f9d07c78d573a9015c3e47f0d12b356d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f9d07c78d573a9015c3e47f0d12b356d_JaffaCakes118
Size

358KB
MD5

f9d07c78d573a9015c3e47f0d12b356d
SHA1

0083ddd1a5bcead629097f94086a9d16f9e3a312
SHA256

3b1355c139d84356fa4a3ac2efe202e99cfdf6ffca06bdcf919f8c3f46d421f0
SHA512

d8f1b537a72ccee47ea14a061acd98ef520cdf5b1a4c99e5099e78166fbf7d9837e4ee03bce4a706f1bde669fe1f2b8937d8d0e92d730013ba61ada1a6ceb6a9
SSDEEP

6144:FGKgOc2F6nPVjmnwOi4s7uDBlqjDssPGpB7vcQgimhirr88uRd2TBOTeyoIIcBu:FGKgOc2F6nPcwOi5uPWsrB7gimhIQ8AW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9d07c78d573a9015c3e47f0d12b356d_JaffaCakes118

Files

f9d07c78d573a9015c3e47f0d12b356d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b93dd5480ad7255eaa848a2153c9707a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindNextFileW
GetWindowsDirectoryW
ExpandEnvironmentStringsW
SetFilePointer
CreateProcessW
GetVersionExW
ReadFile
GetFileSizeEx
GetLongPathNameW
ProcessIdToSessionId
LocalFileTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
GetProcAddress
LoadLibraryW
GetSystemTimeAsFileTime
FreeLibrary
MultiByteToWideChar
OpenProcess
DeleteCriticalSection
SetProcessWorkingSetSize
GetFileAttributesW
CreateThread
SetFileAttributesW
LocalFree
GetCurrentProcessId
DeleteFileW
OpenEventW
CreateWaitableTimerW
WaitForMultipleObjects
SetNamedPipeHandleState
DeviceIoControl
CreateEventW
ResetEvent
TransactNamedPipe
Sleep
WaitNamedPipeW
SetEvent
WaitForSingleObject
lstrcatW
MoveFileExW
SetWaitableTimer
CloseHandle
GetLocalTime
EnterCriticalSection
SetLastError
CreateFileW
LeaveCriticalSection
InitializeCriticalSection
WriteFile
OutputDebugStringW
GetLastError
CreateDirectoryW
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
HeapReAlloc
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
GetTickCount
QueryPerformanceCounter
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
HeapCreate
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
lstrcmpiW
FindClose
lstrcmpW
GetSystemDirectoryW
GetModuleHandleW
GetSystemWindowsDirectoryW
FindFirstFileW
GetFileTime
GetCurrentProcess
CompareFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ExitProcess
HeapSize
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
GetStringTypeW
ExitThread
GetCurrentThreadId
HeapFree
GetCommandLineA
HeapSetInformation
HeapAlloc
RaiseException
GetCPInfo
RtlUnwind
LCMapStringW
TerminateProcess
FlushFileBuffers

advapi32

CryptDecrypt
CryptDestroyKey
RevertToSelf
CryptEncrypt
ImpersonateLoggedOnUser
DuplicateTokenEx
CreateProcessAsUserW
GetTokenInformation
CryptDeriveKey
CryptAcquireContextW
RegEnumKeyExW
RegOpenCurrentUser
GetUserNameW
OpenProcessToken
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
SetEntriesInAclW
SetSecurityInfo
CryptGenRandom
BuildTrusteeWithSidW
GetSecurityInfo
SetSecurityDescriptorDacl
ConvertStringSidToSidW
InitializeSecurityDescriptor
CryptHashData
CryptDestroyHash
ReportEventW
CryptCreateHash
DeregisterEventSource
RegisterEventSourceW
CryptGetHashParam
SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW

userenv

DestroyEnvironmentBlock
GetDefaultUserProfileDirectoryW
GetProfilesDirectoryW
CreateEnvironmentBlock
GetUserProfileDirectoryW
ExpandEnvironmentStringsForUserW

shlwapi

SHRegGetPathW
PathFileExistsW
SHGetValueA
SHRegGetPathA

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

psapi

EnumProcesses
GetModuleBaseNameW
GetModuleFileNameExW

shell32

SHGetFolderPathW

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW
WTSQuerySessionInformationW

user32

CharUpperA
CharUpperW

iphlpapi

GetIpAddrTable
_PfDeleteInterface@4
_PfMakeLog@4
_PfCreateInterface@24
_PfSetLogBuffer@28
_PfUnBindInterface@4
_PfBindInterfaceToIPAddress@12
_PfDeleteLog@0
_PfAddFiltersToInterface@24

mpr

WNetGetConnectionW

mbam

ord10
ord20

mbamnet

ord12
ord26
ord10
ord9

Sections

.text
Size: 269KB - Virtual size: 269KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b93dd5480ad7255eaa848a2153c9707a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

userenv

shlwapi

version

psapi

shell32

wtsapi32

user32

iphlpapi

mpr

mbam

mbamnet

Sections

.text Size: 269KB - Virtual size: 269KB

.rdata Size: 56KB - Virtual size: 56KB

.data Size: 5KB - Virtual size: 14KB

.rsrc Size: 1024B - Virtual size: 1016B

.reloc Size: 19KB - Virtual size: 18KB

.text
Size: 269KB - Virtual size: 269KB

.rdata
Size: 56KB - Virtual size: 56KB

.data
Size: 5KB - Virtual size: 14KB

.rsrc
Size: 1024B - Virtual size: 1016B

.reloc
Size: 19KB - Virtual size: 18KB