fab9021981e0ea7a32eb7ba6865e954d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fab9021981e0ea7a32eb7ba6865e954d_JaffaCakes118
Size

1.0MB
MD5

fab9021981e0ea7a32eb7ba6865e954d
SHA1

ad3c604fc3345c5353f2ccde2054fefe2069cc2a
SHA256

9bbc2f02e64462e44d44258e154aa45d2ed9fb2ab76f2169c9bfa604f5df52fc
SHA512

35648f8bda243a9ce7685ea681bead11c6b3e4eb35d8207f42ce79db5f4c37ef62f1913c00ae3d19cbb9e7f327e580e134743798f5678ded04a4fc5f33fd6b24
SSDEEP

24576:szK44rS1doXLrP45xvS4z+mtBzwzFhezdUi80epimHyBYA:szP1OrAzdtAhezdUAepFyBYA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fab9021981e0ea7a32eb7ba6865e954d_JaffaCakes118

Files

fab9021981e0ea7a32eb7ba6865e954d_JaffaCakes118
.exe windows:10 windows x86 arch:x86

da0fd4d70eaa0a58643b0554d13b3f15

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

SearchIndexer.pdb

Imports

msvcrt

_free_locale
_get_current_locale
__crtLCMapStringW
__crtCompareStringW
_wcsdup
abort
memcmp
__pctype_func
memset
___lc_codepage_func
??1exception@@UAE@XZ
___lc_handle_func
___mb_cur_max_func
___lc_collate_cp_func
setlocale
toupper
wcstok
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
strchr
??0exception@@QAE@XZ
vswprintf_s
_vscwprintf
_wcslwr_s
wcspbrk
qsort
_get_errno
_set_errno
bsearch
??0exception@@QAE@ABV0@@Z
_controlfp
memcpy_s
_errno
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
strncmp
_unlock
_lock
?terminate@@YAXXZ
_acmdln
_vsnprintf_s
_initterm
__setusermatherr
swscanf
towupper
_wtol
wcschr
iswxdigit
_ismbblead
__p__fmode
_cexit
iswspace
memmove_s
_exit
exit
__set_app_type
__getmainargs
wcstol
_vsnwprintf
_wcsicmp
_amsg_exit
__p__commode
_XcptFilter
wcsstr
memmove
free
_wcsnicmp
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
calloc
wcsncpy_s
malloc
wcscat_s
wcscpy_s
wcsncmp
realloc
__CxxFrameHandler3

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
LockResource
LoadStringW
FreeLibrary
LoadResource
GetModuleFileNameA
LoadLibraryExW
GetModuleHandleW
SizeofResource
GetProcAddress
FindStringOrdinal
FindResourceExW
GetModuleHandleExW

api-ms-win-core-file-l1-1-0

GetFileAttributesExW
GetFileTime
RemoveDirectoryW
FindVolumeClose
GetVolumeInformationW
DeleteFileW
CreateDirectoryW
FindFirstFileExW
FindNextVolumeW
GetDriveTypeW
FindNextFileW
FindClose
GetLogicalDrives
CompareFileTime
SetFileTime
FindFirstVolumeW
FindFirstFileW
SetFileAttributesW
CreateFileW
GetFileAttributesW

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
Sleep
InitOnceComplete
WakeAllConditionVariable
InitOnceExecuteOnce
InitOnceBeginInitialize
InitOnceInitialize

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
SetEvent
CreateMutexW
DeleteCriticalSection
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockExclusive
CreateSemaphoreExW
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
CreateMutexExW
InitializeCriticalSection
WaitForSingleObjectEx
WaitForSingleObject
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
OpenEventW
ReleaseMutex
AcquireSRWLockShared
TryAcquireSRWLockExclusive
CreateEventW

api-ms-win-core-heap-l1-1-0

HeapSize
HeapDestroy
HeapFree
HeapAlloc
GetProcessHeap
HeapReAlloc
HeapSetInformation

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetErrorMode
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-com-l1-1-0

CoImpersonateClient
CoUninitialize
CoRevertToSelf
PropVariantClear
StringFromGUID2
IIDFromString
CLSIDFromString
CoMarshalInterface
CoGetMalloc
CoTaskMemAlloc
CoInitializeEx
CoTaskMemRealloc
CoCreateInstance
CoRevokeClassObject
CoTaskMemFree
CoInitializeSecurity
CoCreateFreeThreadedMarshaler
CoRegisterClassObject

api-ms-win-core-io-l1-1-0

DeviceIoControl

ntdll

RtlGetPersistedStateLocation
RtlIsStateSeparationEnabled
RtlQueryWnfStateData
RtlUnsubscribeWnfStateChangeNotification
RtlQueryPackageClaims
RtlSubscribeWnfStateChangeNotification
NtOpenFile
RtlGetDeviceFamilyInfoEnum
RtlInitUnicodeString
RtlNtStatusToDosError
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
TlsFree
GetCurrentProcess
GetCurrentThread
GetStartupInfoW
OpenProcessToken
CreateThread
TerminateProcess
TlsAlloc
SetPriorityClass
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteTreeW
RegDeleteValueW
RegQueryValueExW
RegOpenKeyExW
RegGetKeySecurity
RegEnumValueW
RegDeleteKeyExW
RegSetValueExW
RegCreateKeyExW

