00b52118a8790a58b9b484eec5814e1e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

00b52118a8790a58b9b484eec5814e1e_JaffaCakes118
Size

387KB
MD5

00b52118a8790a58b9b484eec5814e1e
SHA1

f5a2aaa51960ec1154dec86731024a91c40ce79d
SHA256

39f2ff8970b1bf8a8119b9f5853c587201504cd4abeb5bfbc0bd2fa04c5accf5
SHA512

180e2a0158c1b5aec1b31df2ea127370d184d98028053c32de1dc9d546e6c097012514c120bb0388a5c28a3cc51b8de22b66cbefd32ded3c823f1dbda4d8b89a
SSDEEP

12288:/8WrJlOoAq5YG/MK/f9k4b4T2zFNUSOB:UWrJL3MKtP4UNx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00b52118a8790a58b9b484eec5814e1e_JaffaCakes118

Files

00b52118a8790a58b9b484eec5814e1e_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f3b84bfad2b2f69c33b42e22f39b825a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

??4__non_rtti_object@@QAEAAV0@ABV0@@Z
??_Fbad_cast@@QAEXXZ
_yn
_getw
_safe_fprem1
__crtGetStringTypeW
_ismbcupper
_telli64
??_U@YAPAXI@Z
_stricmp
_getdrives
_spawnvpe
getc
_wfdopen
_fileno
__CxxExceptionFilter
perror
iswascii
_cwprintf
_iob
_CxxThrowException
iswprint
__p__environ
fabs
sscanf
memcmp
wcscpy
_mbctolower
_cexit
_unloaddll
_getwche
_lfind
__p__pctype
_errno
div
_strupr
_ungetch
_ismbcl0
__p__winminor
_snprintf
??_Eexception@@UAEPAXI@Z
_wperror

cfgmgr32

CM_Set_HW_Prof_FlagsA
CM_Get_Sibling_Ex
CM_Get_Device_ID_List_Size_ExA
CM_Get_Hardware_Profile_Info_ExA
CM_Get_Device_IDA
CM_Get_DevNode_Registry_PropertyA
CMP_RegisterNotification
CM_Register_Device_InterfaceW
CM_Set_HW_Prof_Flags_ExW
CM_Get_Class_Key_NameW
CM_Get_Device_Interface_List_ExW
CM_Delete_Class_Key
CM_Get_Class_Name_ExW
CM_Detect_Resource_Conflict
CM_Query_And_Remove_SubTree_ExW
CM_Enable_DevNode_Ex
CM_Get_Res_Des_Data_Size
CM_Enumerate_Classes
CM_Register_Device_Driver
CM_Query_Arbitrator_Free_Data_Ex
CM_Get_Device_Interface_Alias_ExA
CM_Add_Empty_Log_Conf_Ex
CM_Move_DevNode_Ex
CM_Open_Class_Key_ExA
CM_Get_DevNode_Status
CM_Unregister_Device_InterfaceW
CM_Get_DevNode_Registry_Property_ExA
CM_Get_Class_Registry_PropertyW
CM_Get_Next_Res_Des
CM_Get_Device_Interface_List_SizeW
CM_Set_DevNode_Registry_Property_ExA
CM_Create_Range_List
CM_Set_HW_Prof
CM_Get_HW_Prof_Flags_ExW
CM_Move_DevNode
CM_Create_DevNodeW
CM_Get_Device_Interface_List_SizeA
CM_Set_Class_Registry_PropertyW
CM_Get_Device_Interface_List_Size_ExA
CM_Get_Device_Interface_List_ExA
CM_Query_Remove_SubTree
CM_Add_IDW
CM_Get_Global_State
CM_Delete_DevNode_Key_Ex
CM_Reenumerate_DevNode_Ex

msvcrt40

tolower
?name@type_info@@QBEPBDXZ
asctime
_spawnl
?overflow@strstreambuf@@UAEHH@Z
_strnset
??_Gostream_withassign@@UAEPAXI@Z
?read@istream@@QAEAAV1@PAEH@Z
_wsopen
??4exception@@QAEAAV0@ABV0@@Z
memset
_outp
?x_maxbit@ios@@0JA
?set_unexpected@@YAP6AXXZP6AXXZ@Z
_mbbtombc
??_8ostream@@7B@
_wexecve
_mbsbtype
__RTCastToVoid
_wexecvp
??1istrstream@@UAE@XZ
ldiv
_toupper
??_7ostream_withassign@@6B@
wcsftime
??0fstream@@QAE@XZ
_atoldbl
_memicmp
_fileinfo
?setrwbuf@stdiobuf@@QAEHHH@Z

