a84b58a6682b2fb23d5aedc01ae977c5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a84b58a6682b2fb23d5aedc01ae977c5_JaffaCakes118
Size

672KB
MD5

a84b58a6682b2fb23d5aedc01ae977c5
SHA1

9b6aeb1551c8e8a7b910b829afd35966165d9a94
SHA256

06c14905be0b11d75098fec16dc0dfd605a7e6582ff67a785114db50f15d057e
SHA512

e25d6f02fa6d0da371ce354a5f5dc791a0f6ce58d4bb04991f4e10fa6ceec3cbeaac61b24d834fe6699fd51c2e533641919f221a5d883e823776c8c4882f4645
SSDEEP

12288:MCMCwxOZDmLRkBUSy+9MzveFqSP1vtRNJ8/PyxX:MFsmLRkySyNe/rJ8/G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a84b58a6682b2fb23d5aedc01ae977c5_JaffaCakes118

Files

a84b58a6682b2fb23d5aedc01ae977c5_JaffaCakes118
.dll regsvr32 windows:10 windows x64 arch:x64

dfa184c50b94e22879ad88cc6fd24353

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Windows.Networking.Connectivity.pdb

Imports

msvcrt

_lock
?terminate@@YAXXZ
__C_specific_handler
_unlock
_amsg_exit
_XcptFilter
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
_initterm
??0bad_cast@@QEAA@AEBV0@@Z
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@PEBD@Z
setlocale
___mb_cur_max_func
_errno
___lc_handle_func
___lc_codepage_func
_ismbblead
memset
__pctype_func
calloc
__uncaught_exception
abort
_wcsdup
__crtLCMapStringW
_get_current_locale
_free_locale
memcmp
??0exception@@QEAA@AEBV0@@Z
_onexit
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
??1type_info@@UEAA@XZ
__dllonexit
memcpy
__CxxFrameHandler3
_CxxThrowException
_callnewh
??3@YAXPEAX@Z
??_V@YAXPEAX@Z
malloc
free
_vsnwprintf
_purecall
memmove
realloc

rpcrt4

NdrStubCall3
NdrOleAllocate
CStdStubBuffer_CountRefs
NdrStubForwardingFunction
NdrOleFree
IUnknown_QueryInterface_Proxy
RpcServerInqCallAttributesW
CStdStubBuffer_DebugServerRelease
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_AddRef
IUnknown_AddRef_Proxy
CStdStubBuffer_QueryInterface
NdrDllUnregisterProxy
NdrDllGetClassObject
NdrCStdStubBuffer2_Release
NdrDllCanUnloadNow
NdrDllRegisterProxy
UuidFromStringW
NdrCStdStubBuffer_Release
CStdStubBuffer_Disconnect
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Connect

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient11
ObjectStublessClient13
NdrProxyForwardingFunction3
ObjectStublessClient6
ObjectStublessClient10
ObjectStublessClient3
CStdStubBuffer2_QueryInterface
ObjectStublessClient9
ObjectStublessClient7
CStdStubBuffer2_CountRefs
ObjectStublessClient15
ObjectStublessClient8
ObjectStublessClient17
NdrProxyForwardingFunction5
CStdStubBuffer2_Disconnect
CStdStubBuffer2_Connect
ObjectStublessClient12
ObjectStublessClient14
ObjectStublessClient16
NdrProxyForwardingFunction4

api-ms-win-core-winrt-string-l1-1-0

WindowsDuplicateString
WindowsCreateString
WindowsDeleteString
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsCreateStringReference
HSTRING_UserSize64
HSTRING_UserMarshal64
HSTRING_UserFree
WindowsGetStringRawBuffer
HSTRING_UserSize
HSTRING_UserFree64
HSTRING_UserMarshal
HSTRING_UserUnmarshal
HSTRING_UserUnmarshal64

api-ms-win-core-winrt-error-l1-1-1

RoOriginateErrorW
RoReportFailedDelegate
RoTransformError
RoOriginateError
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
SetRestrictedErrorInfo
GetRestrictedErrorInfo

api-ms-win-core-com-l1-1-1

CoReleaseMarshalData
IIDFromString
StringFromGUID2
CoDecrementMTAUsage
CreateStreamOnHGlobal
CoMarshalInterface
CoRevertToSelf
CoCreateInstance
CoCreateFreeThreadedMarshaler
RoGetAgileReference
CoTaskMemAlloc
CoImpersonateClient
CoGetCallContext
CoTaskMemFree
CoIncrementMTAUsage

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-processthreads-l1-1-2

OpenProcess
OpenProcessToken
OpenThreadToken
GetCurrentThread
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-libraryloader-l1-2-0

LoadResource
LoadLibraryExW
LoadStringW
GetModuleHandleW
GetModuleFileNameW
DisableThreadLibraryCalls
GetProcAddress
LockResource
GetModuleFileNameA
SizeofResource
GetModuleHandleExW
FreeLibrary

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
RaiseException
SetLastError
UnhandledExceptionFilter
GetLastError

api-ms-win-core-debug-l1-1-1

OutputDebugStringW

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-2-0

CreateEventExW
InitOnceExecuteOnce
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
EnterCriticalSection
WaitForSingleObject
AcquireSRWLockExclusive
SetEvent
InitializeSRWLock
CreateEventW
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeCriticalSection
DeleteCriticalSection
Sleep
LeaveCriticalSection

api-ms-win-core-rtlsupport-l1-2-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoInitialize
RoActivateInstance
RoUninitialize

api-ms-win-core-string-l1-1-0

CompareStringEx
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegGetValueW
RegOpenKeyExW
RegQueryValueExW
RegEnumValueW
RegCloseKey

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-threadpool-l1-2-0

TrySubmitThreadpoolCallback
CallbackMayRunLong
FreeLibraryWhenCallbackReturns
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
CreateThreadpoolWork

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-security-base-l1-2-0

GetTokenInformation

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabledForPackage
QuirkIsEnabledForProcess

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW

ntdll

RtlLoadString
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlQueryPackageIdentity
RtlCapabilityCheck
RtlInitUnicodeString
RtlNtStatusToDosError
wcsncpy_s
memmove_s
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
NtQueryWnfStateData
strchr

shcore

SHCreateMemStream
CreateRandomAccessStreamOverStream

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

api-ms-win-core-heap-l1-2-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllRegisterServer
DllUnregisterServer
SetHostNameMediaStreamingMode

Sections

.text
Size: 390KB - Virtual size: 389KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 233KB - Virtual size: 233KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dfa184c50b94e22879ad88cc6fd24353

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

rpcrt4

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-com-l1-1-1

api-ms-win-core-localization-l1-2-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l2-1-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-quirks-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-shlwapi-legacy-l1-1-0

ntdll

shcore

api-ms-win-core-heap-l2-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 390KB - Virtual size: 389KB

.rdata Size: 233KB - Virtual size: 233KB

.data Size: 1KB - Virtual size: 4KB

.pdata Size: 23KB - Virtual size: 23KB

.didat Size: 1024B - Virtual size: 576B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 20KB

.text
Size: 390KB - Virtual size: 389KB

.rdata
Size: 233KB - Virtual size: 233KB

.data
Size: 1KB - Virtual size: 4KB

.pdata
Size: 23KB - Virtual size: 23KB

.didat
Size: 1024B - Virtual size: 576B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 20KB