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
GetSystemPreferredUILanguages
ResolveLocaleName
FormatMessageW
GetNLSVersionEx
GetSystemDefaultLCID
LocaleNameToLCID
LCMapStringW

oleaut32

SafeArrayDestroy
SysFreeString
SysStringByteLen
VariantClear
LoadRegTypeLi
SafeArrayGetUBound
SysAllocStringByteLen
VarUI4FromStr
VariantInit
LoadTypeLi
SysAllocStringLen
SysStringLen
SysAllocString
VarBstrCat
SafeArrayGetElement

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW
DebugBreak

api-ms-win-core-shlwapi-legacy-l1-1-0

PathSkipRootW
PathCanonicalizeW
PathIsUNCServerW
PathIsRootW
PathAddBackslashW
PathFindNextComponentW
PathRemoveBackslashW
PathIsUNCW
PathStripToRootW
PathFileExistsW
PathIsUNCServerShareW
PathAppendW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-file-l1-2-0

GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar
GetStringTypeW
CompareStringW

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
SetEnvironmentVariableW
SearchPathW
ExpandEnvironmentStringsW
GetEnvironmentVariableW

api-ms-win-shell-shdirectory-l1-1-0

ord290

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventUnregister
EventEnabled
EventSetInformation
EventActivityIdControl
EventProviderEnabled

api-ms-win-shcore-registry-l1-1-0

SHSetValueW
SHGetValueW
SHDeleteKeyW
SHCopyKeyW

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetVersionExA
GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW
GetTickCount64

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-processthreads-l1-1-1

SetProcessMitigationPolicy
OpenProcess

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenSCManagerW
OpenServiceW

api-ms-win-core-localization-obsolete-l1-2-0

GetSystemDefaultUILanguage
GetUserDefaultUILanguage

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

tquery

ciNew
ciDelete
ciNewNoThrow

shcore

ord1
SHStrDupW

mssrch

?GetFileChangeClientManagerInstance@@YA?AV?$shared_ptr@UIFileChangeClientManager@ChangeTracking@Windows@@@std@@XZ
??1CSearchServiceObj@@QAE@XZ
??0CSearchServiceObj@@QAE@XZ
?Cleanup@CSearchServiceObj@@SGXXZ

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpNICW
StrStrIW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-path-l1-1-0

PathCchSkipRoot

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW
GetSystemPowerStatus

api-ms-win-service-core-l1-1-1

EnumDependentServicesW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus
ControlService

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW

rpcrt4

I_RpcBindingInqLocalClientPID

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
UnmapViewOfFile
MapViewOfFile

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W

api-ms-win-shcore-stream-l1-1-0

SHCreateMemStream

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-appmodel-runtime-l1-1-1

GetApplicationUserModelIdFromToken

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsDeleteString

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

Sections

.text
Size: 595KB - Virtual size: 595KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 376B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 436KB - Virtual size: 632KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

da0fd4d70eaa0a58643b0554d13b3f15

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-io-l1-1-0

ntdll

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-localization-l1-2-0

oleaut32

api-ms-win-shcore-taskpool-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-shell-shdirectory-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-shcore-registry-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-service-management-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-apiquery-l1-1-0

tquery

shcore

mssrch

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-service-core-l1-1-1

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

rpcrt4

api-ms-win-core-memory-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-service-core-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-shcore-stream-l1-1-0

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-appmodel-runtime-l1-1-1

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-psapi-l1-1-0

Sections

.text Size: 595KB - Virtual size: 595KB

.data Size: 3KB - Virtual size: 10KB

.idata Size: 13KB - Virtual size: 12KB

.didat Size: 512B - Virtual size: 376B

.rsrc Size: 2KB - Virtual size: 2KB

.text
Size: 595KB - Virtual size: 595KB

.data
Size: 3KB - Virtual size: 10KB

.idata
Size: 13KB - Virtual size: 12KB

.didat
Size: 512B - Virtual size: 376B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 436KB - Virtual size: 632KB