0794abf67cddbcee0e7a32075bbcf31b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0794abf67cddbcee0e7a32075bbcf31b_JaffaCakes118
Size

119KB
MD5

0794abf67cddbcee0e7a32075bbcf31b
SHA1

a8746e49c5d578d0c9bdd4a509345eb85f5da31a
SHA256

61f106361b458317ef503a3c84752070c80c94c1f250d3b978285347f97e65b6
SHA512

5f9bf5acdd692443dad967b795b48ca0fabb10b979cbcaca551ecf4de2023a3d4609c287a1b61c77cc18ed74b882ee4481f13edd5aea86db668523ff95c0c9da
SSDEEP

3072:JL+4lRMf0zJVxct8AkiqaLOQwQEYLtfBAepg:JbzVxcVqacQg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0794abf67cddbcee0e7a32075bbcf31b_JaffaCakes118

Files

0794abf67cddbcee0e7a32075bbcf31b_JaffaCakes118
.exe windows:6 windows x86 arch:x86

cf9ec4dc0bd91116869a266696faf3a9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

ehSched.pdb

Imports

advapi32

CloseServiceHandle
OpenServiceW
OpenSCManagerW
DeleteService
ControlService
DeregisterEventSource
ReportEventW
RegisterEventSourceW
SetServiceStatus
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegQueryInfoKeyW
AddAce
GetAce
GetAclInformation
AddAccessAllowedAce
InitializeAcl
GetLengthSid
IsValidSid
GetTokenInformation
ChangeServiceConfig2W
CreateServiceW
RegEnumKeyExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupAccountNameW
OpenThreadToken
RegDeleteKeyW
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
CreateWellKnownSid
SetSecurityInfo
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
CopySid
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
OpenProcessToken
SetNamedSecurityInfoW
LookupAccountSidW

kernel32

LoadLibraryW
GetProcAddress
GetModuleHandleW
lstrcmpiW
CloseHandle
CancelWaitableTimer
ResetEvent
SetEvent
SetWaitableTimer
GetModuleFileNameW
LeaveCriticalSection
CreateWaitableTimerW
GetCurrentThread
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
CreateEventW
ExitThread
WaitForSingleObject
CreateThread
WaitForMultipleObjects
OpenThread
GetCurrentThreadId
GetCommandLineW
HeapSetInformation
QueryPerformanceCounter
GetTickCount64
QueryPerformanceFrequency
QueueUserWorkItem
GetSystemTimeAsFileTime
OutputDebugStringA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetTickCount
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
OutputDebugStringW
InterlockedExchange
GetVersionExA
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
RaiseException
lstrlenW
GetLastError
HeapAlloc
GetProcessHeap
HeapFree
CreateEventExW
GetLocalTime
LocalFree
EncodeSystemPointer

user32

PostThreadMessageW
UnregisterClassA
RegisterDeviceNotificationW
UnregisterDeviceNotification
PeekMessageW
MsgWaitForMultipleObjectsEx
DispatchMessageW
CharNextW

msvcrt

__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
realloc
_errno
fflush
__setusermatherr
_amsg_exit
fputws
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_vsnwprintf
??0exception@@QAE@XZ
_CxxThrowException
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
memmove_s
_wcsnicmp
_purecall
__CxxFrameHandler3
memset
calloc
wcscat_s
wcsncpy_s
wcscpy_s
memcpy_s
free
malloc
_controlfp
??1type_info@@UAE@XZ
_onexit
_lock
__dllonexit
_initterm
_unlock
_resetstkoflw

ole32

CoSetProxyBlanket
CoTaskMemAlloc
CoInitialize
CoReleaseServerProcess
CoInitializeEx
CoRevokeClassObject
CoUninitialize
CoImpersonateClient
CoInitializeSecurity
CoRevertToSelf
StringFromGUID2
CoAddRefServerProcess
CoTaskMemFree
CoRegisterClassObject
CoCreateInstance
CoTaskMemRealloc

oleaut32

SysFreeString
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
SysStringLen

slc

SLGetWindowsInformationDWORD

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

illbwmn
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cf9ec4dc0bd91116869a266696faf3a9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

ole32

oleaut32

slc

Sections

.text Size: 81KB - Virtual size: 81KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 30KB - Virtual size: 31KB

illbwmn Size: - Virtual size: 4KB

.text
Size: 81KB - Virtual size: 81KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 30KB - Virtual size: 31KB

illbwmn
Size: - Virtual size: 4KB