17beb95450382f01843a54ab4809cd0d_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

17beb95450382f01843a54ab4809cd0d_JaffaCakes118
Size

869KB
MD5

17beb95450382f01843a54ab4809cd0d
SHA1

7ef6d65e227274fce632a9f1ea961f32a8b92eeb
SHA256

120c301a7d0c423b54d98de9fd71368c64ca43db04b4d061e07ea2935d8b1971
SHA512

92111f1645f9bbce77a3688fab42a10989cfcb74094a16d1c3b129c0058abea2e1070d556d985dce8aa45a82eaba80a58d73e7e2913a96dc1742b3f23b20fcf7
SSDEEP

24576:NuiCFK6/b7TinmgvYgfS6yl/DSrMl5VL6ckiJMgG:eT7T2wQylbSwocxJMg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17beb95450382f01843a54ab4809cd0d_JaffaCakes118

Files

17beb95450382f01843a54ab4809cd0d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

4d5353bdc4363b35ff25576a981d0ed6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mtxoci

ologof
ologTransacted
Enlist
GetXaSwitch
obndra
osetpi
MTxOciInit
MTxOciRegisterCursor
ocon
odescr
obindps
odessp
odefin
oopt
oflng
ogetpi
oclose
obndrv
MTxolog
oexfet
ocof
oexn
ocan
oopen
ofen
MTxOciGetVersion
oerhms
oexec
opinit
obndrn
orol
olog
ocom
odefinps
oparse
obreak

kernel32

FindVolumeClose
CreateDirectoryExW
BackupWrite
CreateMutexA
CancelIo
WaitCommEvent
GetConsoleDisplayMode
FindNextFileA
GetCalendarInfoW
QueryDepthSList
GetTickCount
CompareStringW
SetConsoleTextAttribute
DnsHostnameToComputerNameA
LoadLibraryA
GetPrivateProfileStructA
GetFileAttributesA
GetCurrentProcessId
AddVectoredExceptionHandler
ReadConsoleW
GetCurrentDirectoryA
VirtualAlloc
Heap32ListFirst
InitAtomTable
GlobalMemoryStatus
SetConsoleCursorInfo
VirtualFree
GetFileSize
SetConsoleHardwareState
HeapUnlock
WriteConsoleOutputCharacterA
DeleteFileA
CommConfigDialogW
lstrcpyW
UnlockFile
_llseek
SetHandleCount
GetThreadPriorityBoost
GetProcessId
OpenFileMappingW
GetPrivateProfileIntA
IsDebuggerPresent
GetModuleHandleA
GetSystemDirectoryA

mfcsubs

??H@YG?AVCString@@ABV0@PBG@Z
??O@YG_NPBGABVCString@@@Z
?Left@CString@@QBE?AV1@H@Z
?CopyBeforeWrite@CString@@IAEXXZ
?FormatMessageW@CString@@QAAXIZZ
?FreeAssoc@CMapStringToPtr@@IAEXPAUCAssoc@1@@Z
??0CString@@QAE@XZ
??0CString@@QAE@ABV0@@Z
?Mid@CString@@QBE?AV1@H@Z
?NewAssoc@CMapStringToPtr@@IAEPAUCAssoc@1@XZ
?Lookup@CMapStringToPtr@@QBEHPBGAAPAX@Z
??4CString@@QAEABV0@PBG@Z
??0CString@@QAE@PBG@Z
?InsertAt@CStringArray@@QAEXHPBGH@Z
??M@YG_NPBGABVCString@@@Z
?Release@CString@@IAEXXZ
??H@YG?AVCString@@ABV0@G@Z
?LoadStringW@CString@@QAEHI@Z
??1CMapStringToPtr@@UAE@XZ
??P@YG_NABVCString@@0@Z
?Lock@CCriticalSection@@UAEHK@Z
?GetData@CStringArray@@QAEPAVCString@@XZ
?GetAt@CStringArray@@QBE?AVCString@@H@Z
?SetAt@CString@@QAEXHG@Z
??BCString@@QBEPBGXZ
??0CObject@@IAE@XZ
?SafeStrlen@CString@@KGHPBG@Z
?SetAt@CStringArray@@QAEXHPBG@Z
?SetSize@CStringArray@@QAEXHH@Z
?Unlock@CSyncObject@@UAEHJPAJ@Z
??4CString@@QAEABV0@G@Z
?GetSize@CStringArray@@QBEHXZ
??_FCMapStringToPtr@@QAEXXZ
?IsEmpty@CMapStringToPtr@@QBEHXZ
?GetStartPosition@CMapStringToPtr@@QBEPAU__POSITION@@XZ
?Format@CString@@QAAXPBGZZ
?Right@CString@@QBE?AV1@H@Z
?Unlock@CCriticalSection@@UAEHXZ
??YCString@@QAEABV0@D@Z
??BCCriticalSection@@QAEPAU_RTL_CRITICAL_SECTION@@XZ
?Add@CStringArray@@QAEHPBG@Z

