f3ef51dbe75d9fb14dd29aa5f54c94aa_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

f3ef51dbe75d9fb14dd29aa5f54c94aa_JaffaCakes118
Size

144KB
MD5

f3ef51dbe75d9fb14dd29aa5f54c94aa
SHA1

9c3d5d8c006f3f353b9405c6cb8621672190319b
SHA256

d004cf14b0a7ac59910a52135784c04ad891f17a3b995e92f852752a0ef5e531
SHA512

2c8fff22b661b612791346a1a3e83faa963121a1947da4934fcbde1b31d017c0d8310b3e42bd2f0daa378e23c2e36578d02558fac8f12374c7d973ca11b5ae5a
SSDEEP

3072:tvFjrP1pNLD03rrsaDOyO7C+uqAOtv/tQZSSXwgUtrmLkUZK2CeAdlU:FFjj17crsa6FWxPOtEUtgkUZaZdlU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f3ef51dbe75d9fb14dd29aa5f54c94aa_JaffaCakes118

Files

f3ef51dbe75d9fb14dd29aa5f54c94aa_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3717b6bb7b9dd98899ac85d9c849b8d5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

advapi32

GetAce
OpenProcessToken
RegSetValueExA
SetThreadToken
SetSecurityDescriptorGroup
DeleteService
DuplicateToken
RegQueryInfoKeyA
RegEnumKeyExA
AccessCheck
GetSecurityDescriptorDacl
MakeAbsoluteSD
RegDeleteKeyA
ReportEventA
RegQueryValueExA
EqualSid
RegCreateKeyA
RegEnumValueA
LookupAccountNameA
GetSecurityDescriptorGroup
CloseServiceHandle
RegQueryValueExW
GetSidSubAuthority
GetLengthSid
GetSecurityDescriptorOwner
GetSecurityDescriptorLength
RegCloseKey
RegEnumKeyA
LookupPrivilegeValueA
AddAccessAllowedAce
OpenServiceA
IsValidSecurityDescriptor
MakeSelfRelativeSD
AddAce
ChangeServiceConfigA
PrivilegeCheck
DuplicateTokenEx
IsValidSid
GetSecurityDescriptorControl
AllocateAndInitializeSid
RegConnectRegistryA
FreeSid
GetSidLengthRequired
SetSecurityDescriptorDacl
SetServiceStatus
GetUserNameA
StartServiceCtrlDispatcherA
RegOpenKeyExA
GetAclInformation
InitializeSecurityDescriptor
OpenSCManagerA
AddAccessDeniedAce
GetTokenInformation
RegDeleteValueA
AdjustTokenPrivileges
DeregisterEventSource
CopySid
RegisterServiceCtrlHandlerA
SetSecurityDescriptorOwner
ControlService
CreateServiceA
RegCreateKeyExA
RegSetKeySecurity
QueryServiceStatus
LookupAccountSidA
GetSecurityDescriptorSacl
LookupAccountSidW
InitializeAcl
InitializeSid
OpenThreadToken
RegisterEventSourceA
SetSecurityDescriptorSacl
RegOpenKeyExW

ole32

CoGetCallContext
CoCreateInstance
CoGetClassObject
StringFromCLSID
CoTaskMemRealloc
CoCreateGuid
CoUninitialize
CoSetProxyBlanket
CLSIDFromString
CoTaskMemAlloc
CoRevertToSelf
CoQueryProxyBlanket
CoInitializeSecurity
CoTaskMemFree
CoImpersonateClient
CoDisconnectObject
CoRegisterClassObject
StringFromIID
CoInitializeEx
StringFromGUID2
CoRevokeClassObject

shlwapi

PathFindExtensionA

rpcrt4

RpcBindingFromStringBindingA
RpcStringBindingComposeA
RpcBindingSetAuthInfoA
NdrClientCall
RpcStringFreeA

