0cd92bd5ad057decffa6583b01b31546_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0cd92bd5ad057decffa6583b01b31546_JaffaCakes118
Size

868KB
MD5

0cd92bd5ad057decffa6583b01b31546
SHA1

8bcb985325606c9cd4fa85a32dcef0ddc3fb3926
SHA256

7726225acc24fe34b6587c2ecec1697aaec6d64fb68473c37739311bed9708f7
SHA512

d544d2719b66c2a932664c1965b6dca001dc686c1dd46f9f4df68b77556338fab084d9e122c8b04fcafaf1059ac370e9bc2016165b30058515f8d5736944b1d1
SSDEEP

24576:sfGT5TWyso9B/U97m0EPkLCTNh/+tTsCzp2z7TC:EI5T3pzAPAkLCGaCzpe7+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0cd92bd5ad057decffa6583b01b31546_JaffaCakes118

Files

0cd92bd5ad057decffa6583b01b31546_JaffaCakes118
.exe windows:5 windows x86 arch:x86

c2ed846536fb0335966eb092d85345bd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

SetWindowTextW
OemToCharBuffA
DrawTextExA
PostMessageW
EnumPropsExA
SendDlgItemMessageA
GetUserObjectInformationA
GetClipboardSequenceNumber
GetClassInfoW
GetMenuItemInfoA
UserRealizePalette
CreateCursor
RealGetWindowClass
TabbedTextOutA
IsServerSideWindow
DdeInitializeW
GetScrollRange
IMPQueryIMEW
DestroyWindow
DefWindowProcW
SetWindowsHookExW
GetClientRect
GetUpdateRect
CopyAcceleratorTableA
SetCursorPos
CheckMenuRadioItem
MapVirtualKeyExW
TileWindows
GetKeyNameTextW
SetPropW
OpenWindowStationW
DdeQueryConvInfo
GetMenuState
CsrBroadcastSystemMessageExW
GetQueueStatus
SetWindowPos
SetMenuItemInfoA
GetKeyboardLayout
IsCharAlphaA
DdeFreeDataHandle
MsgWaitForMultipleObjectsEx
DefDlgProcW
SetWindowLongW
GetDialogBaseUnits

kernel32

ActivateActCtx
DelayLoadFailureHook
EscapeCommFunction
FoldStringA
GetCurrentConsoleFont
SetFileValidData
OutputDebugStringA
GetProcAddress
SetLocalPrimaryComputerNameW
ReadConsoleOutputA
SetVolumeLabelW
HeapCreate
WaitForDebugEvent
GetPrivateProfileSectionA
EnumDateFormatsA
OpenFile
FindActCtxSectionStringW
SetComputerNameExW
VirtualFree
TermsrvAppInstallMode
GlobalMemoryStatus
Beep
GetConsoleAliasesA
WriteConsoleOutputW
InitializeCriticalSectionAndSpinCount
GetNumaHighestNodeNumber
SetVolumeMountPointW
ExpungeConsoleCommandHistoryA
Module32NextW
LoadModule
FillConsoleOutputCharacterW
GetSystemDefaultLCID
GetACP
WriteProfileStringA
Process32NextW
IsBadStringPtrW
LoadLibraryA
CopyLZFile
MapViewOfFileEx
GetConsoleWindow
AddConsoleAliasW
FindNextVolumeA
VirtualAlloc
WaitNamedPipeA
GetProcessWorkingSetSize
WaitNamedPipeW
CreateDirectoryExW
EnumSystemLanguageGroupsW
CreateWaitableTimerW
ReadDirectoryChangesW
FreeResource
GetEnvironmentStringsW
MoveFileWithProgressA
IsDebuggerPresent
GetFileType
UpdateResourceA
GetCommandLineW
SetThreadExecutionState
CreateMutexW
FileTimeToLocalFileTime
CreateTimerQueue
SetFileApisToANSI
ReadFileEx
ExpungeConsoleCommandHistoryW
LCMapStringW
RtlZeroMemory
GetVersion

