639774c9acd063f028f6084abf5593ad_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

639774c9acd063f028f6084abf5593ad_JaffaCakes118
Size

67KB
MD5

639774c9acd063f028f6084abf5593ad
SHA1

1ab1e31fe9f3347f68b1eee8ff02f525fc46ccc9
SHA256

9dfd80610cbbc9188f6c6bc85c87016b0ae42254fc289c2b578e85282bdd9c23
SHA512

b2e88c559b369024144285dcf145d64e3d360eefa4300e497f259e38f9fade7408444165fd34038181b97651121eac99bf3e76575b341c7a79fde6d5b0ed5cd5
SSDEEP

1536:rt/5yic0Zd7u+6ISspEnIKSCf0NEFtkyrJQeA:rt/fRu+fpEnIKSCf0NEFWyW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
639774c9acd063f028f6084abf5593ad_JaffaCakes118

Files

639774c9acd063f028f6084abf5593ad_JaffaCakes118
.exe windows:6 windows x64 arch:x64

d9c431646227dba4b6b2a1313802ed63

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

taskhost.pdb

Imports

msvcrt

??0exception@@QEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
memcpy_s
??0exception@@QEAA@AEBQEBDH@Z
_CxxThrowException
_callnewh
__CxxFrameHandler3
??1type_info@@UEAA@XZ
_initterm
_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
_unlock
_lock
?what@exception@@UEBAPEBDXZ
_purecall
malloc
calloc
free
memmove_s
__C_specific_handler
_XcptFilter
_exit
_onexit
_cexit
__wgetmainargs
exit
??0exception@@QEAA@AEBV0@@Z
_wcmdln
__dllonexit
memset

ntdll

EtwTraceMessage
RtlUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
DbgPrintEx
RtlCaptureContext

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance
CoEnableCallCancellation
CoDisableCallCancellation
CoCancelCall
CoInitializeSecurity

oleaut32

SysAllocString
SysFreeString

kernel32

HeapSize
Sleep
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
WaitForSingleObject
GetLastError
ResetEvent
CreateEventW
CloseHandle
HeapAlloc
HeapFree
HeapDestroy
HeapCreate
InitOnceExecuteOnce
SetLastError
SetProcessShutdownParameters
SetEvent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeSRWLock
IsDebuggerPresent
DeleteAtom
CreateThread
GetTickCount64
GetCurrentThread
SetThreadPriority
GetExitCodeThread
GetThreadPriority
CreateTimerQueueTimer
DeleteTimerQueueTimer
LocalFree
OutputDebugStringA
HeapReAlloc
GetProcessHeap

api-ms-win-core-localregistry-l1-1-0

RegGetValueW

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken

api-ms-win-security-base-l1-1-0

GetSecurityDescriptorSacl
AddAce
InitializeSid
GetSidLengthRequired
IsValidSid
GetSecurityDescriptorOwner
SetSecurityDescriptorOwner
MakeAbsoluteSD
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorControl
GetSecurityDescriptorGroup
SetSecurityDescriptorGroup
GetSidSubAuthority
GetLengthSid
InitializeAcl
CopySid
GetTokenInformation
FreeSid
AllocateAndInitializeSid
GetSecurityDescriptorDacl
GetAclInformation

user32

ShowWindow
LoadStringW
ShutdownBlockReasonDestroy
PeekMessageW
TranslateMessage
ShutdownBlockReasonCreate
CreateWindowExW
UnregisterClassW
PostQuitMessage
DestroyWindow
EnumThreadWindows
GetWindowThreadProcessId
IsWindow
EnumWindows
PostMessageW
RegisterClassW
UpdateWindow
DefWindowProcW
DispatchMessageW
MsgWaitForMultipleObjects

rpcrt4

RpcAsyncCancelCall
RpcStringBindingComposeW
RpcAsyncCompleteCall
NdrClientCall2
NdrAsyncClientCall
RpcBindingSetAuthInfoExW
RpcBindingFree
RpcStringFreeW
RpcAsyncInitializeHandle
RpcBindingFromStringBindingW

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d9c431646227dba4b6b2a1313802ed63

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

ole32

oleaut32

kernel32

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-base-l1-1-0

user32

rpcrt4

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 21KB - Virtual size: 21KB

.data Size: 2KB - Virtual size: 2KB

.pdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 276B

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 21KB - Virtual size: 21KB

.data
Size: 2KB - Virtual size: 2KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 276B