311959da7b16b2c3f36f44432dce6221_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

311959da7b16b2c3f36f44432dce6221_JaffaCakes118
Size

6.9MB
MD5

311959da7b16b2c3f36f44432dce6221
SHA1

5cb632726a6e6fdba25e15fd9107bf63e22310a3
SHA256

f746d425f0e4d78a28bd5d8afc70d263ac0351f3a3a5481c067c0000c59a6576
SHA512

158b663528ddf1ca681b2b01694729820c4a51dd72fc8a946b149997bb9b0ea8ff08a1ab9ef7c14e919192f6987e407bbfe43e849414b1efeaf178f5a2eb3ac3
SSDEEP

196608:MxbGhcyAAjf7lG2lUCO18b4Vmp814HbsIWLS8fi8trGev+Sufl7WSGv8Q:MUWFAb7lG2E18EV58b7Wu8aCr1+SQWSA

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/miniZ.exe
unpack001/miniZ_gui.exe

Files

311959da7b16b2c3f36f44432dce6221_JaffaCakes118
.zip
miniZ.exe
.exe windows:6 windows x64 arch:x64

9c6e2c0545f96f6cd98c8bf16b2c2b8d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

wsock32

WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
listen
htonl
bind
accept
closesocket
gethostbyname
socket
setsockopt
send
recv
htons
connect
gethostname

crypt32

CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetCertificateContextProperty

advapi32

CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptGenRandom

kernel32

DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
SignalObjectAndWait
CreateTimerQueue
InitializeSListHead
IsDebuggerPresent
GetNumaHighestNodeNumber
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LCMapStringW
CompareStringW
GetCPInfo
CreateEventW
InitializeCriticalSectionAndSpinCount
DecodePointer
EncodePointer
SetThreadAffinityMask
RtlPcToFileHeader
RegisterWaitForSingleObject
UnregisterWait
ExpandEnvironmentStringsA
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetTickCount
ReleaseSemaphore
GetModuleHandleA
GetProcAddress
CreateEventA
OpenEventA
SetEvent
ResetEvent
GetCurrentThreadId
Sleep
GetCurrentProcessId
WaitForSingleObjectEx
CloseHandle
GetProcessHeap
HeapAlloc
HeapFree
GetLastError
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLogicalProcessorInformation
LocalFree
FormatMessageA
OpenProcess
GetVersionExA
FreeLibrary
LoadLibraryA
RaiseException
SetUnhandledExceptionFilter
WaitForSingleObject
GetCurrentProcess
CreateThread
GetModuleFileNameW
MultiByteToWideChar
GetEnvironmentVariableA
SetEnvironmentVariableA
SetErrorMode
LoadLibraryExW
SetLastError
GetSystemTime
GetStdHandle
GetFileType
WriteFile
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
FindClose
FindFirstFileW
FindNextFileW
WideCharToMultiByte
ConvertFiberToThread
ConvertThreadToFiber
QueryPerformanceCounter
GlobalMemoryStatus
GetEnvironmentVariableW
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
DuplicateHandle
GetCurrentThread
SetThreadPriority
GetThreadPriority
GetThreadContext
SetThreadContext
GetSystemDirectoryA
GetProcessAffinityMask
WaitForMultipleObjects
CreateSemaphoreA
QueryPerformanceFrequency
VirtualAlloc
VirtualFree
VirtualProtect
GetNativeSystemInfo
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
SwitchToThread
HeapDestroy
FreeLibraryAndExitThread
HeapCreate
LocalAlloc
GetSystemDirectoryW
GetThreadTimes
GetVersionExW
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
GetExitCodeThread

user32

GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW

vcruntime140

__RTDynamicCast
strchr
memcmp
__std_type_info_compare
__C_specific_handler
wcsstr
strrchr
longjmp
__uncaught_exception
__vcrt_InitializeCriticalSectionEx
__intrinsic_setjmp
__processing_throw
__current_exception
__std_exception_copy
memmove
__std_terminate
_purecall
__AdjustPointer
strstr
memchr
memset
memcpy
__CxxFrameHandler3
_CxxThrowException
__std_exception_destroy

api-ms-win-crt-runtime-l1-1-0

_set_app_type
system
_get_initial_narrow_environment
_initterm
_initterm_e
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
signal
_beginthreadex
_seh_filter_exe
exit
_crt_atexit
_register_onexit_function
_cexit
_exit
_invalid_parameter_noinfo_noreturn
strerror_s
_initialize_onexit_table
_invalid_parameter_noinfo
abort
raise
_initialize_narrow_environment
terminate
_configure_narrow_argv
_endthreadex
perror
_errno
strerror

api-ms-win-crt-string-l1-1-0

_strdup
isxdigit
strspn
strncpy
strtok
isupper
toupper
strncat_s
_strnicmp
_strupr
_wcsdup
_stricmp
iswprint
islower
tolower
isdigit
strncmp
__strncnt
strcspn
strcmp
isspace

api-ms-win-crt-heap-l1-1-0

_calloc_base
malloc
realloc
_callnewh
_set_new_mode
_free_base
free
calloc
_malloc_base

api-ms-win-crt-math-l1-1-0

pow
ldexp
frexp
sqrt
exp
log10
powf
__setusermatherr

api-ms-win-crt-stdio-l1-1-0

setvbuf
fwrite
fclose
fopen
fputs
putc
_fsopen
_fseeki64
__acrt_iob_func
__stdio_common_vfprintf
fsetpos
ungetc
__stdio_common_vsprintf_s
__stdio_common_vsprintf
__stdio_common_vswprintf
_get_stream_buffer_pointers
fflush
fgetc
_wfopen
__stdio_common_vsscanf
fgetpos
feof
_set_fmode
_setmode
ftell
fseek
fread
_fileno
fputc
__p__commode
fgets
ferror

api-ms-win-crt-locale-l1-1-0

___lc_collate_cp_func
_configthreadlocale
setlocale
localeconv
___mb_cur_max_func
_lock_locales
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_unlock_locales

api-ms-win-crt-convert-l1-1-0

strtol
strtoul
strtof
strtod
atof
atoi

api-ms-win-crt-time-l1-1-0

_localtime64
strftime
_gmtime64
_Gettnames
_ftime64_s
_Strftime
_time64

api-ms-win-crt-utility-l1-1-0

rand_s
rand
qsort
div
srand

api-ms-win-crt-filesystem-l1-1-0

_stat64i32
_unlock_file
_lock_file

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-multibyte-l1-1-0

_ismbblead

Exports

Exports

NvOptimusEnablementCuda

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 894KB - Virtual size: 893KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 164KB - Virtual size: 498KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ctors
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dtors
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.nv_fatb
Size: 22.5MB - Virtual size: 22.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.nvFatBi
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
miniZ.exe.sha256sum
miniZ_gui.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 377KB - Virtual size: 377KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
miniZ_gui.exe.sha256sum

Sharing

General

Malware Config

Signatures

Files

9c6e2c0545f96f6cd98c8bf16b2c2b8d

Headers

DLL Characteristics

File Characteristics

Imports

wsock32

crypt32

advapi32

kernel32

user32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

Exports

Exports

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 894KB - Virtual size: 893KB

.data Size: 164KB - Virtual size: 498KB

.pdata Size: 110KB - Virtual size: 109KB

.ctors Size: 512B - Virtual size: 8B

.dtors Size: 512B - Virtual size: 8B

.nv_fatb Size: 22.5MB - Virtual size: 22.5MB

.nvFatBi Size: 512B - Virtual size: 192B

.gfids Size: 2KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 26KB - Virtual size: 26KB

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 377KB - Virtual size: 377KB

.rsrc Size: 39KB - Virtual size: 38KB

.reloc Size: 512B - Virtual size: 12B

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 894KB - Virtual size: 893KB

.data
Size: 164KB - Virtual size: 498KB

.pdata
Size: 110KB - Virtual size: 109KB

.ctors
Size: 512B - Virtual size: 8B

.dtors
Size: 512B - Virtual size: 8B

.nv_fatb
Size: 22.5MB - Virtual size: 22.5MB

.nvFatBi
Size: 512B - Virtual size: 192B

.gfids
Size: 2KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 26KB - Virtual size: 26KB

.text
Size: 377KB - Virtual size: 377KB

.rsrc
Size: 39KB - Virtual size: 38KB

.reloc
Size: 512B - Virtual size: 12B