kernel32

GetCurrentThread
TerminateThread
FileTimeToDosDateTime
GetEnvironmentStringsW
LoadLibraryA
GetThreadContext
FindAtomA
IsProcessInJob
InitializeCriticalSection
GetProcessWorkingSetSize
SetFirmwareEnvironmentVariableA
RtlFillMemory
FindResourceExW
Toolhelp32ReadProcessMemory
EnumUILanguagesW
HeapReAlloc
GetWriteWatch
SetSystemTimeAdjustment
SetConsoleKeyShortcuts
EnumerateLocalComputerNamesW
GetVolumeInformationA
FindVolumeMountPointClose
DebugBreak
VirtualAlloc
WriteProcessMemory
GetStartupInfoA
LCMapStringA
InitializeCriticalSectionAndSpinCount
IsSystemResumeAutomatic
GetTempFileNameW
EnumResourceNamesW
GetPrivateProfileStringW
TlsGetValue
SetHandleInformation
Process32NextW
ReplaceFileA
GetNextVDMCommand
ReadConsoleInputW
HeapCreate
IsBadHugeReadPtr

opengl32

wglUseFontBitmapsA
wglCreateLayerContext
glIsTexture
glGetIntegerv
glClearAccum
glTexCoord4f
glMultMatrixd
glBindTexture
glTexCoord2i
glEdgeFlagPointer
glIndexiv
glRasterPos2f
wglSwapLayerBuffers
glRasterPos3d
glIndexPointer
glRasterPos4s
glTexImage1D
glTexCoord1s
glTexCoord1d
glVertex3iv
glPopClientAttrib
glEdgeFlag
glGetTexGeniv
glTexCoord3iv
glIndexi
glColor4usv
glIndexsv
glColor3s
glAccum
glInitNames
glColor4f
glTexParameteriv
glTexEnvf
glTexCoord3f
glPixelZoom
wglGetCurrentContext

gdi32

EngCheckAbort
CopyEnhMetaFileA
CreateCompatibleBitmap
GdiConvertBitmapV5
DPtoLP
GdiQueryFonts
EnumFontFamiliesExW
DdEntry23
GetObjectW
GetEnhMetaFileHeader
STROBJ_bGetAdvanceWidths
GdiSetAttrs
GdiConsoleTextOut
SetViewportOrgEx
CreateRectRgn
GdiEntry7
Rectangle
GdiProcessSetup
EnumFontsA
GetCharWidthFloatW
FONTOBJ_pvTrueTypeFontFile
ScaleViewportExtEx
GetTextMetricsW
GetFontData
FONTOBJ_cGetGlyphs
DdEntry31
Pie
Polyline
GetTextExtentPointI
BeginPath
PolyDraw
SelectClipRgn
CreateDIBitmap
CreateBitmapIndirect
AnyLinkedFonts
GdiSetBatchLimit
bMakePathNameW
SetColorAdjustment
GetGlyphOutlineW
RemoveFontResourceExW
HT_Get8BPPFormatPalette
CloseEnhMetaFile
GetEUDCTimeStamp
GdiStartDocEMF

wldap32

ldap_err2string
ldap_first_attributeW
ldap_compare
ldap_compare_sA
ldap_set_optionW
ldap_startup
ldap_modrdnA
ldap_parse_extended_resultA
ldap_add_ext
ldap_search_sA
ldap_escape_filter_elementW
ldap_modify_extW
ber_scanf
ldap_modrdn2W
cldap_open
ldap_add_ext_sA
ldap_start_tls_sW
ldap_modrdn_sW
ldap_openA
ldap_get_values
ldap_first_attributeA
ldap_modifyA
ber_peek_tag
ldap_compare_ext_sW
ldap_bind_s
ldap_count_valuesA
ldap_openW
ldap_get_valuesA
ldap_first_attribute
ldap_modify_sW
ber_bvdup
ldap_value_free
ldap_get_next_page
ldap_err2stringA
ldap_extended_operationW
ldap_count_references
ldap_escape_filter_element

user32

EndDialog
MessageBoxW

shell32

SHGetMalloc

Sections

.text
Size: 92KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 660KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 220KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f3b84bfad2b2f69c33b42e22f39b825a

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

cfgmgr32

msvcrt40

kernel32

opengl32

gdi32

wldap32

user32

shell32

Sections

.text Size: 92KB - Virtual size: 96KB

.rdata Size: 72KB - Virtual size: 72KB

.data Size: 512B - Virtual size: 660KB

.rsrc Size: 220KB - Virtual size: 220KB

.reloc Size: 1024B - Virtual size: 4KB

.text
Size: 92KB - Virtual size: 96KB

.rdata
Size: 72KB - Virtual size: 72KB

.data
Size: 512B - Virtual size: 660KB

.rsrc
Size: 220KB - Virtual size: 220KB

.reloc
Size: 1024B - Virtual size: 4KB