advapi32

GetTraceEnableLevel
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptGetKeyParam
ElfReportEventA
GetNumberOfEventLogRecords
ElfReadEventLogA
ElfReportEventW
LsaQueryInfoTrustedDomain
LsaLookupPrivilegeName
WmiQuerySingleInstanceA
QueryServiceConfigA
AdjustTokenPrivileges
OpenEventLogA
AddAuditAccessObjectAce
SaferiSearchMatchingHashRules
RegRestoreKeyW
ConvertStringSecurityDescriptorToSecurityDescriptorA
ElfReadEventLogW
CryptGetHashParam
LsaICLookupSids
IsTokenRestricted
ReadEventLogW
AddAccessDeniedAce
RegLoadKeyW
CredpDecodeCredential
CryptDeriveKey
ObjectCloseAuditAlarmW
SetKernelObjectSecurity
FreeEncryptionCertificateHashList
UninstallApplication
CryptSetProvParam
CryptSignHashA
GetSecurityDescriptorDacl

msvcrt40

_adj_fdivr_m32i
_cabs
fread
_getsystime
putwc
??_Distream@@QAEXXZ
?name@type_info@@QBEPBDXZ
?sunk_with_stdio@ios@@0HA
??3@YAXPAX@Z
_iob
?precision@ios@@QBEHXZ
?seekoff@streambuf@@UAEJJW4seek_dir@ios@@H@Z
div
??4istream_withassign@@QAEAAV0@ABV0@@Z
??4bad_cast@@QAEAAV0@ABV0@@Z
_findnexti64
??5istream@@QAEAAV0@PAD@Z
__p___winitenv
?lock@ios@@QAAXXZ
_strncoll
_inpd
wcsncpy
??_Gstrstreambuf@@UAEPAXI@Z
??_Eistream_withassign@@UAEPAXI@Z
_sopen
??_Gostrstream@@UAEPAXI@Z
_mbschr
_setmaxstdio
??_8ostream_withassign@@7B@
iswprint
__p__tzname
_ungetch
_findnext
asctime
?str@ostrstream@@QAEPADXZ
_fcvt
__p__amblksiz
strcspn
??6ostream@@QAEAAV0@E@Z
??4ios@@IAEAAV0@ABV0@@Z
_CIfmod
??_Diostream@@QAEXXZ
_mbsrchr
?fill@ios@@QAEDD@Z

query

??0CRegAccess@@QAE@KPBG@Z
?_wcstoui64@@YA_KPBGPAPAGH@Z
?SetProperty@CDbColId@@QAEHPBG@Z
?GetLong@CMemDeSerStream@@UAEJXZ
?DetermineDriveType@CiStorage@@SGIPBG@Z
?GetChar@CMemDeSerStream@@UAEXPADK@Z
??0CIndexTable@@QAE@AAVCiStorage@@AAVCTransaction@@@Z
?Cleanup@CDbProp@@QAEXXZ
?ClearList@CPropertyList@@QAEXXZ
?SetStartKey@CRangeRestriction@@QAEXABVCKeyBuf@@@Z
CIBuildQueryTree
??1CDbPropBaseRestriction@@QAE@XZ
?CheckHasIndexTable@CiStorage@@SGHPBG@Z
?Disconnect@CRequestClient@@QAEXXZ
?SetLPWSTR@CStorageVariant@@QAEXPBGI@Z
?ContainsDrive@CDriveInfo@@SGHPBG@Z
?Set@CPidRemapper@@QAEXAAV?$XArray@K@@@Z
??0CSort@@QAE@I@Z
?Next@CPropertyList@@UAEPBVCPropEntry@@XZ
CITextToSelectTreeEx
??0CMemSerStream@@QAE@I@Z
?Initialize@CImpersonationTokenCache@@QAEXPBGHHHKKK@Z
??0CDbColId@@QAE@XZ
?SetUI8@CStorageVariant@@QAEXT_ULARGE_INTEGER@@I@Z
?LocaleToCodepage@@YGKK@Z
?SetProperty@CFullPropSpec@@QAEHPBG@Z

sqlunirl

_CallMsgFilter_@8
_ExpandEnvironmentStrings_@12
_EnumPropsEx_@12
_RegisterClassEx_@4
_PrintDlg_@4
_GetAtomName_@12
_wvsprintf_@12
_LoadCursorFromFile_@4
_RegUnLoadKey_@8
_GlobalGetAtomName_@12
_SetClassLong_@12
wsprintf_
_DefMDIChildProc_@16
_GetCharWidth32_@16
_CopyEnhMetaFile_@8
_TextOut@20
_AddFontResource_@4
_OutputDebugString_@4
_GetEnvironmentVariable_@12
_GetEnhMetaFile_@4
_ObjectPrivilegeAuditAlarm_@24
_ResetDC_@8
_CharLowerBuff_@8
_QueryDosDevice_@12
_CreateIC_@16
_CreateEvent_@16
_lstrcmp_@8
_GetModuleFileName@12
_GetCommandLine_@0
_BroadcastSystemMessage_@20
_CharToOemBuff_@12
_AppendMenu_@16
_GetProp@8
_MessageBoxIndirect_@4
_LogonUser_@24
_FindWindowEx_@16
_StartDoc@8
_GetLocaleInfo_@16
newWideCharFromMultiByte
newMultiByteFromWideCharEx
_CharToOem_@8

