f94d2f2b15200e74ad8507fe8d54a689_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f94d2f2b15200e74ad8507fe8d54a689_JaffaCakes118
Size

85KB
MD5

f94d2f2b15200e74ad8507fe8d54a689
SHA1

80013e531a5293cdd3fb811d6ba3bc0848322342
SHA256

f758c481cf2f0b352f509b2cd895e19f7293b99d23b5f6f03f6fc540b8d11657
SHA512

a179eb02fc58d2c874627a59b84f58b41c956aaab7baeecfbc6184c9396661e92a32e31dcd202f6119d16c626aec5d84f7f1a3a331653809e13846d92d7b13db
SSDEEP

1536:3sv0G05VtFDdG3jYktNRiC0U7JMvbuSRe1l5OzoWwDLQjq4yGsL/3nYjTxIhieOY:k0pVY3PYlUtMvbuD/zfDh2SQYOY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f94d2f2b15200e74ad8507fe8d54a689_JaffaCakes118

Files

f94d2f2b15200e74ad8507fe8d54a689_JaffaCakes118
.exe windows:5 windows x86 arch:x86

8c4824df66886a7d4ab22dd6cd884ac7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DosPathToSessionPathW
CreateWaitableTimerW
GetLastError
GetSystemTimeAsFileTime
VirtualAlloc
SetThreadIdealProcessor
LoadLibraryA
GetStartupInfoA
GetCurrentProcessId
FindFirstChangeNotificationW
LZDone
SetFileValidData
BuildCommDCBW
LocalCompact
FindClose
GetTickCount
GetCurrentThreadId
HeapCreate
SetEnvironmentVariableA
QueryPerformanceCounter
IsValidLanguageGroup
ConvertThreadToFiber
GetModuleHandleA
IsValidCodePage
GetTempPathW

ntdll

RtlSetAllBits
RtlRemoteCall
RtlLocalTimeToSystemTime
NtCreateJobSet
RtlMapSecurityErrorToNtStatus
ZwTerminateJobObject
log
RtlLockHeap
ZwAllocateUuids
NtCreateSection
RtlQueueWorkItem
ZwQueryDirectoryObject
memcpy
strchr
ZwAcceptConnectPort
_allmul

dmutil

RgszwFromValist
RgszwFromArgs
LowGetPartitionInfo
DynamicSupport
LowNtWriteFile
AddEntryBootFileGpt
SzwFromSza
LowNtReadFile
ShowMessageValist
FTrace
SzwDupSzw
TranslateError
DisplayError
CoDisableDynamicVolumes
LowNtReadOnlyAttributeOff
FTraceValist
GetSystemVolume

winscard

SCardIntroduceReaderW
SCardEstablishContext
SCardGetCardTypeProviderNameA
SCardListReaderGroupsA
SCardForgetReaderGroupA
SCardForgetReaderA
g_rgSCardT1Pci
SCardRemoveReaderFromGroupW
SCardTransmit
SCardListInterfacesA
SCardIntroduceCardTypeW
SCardLocateCardsByATRA
SCardConnectW
SCardIntroduceReaderGroupA
SCardReleaseContext
SCardRemoveReaderFromGroupA
SCardListInterfacesW
SCardListReadersW
SCardForgetCardTypeW
SCardLocateCardsW

query

?VerifyThreadHasAdminPrivilege@@YGXXZ
?VT_VARIANT_GE@@YGHABUtagPROPVARIANT@@0@Z
?GetDrive@CDriveInfo@@SGXPBGPAG@Z
?SetSortProp@CCatState@@QAEXPBGW4SORTDIR@@I@Z
?MultiByteToXArrayWideChar@@YGKPBEKIAAV?$XArray@G@@@Z
?GetGlobalPropListFile@@YGPAVCPropListFile@@XZ
?ReadProperty@CPropStoreManager@@QAEHAAVCCompositePropRecord@@KAAUtagPROPVARIANT@@@Z
?Write@CDynStream@@QAEXPAXK@Z
?QueryCatalogAdmin@CCatalogEnum@@QAEPAVCCatalogAdmin@@XZ
??1CPhraseRestriction@@QAE@XZ
??0CMemSerStream@@QAE@I@Z
?GetScodeError@@YGJAAVCException@@@Z
?IsStopped@CCatalogAdmin@@QAEHXZ
??0CPropListFile@@QAE@PAVCEmptyPropertyList@@HPBGK@Z
?GetAllEntries@CPropertyList@@UAEJPAPAVCPropEntry@@K@Z
?Resume@CProcess@@QAEXXZ
?SetUI1@CStorageVariant@@QAEXEI@Z
??1CQueryUnknown@@QAE@XZ
?QueryScopeAdmin@CScopeEnum@@QAEPAVCScopeAdmin@@XZ
?SetUI8@CStorageVariant@@QAEXT_ULARGE_INTEGER@@I@Z
?Shutdown@CWorkQueue@@QAEXXZ
?Shrink@CDynStream@@QAEXAAVPStorage@@K@Z
?GetOffset@CKeyDeComp@@QAEXAAUBitOffset@@@Z

Sections

.text
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8c4824df66886a7d4ab22dd6cd884ac7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ntdll

dmutil

winscard

query

Sections

.text Size: 33KB - Virtual size: 32KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 22KB - Virtual size: 74KB

.rsrc Size: 19KB - Virtual size: 19KB

.reloc Size: 512B - Virtual size: 300B

.text
Size: 33KB - Virtual size: 32KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 22KB - Virtual size: 74KB

.rsrc
Size: 19KB - Virtual size: 19KB

.reloc
Size: 512B - Virtual size: 300B