173fdc0065af17ac6d01dc96c1972597_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

173fdc0065af17ac6d01dc96c1972597_JaffaCakes118
Size

104KB
MD5

173fdc0065af17ac6d01dc96c1972597
SHA1

db65ad4352fc727b46faa5731d8b5112c5823c13
SHA256

4da808c4b8b1fde972631b097fe180dc55b449379ab85693cc0139d5b5c71ad3
SHA512

3002f5bcb716f903c26795375a8de1e80e1893efbabef2042bf7135cffc566f4d8a14f0849e573037db5e0420c8bb161c9ad03a8cd3c4fdf82739a2865c83f5f
SSDEEP

1536:0ufJG5bVxZAhEcT1yULhiAJ0CuQecvhvMsQ3KYbzOEyai:o5bcT8ULRqgRi0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
173fdc0065af17ac6d01dc96c1972597_JaffaCakes118

Files

173fdc0065af17ac6d01dc96c1972597_JaffaCakes118
.exe windows:6 windows x86 arch:x86

67cbad80770a6a6cb9cdbaa0599d2663

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

DeviceDisplayObjectProvider.pdb

Imports

advapi32

TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
EventRegister
EventUnregister
RegDeleteKeyValueW
RegGetValueW
RegSetKeyValueW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegEnumValueW
EventWrite

kernel32

GlobalAlloc
AcquireSRWLockShared
ReleaseSRWLockShared
GetComputerNameExW
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
ResetEvent
SubmitThreadpoolWork
CreateThreadpoolWork
GlobalFree
ReadFile
WriteFile
SetFilePointerEx
GetFileSizeEx
WaitForSingleObject
GetCurrentProcess
CreateFileW
InterlockedIncrement
InterlockedDecrement
SetEvent
CloseHandle
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeSRWLock
DuplicateHandle
GetTickCount
CreateEventW
CreateThreadpoolTimer
GetLastError
InterlockedExchange
MultiByteToWideChar
GetSystemFirmwareTable
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
Sleep
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange

user32

GetDisplayConfigBufferSizes
DisplayConfigGetDeviceInfo
QueryDisplayConfig

msvcrt

__set_app_type
free
_purecall
malloc
memset
qsort
_wcsnicmp
wcsstr
_wcsicmp
_vsnwprintf
__RTDynamicCast
wcschr
memcpy
_callnewh
__getmainargs
_cexit
_controlfp
_except_handler4_common
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_ismbblead
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_XcptFilter
_exit

ole32

CoAddRefServerProcess
CoReleaseServerProcess
CoUninitialize
CLSIDFromString
IIDFromString
StringFromIID
StringFromGUID2
CoTaskMemFree
CoTaskMemAlloc
PropVariantClear
CreateStreamOnHGlobal
CoCreateInstance
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject

devobj

DevObjGetDeviceProperty
DevObjOpenDeviceInfo
DevObjCreateDeviceInfoList
DevObjDestroyDeviceInfoList

propsys

PSPropertyKeyFromString

dmrc

DMrcQueryModelId
DMrcGetProperties
DMrcQueryClose
DMrcInit
DMrcExit
DMrcQueryHardwareId

xmllite

CreateXmlReader

bcrypt

BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptGetProperty
BCryptCreateHash
BCryptHashData

Sections

.text
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

67cbad80770a6a6cb9cdbaa0599d2663

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

ole32

devobj

propsys

dmrc

xmllite

bcrypt

Sections

.text Size: 75KB - Virtual size: 75KB

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 24KB - Virtual size: 24KB

.text
Size: 75KB - Virtual size: 75KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 24KB - Virtual size: 24KB