f78090b8fbca1018d9ef6499013d4d60_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

f78090b8fbca1018d9ef6499013d4d60_JaffaCakes118
Size

578KB
MD5

f78090b8fbca1018d9ef6499013d4d60
SHA1

64b174faf7b228728cc37b3d80435ae9869d18fd
SHA256

e6ad3226ddfb77de7390964f5d873ce5c7421dddb0b3a4ee69ca3f7128376baa
SHA512

0b351e2e3bed4cca971f80e05f0d6b7837df049efe4951e78626cf2976d7df3fde92747a870007755ab8a4bbc9d435480ac8b159dfcced6bc889e77acce9eacb
SSDEEP

12288:WBIC5Twga/n9LEHBTI1Giey3mHTsotAEdKXxgLd8mlKKeLnwkk6SfxkFv1RC+P:WBIC5cg9I1GiEHTpdKspubYxkh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f78090b8fbca1018d9ef6499013d4d60_JaffaCakes118

Files

f78090b8fbca1018d9ef6499013d4d60_JaffaCakes118
.dll windows:4 windows x86 arch:x86

e4eebbc170a48af7c48d75a13063dfb4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\b\co\tif91\exe\vs\release\snapapi_msi_dll.pdb

Imports

advapi32

RegSetValueExA
RegDeleteValueA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
RegDeleteKeyW
RegSetValueExW
RegQueryValueExW
RegDeleteValueW
GetUserNameW
RegEnumKeyExA
RegEnumValueA
RegDeleteKeyA
GetUserNameA
OpenProcessToken
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
AdjustTokenPrivileges
LookupPrivilegeValueA
GetFileSecurityW
GetSecurityDescriptorOwner
SetFileSecurityW

kernel32

GetCurrentDirectoryW
SetCurrentDirectoryW
CreateFileW
FormatMessageW
GetTempPathW
GetTempFileNameW
GetLogicalDriveStringsW
GetDriveTypeW
GetSystemDirectoryW
GetWindowsDirectoryW
GetShortPathNameW
CreateDirectoryW
RemoveDirectoryW
GetFileAttributesW
SetFileAttributesW
DeleteFileW
CopyFileW
MoveFileW
MoveFileExW
GetFullPathNameW
OutputDebugStringW
ExpandEnvironmentStringsW
LoadLibraryW
LoadLibraryExW
CreateProcessW
GetStartupInfoW
GetComputerNameW
GetModuleFileNameW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
WriteConsoleW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetSystemInfo
WriteConsoleA
GetConsoleOutputCP
FindNextFileA
FindFirstFileA
GetCurrentDirectoryA
SetCurrentDirectoryA
CreateFileA
LocalFree
LocalAlloc
FormatMessageA
GetTempPathA
GetTempFileNameA
GetLogicalDriveStringsA
GetDriveTypeA
GetSystemDirectoryA
GetWindowsDirectoryA
CreateDirectoryA
RemoveDirectoryA
GetFileAttributesA
SetFileAttributesA
DeleteFileA
CopyFileA
MoveFileA
GetFullPathNameA
OutputDebugStringA
ExpandEnvironmentStringsA
LoadLibraryA
LoadLibraryExA
CreateProcessA
GetStartupInfoA
GetModuleFileNameA
GetComputerNameA
GetLocaleInfoA
GetTimeFormatA
GetDateFormatA
GetNumberFormatA
GetEnvironmentVariableA
SetEnvironmentVariableA
GetModuleHandleA
lstrcatA
GetCurrentProcess
SetLastError
ExitThread
ReleaseSemaphore
CreateSemaphoreA
GetFileTime
BackupWrite
BackupRead
EnumResourceNamesW
GetSystemDefaultLangID
FindResourceExW
LoadResource
LockResource
EnumResourceLanguagesW
GetVolumeInformationA
GetDiskFreeSpaceA
WritePrivateProfileStringA
FindFirstChangeNotificationA
GetFileInformationByHandle
GetCompressedFileSizeW
GetDiskFreeSpaceW
GetVolumeInformationW
FindFirstChangeNotificationW
SetFileTime
DeviceIoControl
GetProcessWorkingSetSize
SetProcessWorkingSetSize
UnlockFileEx
LockFileEx
FindNextChangeNotification
FindCloseChangeNotification
CreateEventA
WaitForMultipleObjects
SetEvent
ResetEvent
SetErrorMode
SetFileApisToANSI
GetLogicalDrives
FindClose
CompareStringW
FindFirstFileW
FindNextFileW
WideCharToMultiByte
MultiByteToWideChar
GetProcAddress
FreeLibrary
GetShortPathNameA
CompareStringA
SetEndOfFile
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
ReadFile
FlushFileBuffers
SetStdHandle
VirtualProtect
GetStringTypeW
GetStringTypeA
SetFilePointer
VirtualQuery
InterlockedExchange
InitializeCriticalSection
GetCPInfo
CreateThread
GetOEMCP
GetACP
IsBadCodePtr
IsBadReadPtr
IsBadWritePtr
VirtualAlloc
LCMapStringW
LCMapStringA
HeapSize
HeapReAlloc
WriteFile
UnhandledExceptionFilter
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileType
GetStdHandle
SetHandleCount
TerminateProcess
ExitProcess
EnterCriticalSection
GetExitCodeProcess
CloseHandle
GetLastError
WaitForSingleObject
GetVersion
RtlUnwind
RaiseException
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapFree
HeapAlloc
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
SetUnhandledExceptionFilter
DeleteCriticalSection
LeaveCriticalSection

user32

PostMessageW
CreateDialogIndirectParamW
PeekMessageW
DispatchMessageW
RegisterClipboardFormatW
SendNotifyMessageW
AppendMenuW
ModifyMenuW
SetWindowTextW
SystemParametersInfoW
VkKeyScanW
VkKeyScanExW
WinHelpW
DefWindowProcA
SendMessageW
SetWindowLongW
GetWindowLongW
GetWindowLongA
SetWindowLongA
SendMessageA
SendNotifyMessageA
PostMessageA
DefWindowProcW
CharUpperBuffW
CharUpperBuffA
TranslateMessage
GetMessageA
CreateWindowExA
GetClipboardFormatNameW
VkKeyScanA
wsprintfW
VkKeyScanExA
CreateDialogIndirectParamA
WinHelpA
GetClipboardFormatNameA
SystemParametersInfoA
SetWindowTextA
ModifyMenuA
AppendMenuA
RegisterClipboardFormatA
RegisterClassExA
DispatchMessageA
PeekMessageA
RegisterClassExW

gdi32

EnumFontFamiliesExA
CreateFontIndirectA
GetTextMetricsA
EnumFontFamiliesExW
GetTextMetricsW
CreateFontIndirectW

shell32

Shell_NotifyIconA
SHGetPathFromIDListA
ShellExecuteA
ShellExecuteExA
SHGetMalloc
SHGetFileInfoA
SHGetDesktopFolder
ShellExecuteW
ShellExecuteExW

comdlg32

GetOpenFileNameA
GetSaveFileNameW
GetOpenFileNameW
GetSaveFileNameA

rpcrt4

RpcStringFreeA
UuidToStringA

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

msi

ord47
ord58
ord135
ord64
ord8
ord103
ord125
ord17
ord145
ord80
ord74
ord143
ord49
ord159
ord121
ord123
ord118
ord115
ord160
ord158
ord32
ord51

mpr

WNetAddConnection3A
WNetGetUniversalNameA
WNetAddConnection3W
WNetGetUniversalNameW

ole32

OleInitialize
CoCreateInstance

Exports

Exports

MsiSnapmanCheck
MsiSnapmanInstall
MsiSnapmanUninstall

Sections

.text
Size: 260KB - Virtual size: 259KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e4eebbc170a48af7c48d75a13063dfb4

Headers

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

gdi32

shell32

comdlg32

rpcrt4

version

msi

mpr

ole32

Exports

Exports

Sections

.text Size: 260KB - Virtual size: 259KB

.rdata Size: 64KB - Virtual size: 63KB

.data Size: 8KB - Virtual size: 16KB

.reloc Size: 24KB - Virtual size: 21KB

.text
Size: 260KB - Virtual size: 259KB

.rdata
Size: 64KB - Virtual size: 63KB

.data
Size: 8KB - Virtual size: 16KB

.reloc
Size: 24KB - Virtual size: 21KB