0a80c6dac403a4732018a6db6787a6c7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0a80c6dac403a4732018a6db6787a6c7_JaffaCakes118
Size

986KB
MD5

0a80c6dac403a4732018a6db6787a6c7
SHA1

ad15bbc2375a13272779c9ddc18d898d8c0cdc46
SHA256

ce113f944fa936a3b902dc3e28098f9bee9b3e29401a42d0178dbb866ba331d8
SHA512

ba8fdbce5be15ee322af7591d44221d704afd6d7811229218176dc8e711b833831e130d4f76cb6cba0a7ba1a8ae18bb42e7b5d4df1dcaea49067785e414f71a9
SSDEEP

6144:PJTT4BOTZ0/bTTlh9KP/sg88SI0/bTTlh9KP/sg88SMJ8lh1GDry1v6hfV:xTT4B/zxKPkn/zxKPkn8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a80c6dac403a4732018a6db6787a6c7_JaffaCakes118

Files

0a80c6dac403a4732018a6db6787a6c7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4fc8fe970240e2de5209d49d52175613

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\EDSV3\trunk\Build\32base\Pdb\Decryption.pdb

Imports

sysenv

HT_ReadINIFileW
HT_CheckOtherAPsRunning
HT_IsGuestsGroup
HT_GetTempFolderPathW

cryptoapi

HTCA_CheckLockedFileW
HTCA_CheckSelfExtractEncryptedFile
HTCA_LockFileW
HTCA_CheckEncryptedFileW
HTCA_FreeMemory

keymanager

HTKM_FreeMemory

showerrmsg

ShowErrorMessage

batchcrypto

?BatchCrypto@@YAXPAUtagCRYPTOPARAMS@@@Z
??0CFileList@@QAE@PAPA_W@Z
??1CFileList@@QAE@XZ

kernel32

UnhandledExceptionFilter
GetCurrentProcess
lstrlenA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
TerminateProcess
GetStartupInfoW
Sleep
InterlockedCompareExchange
InterlockedDecrement
lstrlenW
lstrcpyA
GetCommandLineW
FreeLibrary
LoadLibraryW
CopyFileW
GetFileAttributesW
CreateFileW
GetLastError
GetProcAddress
CloseHandle
DeleteFileW
LocalFree
SetFileAttributesW
MultiByteToWideChar
FindFirstFileW
GetDriveTypeW
ReadFile
FindClose
RemoveDirectoryW
FindNextFileW
GetWindowsDirectoryW
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
InterlockedExchange

user32

EndPaint
TranslateAcceleratorW
SendMessageW
PostQuitMessage
LoadCursorW
BeginPaint
GetForegroundWindow
LoadAcceleratorsW
RegisterClassExW
LoadIconW
LoadStringW
ShowWindow
CreateWindowExW
UpdateWindow
DefWindowProcW
DispatchMessageW
TranslateMessage
GetMessageW

shell32

ShellExecuteW
CommandLineToArgvW

ole32

CoCreateInstance
CoUninitialize
CoInitialize
OleRun

oleaut32

SysFreeString
SysAllocString
VariantClear
GetErrorInfo

msvcp80

??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@_W@Z
?at@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@V32@_W@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?rbegin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$reverse_iterator@V?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@XZ
?rend@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$reverse_iterator@V?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@XZ
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHABV12@@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z

msvcr80

_exit
_XcptFilter
exit
_wcmdln
_initterm
memcpy
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
free
malloc
__CxxFrameHandler3
_CxxThrowException
memset
_cexit
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
??3@YAXPAX@Z
??2@YAPAXI@Z
strtok
??_V@YAXPAX@Z
_wtoi
_wsplitpath
rand
srand
_itow
_time64
toupper
_unlock
_encode_pointer
__dllonexit
_lock
_onexit
_decode_pointer
_amsg_exit
__wgetmainargs

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 923KB - Virtual size: 924KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4fc8fe970240e2de5209d49d52175613

Headers

File Characteristics

PDB Paths

Imports

sysenv

cryptoapi

keymanager

showerrmsg

batchcrypto

kernel32

user32

shell32

ole32

oleaut32

msvcp80

msvcr80

Sections

.text Size: 40KB - Virtual size: 39KB

.rdata Size: 15KB - Virtual size: 14KB

.data Size: 1024B - Virtual size: 2KB

.rsrc Size: 923KB - Virtual size: 924KB

.text
Size: 40KB - Virtual size: 39KB

.rdata
Size: 15KB - Virtual size: 14KB

.data
Size: 1024B - Virtual size: 2KB

.rsrc
Size: 923KB - Virtual size: 924KB