0a7cea4ad5cf05dd39b9368f8bd1603a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0a7cea4ad5cf05dd39b9368f8bd1603a_JaffaCakes118
Size

164KB
MD5

0a7cea4ad5cf05dd39b9368f8bd1603a
SHA1

7d3363a1945c9c3fdbb65c1ef4cd0a63cd8a2320
SHA256

d4657a71367279c8f818f329fc048f22099a32d194d5f8cf88683c1692ed1f4d
SHA512

cd30232d80287381c55e1603eb83e24b58302351a646ec577c356a04f12777f0ea1d6db46cab7e56dba211ba48c9f8edfbf0f1cfc218d8ad0919f4c0ec075fa5
SSDEEP

3072:Q9EFvCrYRVRnb038D40F2Cov7kMLdU85MtXxY:Q9ovCrYhI38D87k8fr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a7cea4ad5cf05dd39b9368f8bd1603a_JaffaCakes118

Files

0a7cea4ad5cf05dd39b9368f8bd1603a_JaffaCakes118
.exe windows:5 windows x86 arch:x86

078a0f381f26c36fc8bb842a95742a13

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateThread
IsBadStringPtrW
SetFileShortNameA
ReplaceFileW
RegisterConsoleOS2
GetTapeStatus
IsValidCodePage
GetThreadLocale
IsDebuggerPresent
TryEnterCriticalSection
GetModuleHandleA
AddAtomA
SetHandleInformation
GetConsoleInputExeNameW
GetUserDefaultLCID
EnumDateFormatsExA
LocalFlags
SetComPlusPackageInstallStatus
GetSystemDirectoryW
GetSystemDefaultLCID
GlobalMemoryStatus
EnterCriticalSection
GetACP
LoadLibraryA
SetTapePosition
WriteConsoleOutputA
FillConsoleOutputCharacterW
RegisterConsoleVDM
IsValidLocale
GlobalGetAtomNameA
UnregisterWait
VirtualAlloc
OpenEventA
LeaveCriticalSection
BaseCheckAppcompatCache
CreateRemoteThread
CreateDirectoryExA
CreateActCtxA
FindCloseChangeNotification
WriteFileGather
GetBinaryTypeA

netapi32

I_NetServerPasswordSet
NetReplExportDirLock
I_BrowserSetNetlogonState
NetDfsSetInfo
I_NetServerAuthenticate3
I_NetLogonControl
RxNetAccessAdd
NetDfsAddStdRootForced
DsAddressToSiteNamesExW
NlBindingSetAuthInfo
DsAddressToSiteNamesA
NetWkstaTransportDel
NetpwNameCanonicalize
RxNetAccessGetInfo
NetpwPathCanonicalize
NetRemoteComputerSupports
NetpIsRemote
NetWkstaTransportAdd
DsRoleGetDcOperationProgress
NetServerEnum
NetpMergeFtinfo
I_NetServerGetTrustInfo
NetApiBufferFree
NetServerDiskEnum
NetUserModalsSet
NetReplImportDirEnum
NetGetJoinInformation
NetDfsGetInfo
NetDfsRemove
I_NetDfsIsThisADomainName
I_NetServerPasswordGet
DsGetDcSiteCoverageA
NetAuditClear
DsGetDcNameWithAccountA
RxNetAccessDel
DsGetDcCloseW
NetUseAdd

lz32

LZInit
LZClose
CopyLZFile
LZCloseFile
LZStart
LZCreateFileW
LZSeek
LZOpenFileW
LZCopy
GetExpandedNameA
LZDone
LZOpenFileA
LZRead

msvcp60

?_Init@?$numpunct@D@std@@IAEXABV_Locinfo@2@@Z
?copy@?$char_traits@G@std@@SAPAGPAGPBGI@Z
??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@PAF@Z
?close@?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXXZ
?osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
??_7length_error@std@@6B@
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_Nanv@?$_Ctr@M@std@@SAMM@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_iostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?exp@std@@YA?AV?$complex@O@1@ABV21@@Z
??Kstd@@YA?AV?$complex@M@0@ABMABV10@@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?pbackfail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGG@Z
??8std@@YA_NABV?$complex@N@0@0@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
??4?$basic_fstream@GU?$char_traits@G@std@@@std@@QAEAAV01@ABV01@@Z
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?_Makpat@?$_Mpunct@G@std@@AAEXAAUpattern@money_base@2@DDD@Z
_Stold
??4?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?grouping@?$numpunct@D@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?narrow@?$ctype@G@std@@QBEPBGPBG0DPAD@Z
?eof@?$char_traits@D@std@@SAHXZ
??Kstd@@YA?AV?$complex@M@0@ABV10@0@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1ostrstream@std@@UAE@XZ
?_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ
??Hstd@@YA?AV?$complex@O@0@ABOABV10@@Z

esent

JetRenameTable
JetGotoBookmark
JetResetSessionContext
JetSetCurrentIndex2
JetOpenTempTable2
JetAttachDatabaseWithStreaming
JetBackupInstance
JetUpgradeDatabase
JetEndSession
JetCreateIndex2
JetDBUtilities
JetGetInstanceInfo
JetSetLS
JetDupCursor
JetOSSnapshotThaw
JetIndexRecordCount
JetUnregisterCallback
JetRestore
JetGetLogInfoInstance
JetBeginTransaction
JetBeginExternalBackup
JetCloseFile
JetBeginExternalBackupInstance
JetGetSystemParameter
JetUpdate
JetCloseTable
JetGetLS
JetRetrieveColumn@32
JetIntersectIndexes
JetDeleteTable
JetRetrieveKey
JetCompact

msvcrt

__set_app_type
exit
__getmainargs
__p__commode

Sections

.text
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

078a0f381f26c36fc8bb842a95742a13

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

netapi32

lz32

msvcp60

esent

msvcrt

Sections

.text Size: 63KB - Virtual size: 63KB

.rdata Size: 35KB - Virtual size: 35KB

.data Size: 62KB - Virtual size: 240KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 63KB - Virtual size: 63KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 62KB - Virtual size: 240KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB