0594c71e0ae8d0dd7e718e0c0094f0b1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0594c71e0ae8d0dd7e718e0c0094f0b1_JaffaCakes118
Size

1.4MB
MD5

0594c71e0ae8d0dd7e718e0c0094f0b1
SHA1

d86e5d4fcc1ea88b372129a01a0e0a3e34ec2230
SHA256

fc7726dfc1199d09340ae6be3f5f75dd2bc16a9b7998ab19148f0ec6142fbbc4
SHA512

83650fb1c3b7dcc4eb4265bd57818767d2911ff1b239ba2024b631cf1b79881d3bcb88a22ee90862101b359cd31da9eaabed46a53ba663fb7b7fb8d96242fb97
SSDEEP

24576:U7ET0JSBTgMCwyNam8JoV4imY3Ps9cV3SXGTneIxNsepzBgr:cE0JWrCwyNxfd34/GTeQseptE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0594c71e0ae8d0dd7e718e0c0094f0b1_JaffaCakes118

Files

0594c71e0ae8d0dd7e718e0c0094f0b1_JaffaCakes118
.exe windows:5 windows x86 arch:x86

bf51d70840d3cbe917af25bea080a006

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Development\4.0\SIMS3_32\release\AmdocsSIMS.pdb

Imports

ws2_32

WSACleanup
WSAStartup
inet_ntoa
gethostname
gethostbyname

psapi

GetProcessImageFileNameW
GetModuleFileNameExW
GetProcessMemoryInfo

netapi32

NetGetJoinInformation
DsGetDcNameW
NetApiBufferFree

rpcrt4

UuidCreate
RpcStringFreeW
UuidToStringW

userenv

ExpandEnvironmentStringsForUserW
CreateEnvironmentBlock
DestroyEnvironmentBlock

iphlpapi

GetAdaptersInfo

kernel32

FlushFileBuffers
SetNamedPipeHandleState
GetCurrentThreadId
SetFilePointer
MoveFileExW
GetProcessTimes
GetFileAttributesW
FreeLibrary
InterlockedIncrement
SystemTimeToFileTime
GetModuleHandleW
GetProcAddress
LoadLibraryA
GetSystemTime
CopyFileExW
LoadLibraryExW
FormatMessageW
WaitForMultipleObjects
ExpandEnvironmentStringsW
FindFirstFileW
GetDriveTypeW
GetLogicalDriveStringsW
ReadDirectoryChangesW
TerminateThread
lstrcpynW
FindClose
FindNextFileW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
CreateMutexW
MoveFileW
IsWow64Process
CreateFileMappingW
GetCurrentProcessId
SetThreadPriority
ResumeThread
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
EndUpdateResourceW
GetModuleFileNameW
BeginUpdateResourceW
UpdateResourceW
SetFileTime
WideCharToMultiByte
MultiByteToWideChar
GetCurrentDirectoryW
ReadFile
FindResourceW
LoadResource
CreateProcessW
SystemTimeToTzSpecificLocalTime
HeapAlloc
InterlockedDecrement
CompareFileTime
HeapFree
GetProcessHeap
LoadLibraryW
SizeofResource
DisconnectNamedPipe
ProcessIdToSessionId
LockResource
RemoveDirectoryW
QueryDosDeviceW
DuplicateHandle
GetThreadTimes
CreateFileA
GetFileSize
GetLocalTime
GetFileInformationByHandle
ExitProcess
GetVersionExW
DeviceIoControl
GetCurrentThread
ResetEvent
ReleaseMutex
GetOverlappedResult
OpenEventW
GetCurrentDirectoryA
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedExchange
InterlockedCompareExchange
SetLastError
HeapSize
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetFileType
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
FreeEnvironmentStringsA
GetEnvironmentStrings
WriteFile
WaitNamedPipeW
CreateNamedPipeW
ConnectNamedPipe
LocalFree
DeleteFileW
CloseHandle
GetFileAttributesExW
OpenFileMappingW
CreateEventW
OpenMutexW
TerminateProcess
CopyFileW
OpenProcess
SetEvent
WaitForSingleObject
CreateDirectoryW
GetCurrentProcess
UnmapViewOfFile
MapViewOfFile
FindFirstChangeNotificationW
GetLastError
lstrlenW
Sleep
GetTickCount
GetComputerNameW
FileTimeToSystemTime
CreateFileW
GetModuleHandleA
SetEnvironmentVariableW
SetEndOfFile
lstrlenA
GetCPInfo
GetTimeFormatA
GetDateFormatA
ExitThread
CreateThread
HeapReAlloc
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeW
HeapCreate
VirtualFree
VirtualAlloc
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
LocalFileTimeToFileTime
CreateDirectoryA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetEnvironmentVariableA
CompareStringW
QueryPerformanceCounter
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
CompareStringA
GetLocaleInfoW
IsValidLocale
TlsFree

user32

wsprintfW
CloseDesktop
OpenDesktopW
AttachThreadInput
GetWindowThreadProcessId
OpenWindowStationW
SetThreadDesktop
MessageBoxW
DispatchMessageW
RegisterHotKey
ShowWindow
GetLastInputInfo
PeekMessageW
SetFocus
FindWindowW
GetFocus
CloseWindowStation
GetKeyState
SetProcessWindowStation
GetProcessWindowStation
PostMessageW
GetThreadDesktop
GetDesktopWindow
GetForegroundWindow

advapi32

CryptHashData
RegSetValueExW
AdjustTokenPrivileges
CryptDestroyHash
GetLengthSid
ReportEventW
SetEntriesInAclW
CryptCreateHash
DuplicateTokenEx
LookupPrivilegeValueW
SetTokenInformation
DeregisterEventSource
RegOpenKeyW
CreateProcessAsUserW
CryptReleaseContext
CopySid
GetTokenInformation
RegCreateKeyW
CryptAcquireContextW
OpenProcessToken
RegisterEventSourceW
CryptGetHashParam
SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
CloseEventLog
ReadEventLogW
RegConnectRegistryW
LookupAccountSidW
GetNumberOfEventLogRecords
GetOldestEventLogRecord
NotifyChangeEventLog
RegQueryValueExW
OpenEventLogW
ControlService
QueryServiceStatus
StartServiceW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
RegCloseKey
BuildExplicitAccessWithNameW
RegNotifyChangeKeyValue
RegOpenKeyExW
AllocateAndInitializeSid
SetNamedSecurityInfoW
FreeSid

ole32

CoInitializeEx
CoInitializeSecurity
CoUninitialize
CoCreateInstance
CoSetProxyBlanket

oleaut32

SysAllocString
VariantClear
SysFreeString

wininet

HttpSendRequestA
HttpAddRequestHeadersA
InternetSetCookieA
InternetAttemptConnect
HttpOpenRequestA
InternetOpenA
InternetSetOptionW
HttpSendRequestW
InternetWriteFile
InternetReadFile
HttpSendRequestExW
InternetQueryOptionW
InternetConnectA
HttpSendRequestExA
HttpEndRequestW
InternetCloseHandle

sensapi

IsNetworkAlive

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Sections

.text
Size: 688KB - Virtual size: 688KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 220KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 480KB - Virtual size: 480KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bf51d70840d3cbe917af25bea080a006

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

psapi

netapi32

rpcrt4

userenv

iphlpapi

kernel32

user32

advapi32

ole32

oleaut32

wininet

sensapi

version

Sections

.text Size: 688KB - Virtual size: 688KB

.rdata Size: 220KB - Virtual size: 220KB

.data Size: 8KB - Virtual size: 19KB

.rsrc Size: 480KB - Virtual size: 480KB

.text
Size: 688KB - Virtual size: 688KB

.rdata
Size: 220KB - Virtual size: 220KB

.data
Size: 8KB - Virtual size: 19KB

.rsrc
Size: 480KB - Virtual size: 480KB