05c155363f63be8744149f176a4cfb52_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

05c155363f63be8744149f176a4cfb52_JaffaCakes118
Size

356KB
MD5

05c155363f63be8744149f176a4cfb52
SHA1

f2e505ee9402a8f81024604afa366bdbc50bc946
SHA256

0645de03e28292d317535f5cba22e553a46985dafb4341d8c6452223485b299b
SHA512

73218be7d294053689f93d1791c2363b096132f575c45244b9b691b146207a6c09a83d0640b72ea286b16763276ab5bf5ae1544b1c31e08b8d0ddbe55e3189ab
SSDEEP

6144:OJCsArgpdiPNBCU0hgZb7NVS9qlBFc1d6YpOV6vqvXeuIS4ChZYt:OUMpd+zCFgJXKLMVPvXPIS+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
05c155363f63be8744149f176a4cfb52_JaffaCakes118

Files

05c155363f63be8744149f176a4cfb52_JaffaCakes118
.exe windows:5 windows x86 arch:x86

13ccb585d99062a509595969c6a8c7b1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MonitorFromWindow
GetKeyboardLayoutNameW
TabbedTextOutW
GetUpdateRgn
CheckMenuItem
IsWindowInDestroy
SetMenuContextHelpId
SetScrollInfo
GetClipCursor
ChildWindowFromPoint
ShowOwnedPopups
SetClassLongW
GetWindowTextLengthA
DestroyCaret
GetInputDesktop
EmptyClipboard
SendDlgItemMessageW
IsZoomed
SetWindowLongA
wsprintfA
GetDoubleClickTime
AllowSetForegroundWindow
SetSysColors
DefMDIChildProcW
GetLastInputInfo
GetMessageA
PtInRect
ChangeMenuW
GetWindowModuleFileNameW
SendNotifyMessageW
GetIconInfo
IMPQueryIMEA
LoadLocalFonts

wintrust

CryptCATPersistStore
TrustOpenStores
CryptCATAdminEnumCatalogFromHash
WTHelperCertIsSelfSigned
WinVerifyTrust
WTHelperGetAgencyInfo
CryptSIPVerifyIndirectData
WVTAsn1SpcStatementTypeDecode
WTHelperGetProvCertFromChain
SoftpubInitialize
OfficeInitializePolicy
SoftpubDllUnregisterServer
CryptCATAdminCalcHashFromFileHandle
WVTAsn1CatMemberInfoDecode
WVTAsn1SpcPeImageDataDecode
CryptCATAdminPauseServiceForBackup
FindCertsByIssuer
SoftpubLoadMessage
CryptCATGetMemberInfo
TrustFindIssuerCertificate
CryptCATAdminAddCatalog
CryptCATVerifyMember
TrustDecode
WVTAsn1CatNameValueEncode
mscat32DllUnregisterServer
WintrustAddDefaultForUsage
WintrustLoadFunctionPointers
TrustIsCertificateSelfSigned
CryptCATPutMemberInfo
DriverCleanupPolicy
CryptCATGetAttrInfo
CryptCATEnumerateAttr
WVTAsn1CatNameValueDecode
GenericChainCertificateTrust
WTHelperCertFindIssuerCertificate
MsCatFreeHashTag
SoftpubFreeDefUsageCallData
WTHelperGetProvSignerFromChain
WTHelperOpenKnownStores
WVTAsn1SpcMinimalCriteriaInfoEncode
WTHelperGetFileName

kernel32

GetShortPathNameA
VerLanguageNameA
GetProfileIntA
GetFirmwareEnvironmentVariableW
WaitNamedPipeW
GlobalAddAtomW
GetVolumePathNamesForVolumeNameW
QueryDosDeviceA
DosDateTimeToFileTime
GetNamedPipeInfo
GetSystemTimeAsFileTime
DosPathToSessionPathA
SetTimeZoneInformation
GetFileAttributesExW
SetLastError
GetConsoleInputExeNameW
SetSystemPowerState
GetConsoleMode
GlobalReAlloc
QueryPerformanceCounter
VDMConsoleOperation
VirtualAlloc
GlobalFindAtomW
GetTapeStatus
LZOpenFileW
LZCreateFileW
UnregisterConsoleIME
NlsGetCacheUpdateCount
DisconnectNamedPipe
ReadProcessMemory
GetConsoleScreenBufferInfo
ReadConsoleOutputCharacterA
OutputDebugStringA
RtlCaptureStackBackTrace
GetStartupInfoW
LoadLibraryA
LockFileEx
FindFirstFileW
DefineDosDeviceA
GetConsoleCursorMode
GetModuleHandleW
GetQueuedCompletionStatus
GetSystemPowerStatus
IsBadWritePtr