user32

CharUpperA
PostThreadMessageA
EnumWindows
SetTimer
GetMessageA
LoadStringA
GetWindowTextA
MessageBoxA
PeekMessageA
IsWindowVisible
GetWindowThreadProcessId
KillTimer
CharNextA
wsprintfW
DispatchMessageA
wsprintfA

kernel32

GetFileType
Sleep
GetComputerNameA
FormatMessageA
SetLastError
GetModuleHandleA
GetProcessHeap
LCMapStringA
DuplicateHandle
UnmapViewOfFile
WideCharToMultiByte
GetCurrentProcessId
SizeofResource
SetEnvironmentVariableA
CompareStringW
GetTickCount
TlsSetValue
CreateProcessA
TerminateProcess
DeleteCriticalSection
CreateMutexA
GetLastError
GetPrivateProfileStringA
GetEnvironmentStrings
LoadLibraryA
IsBadReadPtr
GetModuleFileNameA
LocalAlloc
MapViewOfFile
HeapDestroy
EnterCriticalSection
HeapSize
GetStdHandle
TlsAlloc
GetProcessTimes
GetCurrentThread
LoadLibraryExA
GetCurrentThreadId
CloseHandle
GetStringTypeA
OpenProcess
GetACP
ExitProcess
InterlockedDecrement
GetPrivateProfileSectionA
GetSystemDirectoryA
GetStringTypeW
HeapCreate
WriteProfileStringA
TlsGetValue
GetEnvironmentStringsW
ClearCommError
SetFilePointer
InterlockedExchange
CreateThread
FindResourceExA
GetProcAddress
InitializeCriticalSection
EnumResourceNamesW
lstrcmpiA
GetModuleHandleW
lstrcpynA
GetModuleFileNameW
CreateFileMappingA
MultiByteToWideChar
CreateDirectoryA
SetErrorMode
HeapReAlloc
WritePrivateProfileStringA
SetEvent
VirtualQuery
FreeLibrary
GetCPInfo
LoadResource
GetFileAttributesA
GetPrivateProfileIntA
VirtualAlloc
GetVersion
CreateEventA
ReadProcessMemory
InterlockedIncrement
RaiseException
IsBadWritePtr
SetLastError
LeaveCriticalSection
GetCommandLineA
SetUnhandledExceptionFilter
FreeEnvironmentStringsA
QueryPerformanceCounter
IsDBCSLeadByte
GetThreadLocale
RtlUnwind
lstrlenA
ReadFile
ExitProcess
VirtualFree
IsBadCodePtr
GetExitCodeProcess
FreeEnvironmentStringsW
lstrlenW
GetSystemInfo
WaitForSingleObject
GetCurrentProcess
VirtualProtect
GetPrivateProfileSectionNamesA
GetVersionExA
CreateFileA
SetHandleCount
HeapAlloc
GetProfileStringA
CompareStringA
lstrcatA
FlushFileBuffers
GetSystemTimeAsFileTime
ReleaseMutex
LCMapStringW
LockResource
TerminateThread
lstrcpyA
LoadLibraryW
WriteFile
GetStartupInfoA
FindFirstFileA
LocalFree
FindClose
InterlockedCompareExchange
GetOEMCP
UnhandledExceptionFilter
GetLocaleInfoA
SetStdHandle
CreateProcessW
TlsFree
LocalSize
FindResourceA
SetEndOfFile
HeapFree

Sections

.text
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rscr
Size: 512B - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3717b6bb7b9dd98899ac85d9c849b8d5

Headers

File Characteristics

Imports

version

advapi32

ole32

shlwapi

rpcrt4

user32

kernel32

Sections

.text Size: 100KB - Virtual size: 100KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 35KB - Virtual size: 35KB

.rscr Size: 512B - Virtual size: 220KB

.text
Size: 100KB - Virtual size: 100KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 35KB - Virtual size: 35KB

.rscr
Size: 512B - Virtual size: 220KB