esent

JetGetTruncateLogInfoInstance
JetConvertDDL
JetGetLock
JetOSSnapshotPrepare
JetOpenDatabase
ese
JetEndSession@8
JetGetAttachInfoInstance
JetPrepareUpdate
JetSeek
JetDetachDatabase
JetResetTableSequential
JetTerm
JetBeginTransaction
JetDeleteColumn
JetCreateTableColumnIndex
JetStopBackupInstance
JetPrepareToCommitTransaction
JetUpdate
JetEnumerateColumns
JetOSSnapshotThaw
JetGetInstanceInfo
JetGetTableColumnInfo
JetSnapshotStop
JetDetachDatabase2
JetBeginExternalBackupInstance
JetSetTableSequential
JetCreateTable
JetMove
JetRenameColumn
JetResetSessionContext

w32topl

ToplVertexSetParent
ToplEdgeSetVtx
ToplEdgeFree
ToplScheduleExportReadonly
ToplGraphRemoveVertex
ToplGraphMakeRing
ToplVertexGetParent
ToplVertexGetId
ToplVertexDestroy
ToplListSetIter
ToplVertexNumberOfOutEdges
ToplSTHeapInit
ToplVertexGetOutEdge
ToplGraphInit
ToplSTHeapCostReduced
ToplDeleteComponents
ToplScheduleDuration
ToplListNumberOfElements
ToplEdgeSetWeight
ToplListRemoveElem
ToplGraphFree
ToplMakeGraphState
ToplGraphAddVertex
ToplIterGetObject
ToplAddEdgeToGraph
ToplScheduleCacheCreate
ToplIterFree
ToplHeapExtractMin
ToplGraphFindEdgesForMST
ToplEdgeDisassociate
ToplIterCreate

olecli32

OleCopyToClipboard
LeClose
OleRename
ErrSetUpdateOptions
DibEnumFormat
OleClone
ErrUpdate
GenSetData
DibSaveToStream
OleEqual
BmSaveToStream
LeShow
OleRevertClientDoc
OleDelete
OleCreateInvisible
CheckNetDrive
OleSetColorScheme
SetNetName
LeObjectLong
LeQueryProtocol
OleQueryOpen
OleSaveToStream
ErrQueryProtocol
ErrSetTargetDevice
DibEqual
OleQuerySize
OleObjectConvert

secur32

SetContextAttributesW
LsaUnregisterPolicyChangeNotification
SealMessage
TranslateNameW
DeleteSecurityPackageW
RevertSecurityContext
QueryContextAttributesA
FreeContextBuffer
LsaEnumerateLogonSessions
SecpTranslateNameEx
SaslGetProfilePackageW
CredMarshalTargetInfo
EnumerateSecurityPackagesA
VerifySignature
LsaLogonUser
GetSecurityUserInfo
ImpersonateSecurityContext
ImportSecurityContextW
ImportSecurityContextA
AddCredentialsW
DecryptMessage
ExportSecurityContext
QuerySecurityPackageInfoA
QueryContextAttributesW
AcceptSecurityContext
InitSecurityInterfaceA
DeleteSecurityContext
MakeSignature
AddSecurityPackageA
SaslEnumerateProfilesA
UnsealMessage
LsaFreeReturnBuffer
SecpTranslateName
InitializeSecurityContextW

Sections

.text
Size: 520KB - Virtual size: 520KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 339KB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4d5353bdc4363b35ff25576a981d0ed6

Headers

DLL Characteristics

File Characteristics

Imports

mtxoci

kernel32

mfcsubs

esent

w32topl

olecli32

secur32

Sections

.text Size: 520KB - Virtual size: 520KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 339KB - Virtual size: 1.8MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 520KB - Virtual size: 520KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 339KB - Virtual size: 1.8MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 1024B