msvcrt40

??1bad_typeid@@UAE@XZ
??0bad_cast@@QAE@ABQBD@Z
?str@strstreambuf@@QAEPADXZ
_chgsign
??4istream_withassign@@QAEAAVistream@@ABV1@@Z
?str@ostrstream@@QAEPADXZ
?pbackfail@streambuf@@UAEHH@Z
??_7stdiobuf@@6B@
?setmode@ofstream@@QAEHH@Z
strlen
strcmp
_isnan
wcsftime
_telli64
??_E__non_rtti_object@@UAEPAXI@Z
_adj_fdiv_m32
_beginthread
_setsystime
??4streambuf@@QAEAAV0@ABV0@@Z
??5istream@@QAEAAV0@AAF@Z
??_7istrstream@@6B@
_loaddll
??1__non_rtti_object@@UAE@XZ
??0ifstream@@QAE@ABV0@@Z
??_8stdiostream@@7Bostream@@@
_mbsinc
bsearch
_mbsnbset
tanh
_cgets
__setusermatherr
_setmode
_mbsnbicmp
??0iostream@@QAE@PAVstreambuf@@@Z
??_7exception@@6B@
memchr
__CxxLongjmpUnwind
__STRINGTOLD
??0__non_rtti_object@@QAE@ABV0@@Z
_ftime

netapi32

I_NetDatabaseRedo
NetpHexDump
NetGroupSetUsers
I_NetServerTrustPasswordsGet
NetpwPathCanonicalize
NetLogonGetTimeServiceParentDomain
NetGetJoinableOUs
NetUserSetInfo
NetShareDel
NetLocalGroupAddMember
NetApiBufferSize
NetEnumerateComputerNames
DsGetDcNameW
DsRoleDnsNameToFlatName
I_NetLogonSamLogoff
NetUseAdd
DsRoleGetPrimaryDomainInformation
NetUseDel
NetReplExportDirLock
NetValidateName
NetShareEnum
NetServerGetInfo
NetReplSetInfo
NetpAddTlnFtinfoEntry
DsRoleFreeMemory
NetShareEnumSticky
NetShareAdd
NetpDbgPrint
NetShareDelSticky
DsAddressToSiteNamesExA
NetServiceGetInfo
DsRoleCancel
NetLocalGroupDel
I_NetLogonSamLogon
NetReplExportDirDel
DsGetDcNameA
NetAlertRaise
NetpGetConfigBool
NetErrorLogClear
NetWkstaUserSetInfo

w32topl

ToplSTHeapAdd
ToplDeleteComponents
ToplScheduleCacheCreate
ToplListRemoveElem
ToplGraphNumberOfVertices
ToplFree
ToplGraphInit
ToplIsToplException
ToplVertexFree
ToplGetSpanningTreeEdgesForVtx
ToplEdgeGetToVertex
ToplVertexDestroy
ToplListSetIter
ToplVertexGetParent
ToplVertexGetInEdge
ToplIterGetObject
ToplIterFree
ToplSTHeapDestroy
ToplGraphFindEdgesForMST
ToplEdgeSetWeight
ToplVertexSetId
ToplScheduleMaxUnavailable
ToplSTHeapExtractMin
ToplListNumberOfElements
ToplScheduleMerge
ToplVertexCreate
ToplVertexGetOutEdge
ToplEdgeCreate
ToplVertexGetId
ToplScheduleDuration
ToplMakeGraphState
ToplEdgeDestroy

tcpmonui

??1CTcpMibABC@@UAE@XZ
??0CTcpMibABC@@QAE@XZ
LocalAddPortUI
??0CPortABC@@QAE@XZ
??_7CPortABC@@6B@
??0CTcpMibABC@@QAE@ABV0@@Z
?Read@CPortABC@@UAEKQAXPAEKPAK@Z
??4CPortABC@@QAEAAV0@ABV0@@Z
??_7CTcpMibABC@@6B@
??4CTcpMibABC@@QAEAAV0@ABV0@@Z
??1CPortABC@@UAE@XZ
InitializePrintMonitorUI
LocalConfigurePortUI
??0CPortABC@@QAE@ABV0@@Z

Sections

.text
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 157KB - Virtual size: 574KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

13ccb585d99062a509595969c6a8c7b1

Headers

DLL Characteristics

File Characteristics

Imports

user32

wintrust

kernel32

msvcrt40

netapi32

w32topl

tcpmonui

Sections

.text Size: 77KB - Virtual size: 77KB

.rdata Size: 112KB - Virtual size: 112KB

.data Size: 157KB - Virtual size: 574KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 77KB - Virtual size: 77KB

.rdata
Size: 112KB - Virtual size: 112KB

.data
Size: 157KB - Virtual size: 574KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 1024B - Virtual size: 1024B