gdi32

DdEntry26
GetRgnBox
CopyEnhMetaFileW
GetObjectType
SetDIBColorTable
RemoveFontResourceExA
GetTextExtentExPointWPri
GetOutlineTextMetricsW
GetPolyFillMode
ArcTo
SelectObject
EngMarkBandingSurface
EngReleaseSemaphore
DdEntry43
GetTransform
ExtCreateRegion
GdiStartPageEMF
GdiPlayJournal
GdiProcessSetup
PolyBezier
EngFindResource
CreateICW
CreateHalftonePalette
CLIPOBJ_ppoGetPath
GetTextCharset
GetObjectW
GdiEntry11
EnumEnhMetaFile
ClearBitmapAttributes
GetEUDCTimeStamp
GdiEntry6
BRUSHOBJ_hGetColorTransform
SetVirtualResolution
bInitSystemAndFontsDirectoriesW
PolyPolygon
GetViewportExtEx
DdEntry23
EngUnlockSurface

crypt32

CryptImportPublicKeyInfoEx
CertGetCTLContextProperty
CertAddEncodedCertificateToStore
CertDuplicateCTLContext
CertRegisterPhysicalStore
RegCreateKeyExU
RegQueryValueExU
CryptSignHashU
CryptGetDefaultOIDFunctionAddress
CertAddCTLLinkToStore
CryptGetKeyIdentifierProperty
CertAddCRLLinkToStore
CryptSIPRetrieveSubjectGuidForCatalogFile
CertSetEnhancedKeyUsage
CryptGetMessageCertificates
PFXImportCertStore
CertCreateCTLContext
CertControlStore
CertCreateCRLContext
I_CryptFlushLruCache
CryptStringToBinaryW
CertCloseStore
CryptEncodeObject
CertCompareCertificate
CryptHashPublicKeyInfo
CertAddCTLContextToStore
CryptBinaryToStringA
CertVerifyCRLRevocation
CertCreateCertificateContext
CryptExportPublicKeyInfo
CertFreeCertificateContext
CertGetCertificateChain
CryptQueryObject
CryptMsgVerifyCountersignatureEncodedEx
CertAddCertificateLinkToStore
CryptHashToBeSigned
CertAddCRLContextToStore
CertComparePublicKeyInfo
CertSerializeCertificateStoreElement
CertCreateContext

dnsapi

Dns_WriteQuestionToMessage
DnsQueryConfigDword
Dns_UpdateLib
Dns_CreateMulticastSocket
DnsFlushResolverCacheEntry_A
DnsRecordBuild_UTF8
DnsReplaceRecordSetW
DnsReplaceRecordSetUTF8
DnsRecordTypeForName
DnsRecordListFree
Dns_PingAdapterServers
DnsNotifyResolverEx
DnsGlobals
DnsUpdateTest_W
Dns_SendAndRecvUdp
NetInfo_Copy
DnsGetBufferLengthForStringCopy
DnsUnicodeToUtf8
DnsCreateReverseNameStringForIpAddress
Dns_ParsePacketRecord
DnsNotifyResolver
DnsRegisterClusterAddress
DnsQueryExW
NetInfo_IsForUpdate
NetInfo_Clean
DnsAsyncRegisterHostAddrs
Dns_CloseSocket
DnsRemoveRegistrations

Sections

.text
Size: 375KB - Virtual size: 375KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 217KB - Virtual size: 217KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 272KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c2ed846536fb0335966eb092d85345bd

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

advapi32

msvcrt40

query

sqlunirl

gdi32

crypt32

dnsapi

Sections

.text Size: 375KB - Virtual size: 375KB

.rdata Size: 217KB - Virtual size: 217KB

.data Size: 272KB - Virtual size: 1.7MB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 375KB - Virtual size: 375KB

.rdata
Size: 217KB - Virtual size: 217KB

.data
Size: 272KB - Virtual size: 1.7MB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1024B - Virtual size: 1024B