fa3399e4ebcafaf1638e87cb0fa9d8ca_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

fa3399e4ebcafaf1638e87cb0fa9d8ca_JaffaCakes118
Size

258KB
MD5

fa3399e4ebcafaf1638e87cb0fa9d8ca
SHA1

98f360f739dcbb37c38c240a7797c97f05543c41
SHA256

105346e3d5d1ce706e49636bf21527a3e7896c21ffeb064488932e73aa1ceebe
SHA512

a311f334352c7b23934e799e9c714663b5f199a31dcf4f33de3554162b6bee8e88e1e03b9f8519e75404e2ae8514ee7ef5cb71b791fd5bdd2ef8b820def6f01a
SSDEEP

6144:h4QXfCj8hp6OFIyxYBguY3j07Sodt7fnfDWREUGOBNNkZ61q:LuYMXI9uYySofffabrBNNkU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa3399e4ebcafaf1638e87cb0fa9d8ca_JaffaCakes118

Files

fa3399e4ebcafaf1638e87cb0fa9d8ca_JaffaCakes118
.dll windows:6 windows x64 arch:x64

9f0855dc4442fd71ba40c4087a67f916

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemTimeAsFileTime
IsValidCodePage
QueryActCtxW
ReleaseActCtx
CreateActCtxW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetTickCount
CreateThread
Sleep
CreateMutexA
WaitForSingleObject
ReleaseMutex
GetProcessHeap
HeapFree
HeapAlloc
GetLastError
CloseHandle
ReadFile
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetFullPathNameA
GetFileSize
FindNextFileA
FindNextChangeNotification
FindFirstFileA
FindFirstChangeNotificationA
FindCloseChangeNotification
FindClose
CreateFileW
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead

gdi32

CreatePenIndirect
CreateFontIndirectA
DeleteObject
CreatePalette
CreateEllipticRgn
CreateBrushIndirect
CreateBitmap
CreateRectRgn
CreateSolidBrush
GetStockObject
CreatePolygonRgn
CombineTransform
GetEnhMetaFileW
DeleteEnhMetaFile
RemoveFontMemResourceEx
AddFontMemResourceEx
Chord

advapi32

GetFileSecurityW
ObjectOpenAuditAlarmW
CredEnumerateW
CredFree
ObjectCloseAuditAlarmW

shell32

SHGetFolderPathA

shlwapi

SHRegGetValueW
SHRegCreateUSKeyA
SHRegCloseUSKey
AssocQueryStringByKeyA
UrlGetPartA
PathGetArgsA

dbghelp

ImageDirectoryEntryToDataEx
MakeSureDirectoryPathExists
SymGetModuleBase64
SymGetLineFromName64
SymInitialize
SymSetContext
SymFromName
SymCleanup

imm32

ImmGetCompositionStringA
ImmGetProperty
ImmCreateContext
ImmInstallIMEA
ImmDestroyContext
ImmSetCompositionStringA
ImmGetCompositionFontA
ImmNotifyIME

winmm

joyGetDevCapsA
joyGetNumDevs
timeGetDevCaps
midiInGetID
midiOutGetID
midiOutClose
midiOutGetErrorTextA
midiOutGetNumDevs
midiConnect
midiDisconnect
midiOutOpen

rpcrt4

MesEncodeIncrementalHandleCreate
MesHandleFree
MesDecodeBufferHandleCreate
MesEncodeFixedBufferHandleCreate
MesIncrementalHandleReset
MesDecodeIncrementalHandleCreate
I_RpcMapWin32Status

vcruntime140

strstr
__std_exception_copy
__std_exception_destroy
_CxxThrowException
strrchr
memchr
memcmp
memcpy
memmove
memset
__C_specific_handler
__std_type_info_destroy_list
strchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_set_errno
_errno
_invalid_parameter_noinfo_noreturn
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
strerror

api-ms-win-crt-string-l1-1-0

_strdup
strncpy_s
_strnicmp
strncmp
strncat
_stricmp
wcsncpy
wcsncat
isxdigit
isspace
strncpy
_wcsnicmp

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc
realloc
calloc

api-ms-win-crt-utility-l1-1-0

qsort
srand
rand

api-ms-win-crt-convert-l1-1-0

_ultoa
_itoa
_ltoa
strtoul
_itow
_ltow
_ultow
strtol

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

ftell
fseek
__stdio_common_vsscanf
fopen
fclose
_close
_open
_read
__acrt_iob_func
fread
__stdio_common_vsprintf
__stdio_common_vfscanf
__stdio_common_vfprintf
fwrite

api-ms-win-crt-filesystem-l1-1-0

_access
_stat64i32
_mkdir
_fstat64i32
remove
_chmod

api-ms-win-crt-math-l1-1-0

log

Exports

Exports

close_tcp

Sections

.text
Size: 220KB - Virtual size: 219KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9f0855dc4442fd71ba40c4087a67f916

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

gdi32

advapi32

shell32

shlwapi

dbghelp

imm32

winmm

rpcrt4

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 220KB - Virtual size: 219KB

.rdata Size: 31KB - Virtual size: 31KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 4KB - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 132B

.text
Size: 220KB - Virtual size: 219KB

.rdata
Size: 31KB - Virtual size: 31KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 4KB - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 132B