpGetIntegratorReportId
WerpGetLegacyBucketId
WerpGetLoadedModuleByIndex
WerpGetNumFiles
WerpGetNumLoadedModules
WerpGetNumSigParams
WerpGetPathOfWERTempDirectory
WerpGetReportConsent
WerpGetReportCount
WerpGetReportFinalConsent
WerpGetReportFlags
WerpGetReportId
WerpGetReportInformation
WerpGetReportSettings
WerpGetReportTime
WerpGetReportType
WerpGetResponseId
WerpGetSigParamByIndex
WerpGetStoreLocation
WerpGetStorePath
WerpGetStoreType
WerpGetTextFromReport
WerpGetUIParamByIndex
WerpGetUploadTime
WerpGetWerStringData
WerpGetWow64Process
WerpHashApplicationParameters
WerpInitializeImageCache
WerpIsDisabled
WerpIsOnBattery
WerpIsTransportAvailable
WerpLoadReport
WerpLoadReportFromBuffer
WerpOpenMachineArchive
WerpOpenMachineQueue
WerpPromptUser
WerpPruneStore
WerpReportCancel
WerpReportSprintfParameter
WerpReserveMachineQueueReportDir
WerpResetTransientImageCacheStatistics
WerpRestartApplication
WerpSetAADTenantInfo
WerpSetAuxiliaryArchivePath
WerpSetCallBack
WerpSetDefaultUserConsent
WerpSetDynamicParameter
WerpSetEventName
WerpSetExitListeners
WerpSetIntegratorReportId
WerpSetIptEnabled
WerpSetProcessTimelines
WerpSetQuickDumpType
WerpSetReportApplicationIdentity
WerpSetReportFlags
WerpSetReportInformation
WerpSetReportIsFatal
WerpSetReportNamespaceParameter
WerpSetReportOption
WerpSetReportTime
WerpSetReportUploadContextToken
WerpSetTelemetryAppParams
WerpSetTelemetryKernelParams
WerpSetTelemetryServiceParams
WerpSetTtdStatus
WerpShowUpsellUI
WerpStitchedMinidumpVmPostReadCallback
WerpStitchedMinidumpVmPreReadCallback
WerpStitchedMinidumpVmQueryCallback
WerpSubmitReportFromStore
WerpTraceAuxMemDumpStatistics
WerpTraceDuration
WerpTraceImageCacheStatistics
WerpTraceSnapshotStatistics
WerpTraceStitchedDumpWriterStatistics
WerpTraceUnmappedVaRangesStatistics
WerpUnmapProcessViews
WerpValidateReportKey
WerpWalkGatherBlocks

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 276KB - Virtual size: 275KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.xljzbv
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gup
Size: 4KB - Virtual size: 661B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vdimfs
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.icnw
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.haov
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fso
Size: 4KB - Virtual size: 802B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.uwsy
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.flys
Size: 4KB - Virtual size: 802B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gxbcu
Size: 4KB - Virtual size: 503B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.iibij
Size: 4KB - Virtual size: 503B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.todyep
Size: 4KB - Virtual size: 318B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bmp
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b40652efa995f87c760965c22bd8ff6d

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

psapi

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 23KB

.rdata Size: 276KB - Virtual size: 275KB

.data Size: 264KB - Virtual size: 263KB

.pdata Size: 4KB - Virtual size: 1KB

.rsrc Size: 8KB - Virtual size: 6KB

.reloc Size: 4KB - Virtual size: 2KB

.xljzbv Size: 4KB - Virtual size: 1KB

.gup Size: 4KB - Virtual size: 661B

.vdimfs Size: 4KB - Virtual size: 1KB

.icnw Size: 4KB - Virtual size: 1KB

.haov Size: 4KB - Virtual size: 1KB

.fso Size: 4KB - Virtual size: 802B

.uwsy Size: 28KB - Virtual size: 27KB

.flys Size: 4KB - Virtual size: 802B

.gxbcu Size: 4KB - Virtual size: 503B

.iibij Size: 4KB - Virtual size: 503B

.todyep Size: 4KB - Virtual size: 318B

.bmp Size: 8KB - Virtual size: 4KB

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 276KB - Virtual size: 275KB

.data
Size: 264KB - Virtual size: 263KB

.pdata
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 8KB - Virtual size: 6KB

.reloc
Size: 4KB - Virtual size: 2KB

.xljzbv
Size: 4KB - Virtual size: 1KB

.gup
Size: 4KB - Virtual size: 661B

.vdimfs
Size: 4KB - Virtual size: 1KB

.icnw
Size: 4KB - Virtual size: 1KB

.haov
Size: 4KB - Virtual size: 1KB

.fso
Size: 4KB - Virtual size: 802B

.uwsy
Size: 28KB - Virtual size: 27KB

.flys
Size: 4KB - Virtual size: 802B

.gxbcu
Size: 4KB - Virtual size: 503B

.iibij
Size: 4KB - Virtual size: 503B

.todyep
Size: 4KB - Virtual size: 318B

.bmp
Size: 8KB - Virtual size: 4KB