0b075e99ba5b837b4f60799476e68d11_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0b075e99ba5b837b4f60799476e68d11_JaffaCakes118
Size

65KB
MD5

0b075e99ba5b837b4f60799476e68d11
SHA1

47a8bd1f503d6c38a8d845050fc45a62225629b0
SHA256

586fcec897e9d4eeb89f4418d0980967ef45702f6f6367d7cbdb098087f6a18c
SHA512

0cead970e9bb310ce6613292f3aed16198b7867c06bff4b4edb2712af43a87988ab8ebdc8537a25c53177830322af9b881c66b4ed31fcf0316174e99a7a5b706
SSDEEP

1536:2Frsutb/kF2AhM0LXVBoRM2/mKGXi3xpw9JUOr0Rc5hb:2xseu2AjXvovmKwi3Pw/vv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b075e99ba5b837b4f60799476e68d11_JaffaCakes118

Files

0b075e99ba5b837b4f60799476e68d11_JaffaCakes118
.exe windows:6 windows x86 arch:x86

227d81c5224c7437ae46e793d9114b4d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

unsecapp.pdb

Imports

msvcrt

_vsnwprintf
printf
_controlfp
_except_handler4_common
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
wcsstr
_amsg_exit
_purecall
_initterm
exit
_XcptFilter
_exit
_cexit
__getmainargs
malloc
_callnewh
free
??0exception@@QAE@XZ
_CxxThrowException
??0exception@@QAE@ABV0@@Z
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
memmove_s
memcpy_s
__CxxFrameHandler3
__setusermatherr

wbemcomn

??0CCritSec@@QAE@XZ
??1CCritSec@@QAE@XZ
?_ThrowMemoryException_@@YGXXZ
?ErrorTrace@@YAHDPBDZZ
??0CNtSid@@QAE@W4SidType@0@@Z
??1Registry@@QAE@XZ
??8CNtSid@@QAEHAAV0@@Z
?GetTextSid@CNtSid@@QAEHPAGPAK@Z
??1CInCritSec@@QAE@XZ
?GetDWORDStr@Registry@@QAEHPBGPAK@Z
??0Registry@@QAE@PBGK@Z
??0CNtSid@@QAE@PAX@Z
?InternalQueryInterface@CUnkInternal@@QAEJABU_GUID@@PAPAX@Z
?InternalRelease@CUnkInternal@@QAEKXZ
?Write@CMemoryLog@@QAEXJ@Z
?GetMemLogObject@@YGPAVCMemoryLog@@XZ
??0CInCritSec@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z
??0CNtSid@@QAE@ABV0@@Z
??4CNtSid@@QAEAAV0@ABV0@@Z
?Initialize@CUnk@@UAEHXZ
?OnInitialize@CUnk@@UAEHXZ
?Release@CUnk@@UAGKXZ
?AddRef@CUnk@@UAGKXZ
?QueryInterface@CUnk@@UAGJABU_GUID@@PAPAX@Z
??0CUnk@@QAE@PAVCLifeControl@@PAUIUnknown@@@Z
??1CUnk@@UAE@XZ
?Release@CUnkInternal@@UAGKXZ
?AddRef@CUnkInternal@@UAGKXZ
?QueryInterface@CUnkInternal@@UAGJABU_GUID@@PAPAX@Z
??0CUnkInternal@@QAE@PAVCLifeControl@@@Z
??_7CUnkInternal@@6B@
??1CUnkInternal@@UAE@XZ
??1CNtSid@@QAE@XZ

ntdll

EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceLoggerHandle
EtwGetTraceEnableFlags
EtwTraceMessage
EtwGetTraceEnableLevel

api-ms-win-service-core-l1-1-0

SetServiceStatus
StartServiceCtrlDispatcherW

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

api-ms-win-service-management-l1-1-0

OpenSCManagerW
CreateServiceW
OpenServiceW
DeleteService

kernel32

InterlockedIncrement
Sleep
InterlockedCompareExchange
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
LeaveCriticalSection
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
DebugBreak
LCMapStringW
EnterCriticalSection
ExitProcess
SetEvent
LoadLibraryExW
GetLastError
CreateEventW
GetModuleFileNameW
lstrlenW
GetCommandLineW
DeleteCriticalSection
InterlockedDecrement
GetCurrentProcessId
GetProcAddress
InterlockedExchange

ole32

CoImpersonateClient
CoRegisterClassObject
CoRevokeClassObject
StringFromGUID2
CoRevertToSelf
CoInitialize
CoInitializeSecurity

api-ms-win-security-base-l1-1-0

EqualSid
GetLengthSid
IsValidSid

user32

DispatchMessageW
TranslateMessage
GetMessageW
PostQuitMessage
SetTimer
PostThreadMessageW

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

wwhntsw
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

227d81c5224c7437ae46e793d9114b4d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

wbemcomn

ntdll

api-ms-win-service-core-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-management-l1-1-0

kernel32

ole32

api-ms-win-security-base-l1-1-0

user32

Sections

.text Size: 31KB - Virtual size: 30KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 30KB - Virtual size: 31KB

wwhntsw Size: - Virtual size: 4KB

.text
Size: 31KB - Virtual size: 30KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 30KB - Virtual size: 31KB

wwhntsw
Size: - Virtual size: 4KB