07faee89cbdfec9b457f95c20c63737d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

07faee89cbdfec9b457f95c20c63737d_JaffaCakes118
Size

160KB
MD5

07faee89cbdfec9b457f95c20c63737d
SHA1

1e39ee7046d7dbf1662c86e5907cefd309b912d7
SHA256

f7bcf33faa12ca75b72a1f8b72f1576d9f1370a811003912785cea2ce860bdb8
SHA512

ab6f5c5e83755f4d975343fc535a47e84ab5afb35aa3321d66fed3a9f2f46478d1664d65b34856c34af9fd006763195449cbadd8018b4a2b5067a70199c28afb
SSDEEP

3072:BLQETCfHQgWgzguRRI8xPbjJi46+SK4UoKQs8+Oum:SEYWgsuR+8bXPSKgL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
07faee89cbdfec9b457f95c20c63737d_JaffaCakes118

Files

07faee89cbdfec9b457f95c20c63737d_JaffaCakes118
.dll windows:5 windows x86 arch:x86

790d6aa4f67670fd4f6318dbb6f46c6f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\build\products\windows\osdp\vc9build\Win32\Release\osdp.pdb

Imports

kernel32

BackupSeek
OutputDebugStringW
SetFileTime
WideCharToMultiByte
FileTimeToSystemTime
GetModuleFileNameW
MultiByteToWideChar
FindFirstFileA
SetLastError
BackupRead
SetFileAttributesA
FindClose
LocalAlloc
CreateFileMappingW
GetSystemInfo
GetModuleFileNameA
FindNextFileA
FindNextFileW
GetFileTime
SystemTimeToTzSpecificLocalTime
GetTempPathA
LocalFree
SetFileAttributesW
DeleteFileA
SetEndOfFile
MapViewOfFileEx
lstrcmpA
lstrlenA
GetProcAddress
GetModuleHandleA
GetVersionExA
GetCurrentThread
OpenProcess
GetCurrentProcessId
GetShortPathNameA
CompareStringW
CompareStringA
UnmapViewOfFile
MapViewOfFile
FindFirstFileW
GetFileSize
GetFullPathNameA
GetFullPathNameW
CloseHandle
DeviceIoControl
GetDiskFreeSpaceA
QueryDosDeviceW
GetDiskFreeSpaceW
GetLastError
CreateFileW
ReadFile
GetDriveTypeA
WriteFile
CreateFileA
GetLogicalDrives
SetFilePointer
DeleteFileW
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
VirtualAlloc
HeapReAlloc
Sleep
ExitProcess
GetStdHandle
GetStringTypeW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
HeapSize
GetLocaleInfoW
FlushFileBuffers
SetEnvironmentVariableA

user32

GetSystemMetrics

advapi32

PrivilegeCheck
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
OpenThreadToken
OpenProcessToken
LookupPrivilegeNameW
RegCloseKey
GetLengthSid
GetFileSecurityA
SetFileSecurityA
AddAccessAllowedAce
InitializeAcl
SetFileSecurityW
RegOpenKeyExA
SetSecurityDescriptorDacl
GetFileSecurityW
InitializeSecurityDescriptor
RegQueryValueExA

Exports

Exports

AlterPriveledge
FindEnabledPrivileges
ForceSavPriveledges
GetFirstMemoryControlBlock
GetFirstVMHandle
GetFirstVMMemoryControlBlock
GetNextVMHandle
GetPhysParamForLogicalDrive
GetPhysParamForPhysicalDrive
GetPhysicalDriveFromLogical
GetSizeOfLogicalSector
GetSizeOfPhysicalSector
GetTokenHandle
GetTokenUser
GetVMInfo
IsDriveSubstituted
IsLogicalFloppyBootSector
IsLogicalHardBootSector
IsMainConsole
IsPhysicalFloppyBootSector
IsPhysicalHardBootSector
IsPhysicalMasterBootSector
IsTerminalServer
IsWindows95
NTMajorVersion
ReadAbsoluteSector
ReadDOSMemory
ReadLogicalSector
ReadPhysicalMemory
ReadPhysicalSector
ReadVMMemory
RevokeSavPriveledges
SAV_CloseFile
SAV_CompareFileNamesW
SAV_FindClose
SAV_FindFirstA
SAV_FindFirstW
SAV_FindFirstWithTypeA
SAV_FindFirstWithTypeW
SAV_FindNextA
SAV_FindNextW
SAV_FindNextWithTypeA
SAV_FindNextWithTypeW
SAV_GetFileAttributesA
SAV_GetFileAttributesW
SAV_GetFileDateTimeA
SAV_GetFileDateTimeW
SAV_GetFileLength
SAV_GetFileLength64
SAV_GetFileTime
SAV_GetLastError
SAV_GetModuleFileNameA
SAV_GetModuleFileNameW
SAV_GetPathLengthOfCurrentModule
SAV_GetTempPathA
SAV_GetTempPathW
SAV_IsFileLocked
SAV_IsMacFileA
SAV_IsMacFileW
SAV_IsRootDirectoryA
SAV_IsRootDirectoryW
SAV_MakeFileWritableA
SAV_MakeFileWritableW
SAV_NormalisePathA
SAV_NormalisePathW
SAV_OpenFileA
SAV_OpenFileW
SAV_OpenMacFileA
SAV_OpenMacFileW
SAV_ReadFile
SAV_RemoveA
SAV_RemoveW
SAV_SOpenFileA
SAV_SOpenFileW
SAV_SeekInFile
SAV_SeekInFile64
SAV_SetFileAttributesA
SAV_SetFileAttributesW
SAV_SetFileTime
SAV_Tell
SAV_Tell64
SAV_WriteFile
VENG_MMFBaseAddress
VENG_MMFClose
VENG_MMFNew
VENG_MMFOpen
WriteAbsoluteSector
WriteLogicalSector
WritePhysicalSector

Sections

.text
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

790d6aa4f67670fd4f6318dbb6f46c6f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 134KB - Virtual size: 133KB

.rdata Size: 17KB - Virtual size: 17KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 134KB - Virtual size: 133KB

.rdata
Size: 17KB - Virtual size: 17KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB