18a13fec92a4e23221b5451a92d498f9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

18a13fec92a4e23221b5451a92d498f9_JaffaCakes118
Size

385KB
MD5

18a13fec92a4e23221b5451a92d498f9
SHA1

fbcb19f31153e8634e369992127d17174a547684
SHA256

de582939a62441007812e3e7664330c1366ad9889295f55b8400aab87007c4b0
SHA512

f246ef62f72b82b95fd161e2c95c578eba67f50ad270f7d5fd4254f89f32c851b8f5831c4be1d0c2e05e882d0f927b51be52028a4bfda1353360480da72eb099
SSDEEP

6144:CrZ0dEtL4fVQykeZ1fJ1zONN6gXmKSV91EzbZnyQ1Nogt98m:wZ0CtL4fGAZ1DCN8Br1sbZnbft98

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18a13fec92a4e23221b5451a92d498f9_JaffaCakes118

Files

18a13fec92a4e23221b5451a92d498f9_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f59a4a0f74c80dbac6ae4f4e68648e0a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcirt

?attach@ofstream@@QAEXH@Z
?close@ifstream@@QAEXXZ
?getline@istream@@QAEAAV1@PACHD@Z
?seekp@ostream@@QAEAAV1@JW4seek_dir@ios@@@Z
??4ostrstream@@QAEAAV0@ABV0@@Z
?setrwbuf@stdiobuf@@QAEHHH@Z
??_7stdiobuf@@6B@
?seekoff@filebuf@@UAEJJW4seek_dir@ios@@H@Z
?fill@ios@@QAEDD@Z
??_8ofstream@@7B@
??5istream@@QAEAAV0@AAC@Z
?precision@ios@@QAEHH@Z
??1fstream@@UAE@XZ
??_Efilebuf@@UAEPAXI@Z
?write@ostream@@QAEAAV1@PBCH@Z
??0Iostream_init@@QAE@XZ
??6ostream@@QAEAAV0@G@Z
?str@strstreambuf@@QAEPADXZ
??4streambuf@@QAEAAV0@ABV0@@Z
??6ostream@@QAEAAV0@N@Z
??5istream@@QAEAAV0@PAE@Z
?get@istream@@QAEAAV1@PADHD@Z
??0ifstream@@QAE@HPADH@Z
??0exception@@QAE@XZ
??_8fstream@@7Bistream@@@
?attach@filebuf@@QAEPAV1@H@Z
?is_open@ifstream@@QBEHXZ
??_Eostream_withassign@@UAEPAXI@Z
?rdbuf@fstream@@QBEPAVfilebuf@@XZ
?allocate@streambuf@@IAEHXZ
??_7iostream@@6B@

kernel32

GetProcessAffinityMask
SetProcessWorkingSetSize
GetSystemWindowsDirectoryA
WriteConsoleW
VerLanguageNameW
FreeEnvironmentStringsW
FatalExit
HeapCreate
SetSystemPowerState
InterlockedPushEntrySList
LoadLibraryA
GetLogicalDrives
CreateMailslotA
ReleaseSemaphore
GlobalFindAtomA
HeapCompact
SetConsoleCursorMode
VirtualAlloc
Process32NextW
IsBadStringPtrW
SetConsoleInputExeNameA
CreateMutexA
SetConsoleWindowInfo
FindFirstFileExA
BuildCommDCBW
GlobalGetAtomNameA
SetConsoleMode
CreateActCtxW
OpenFileMappingW
GetPrivateProfileIntW
SetThreadPriority
QueryPerformanceCounter
SizeofResource
OpenWaitableTimerA
VerifyVersionInfoA
ConsoleMenuControl
FindFirstVolumeW
PrepareTape
FlushViewOfFile
GetCommandLineW
lstrcpyn
OpenWaitableTimerW
GetStartupInfoA
GetConsoleAliasesLengthA
EraseTape
GetProfileSectionW
DeleteTimerQueueEx

ntdll

NtRaiseHardError
RtlUnicodeToCustomCPN
RtlNtPathNameToDosPathName
ZwCreateKey
RtlSetCurrentEnvironment
RtlFirstFreeAce
RtlNewSecurityObjectEx
NtQueryInformationProcess
NtSetSystemInformation
NtSetInformationDebugObject
RtlFillMemory
RtlNumberGenericTableElementsAvl
NtOpenFile
ZwSetHighWaitLowEventPair
ZwQuerySemaphore
NtSetLowWaitHighEventPair
NtUnlockFile
RtlDeleteAce
RtlSetUserValueHeap
NtLockRegistryKey
NtProtectVirtualMemory
DbgUiStopDebugging
NtPowerInformation
NtSetEvent
__isascii
NtDuplicateToken
ZwOpenTimer
RtlSetUserFlagsHeap
ZwCompleteConnectPort
RtlpNtSetValueKey
RtlQueryHeapInformation
RtlCreateAtomTable
RtlDnsHostNameToComputerName
RtlCompareUnicodeString
ZwWriteRequestData
ZwRestoreKey

catsrvut

??4CComPlusInterface@@QAEAAV0@ABV0@@Z
?GetITypeLib@CComPlusTypelib@@QAEPAUITypeLib@@XZ
ManagedRequestW
QueryUserDllW
??1CComPlusInterface@@UAE@XZ
SysprepComplus2
??0CComPlusMethod@@QAE@ABV0@@Z
RunMTSToCom
??_7CComPlusMethod@@6B@
FindAssemblyModulesW
??4CComPlusComponent@@QAEAAV0@ABV0@@Z
??1CComPlusComponent@@UAE@XZ
RegDBRestore
??4CComPlusMethod@@QAEAAV0@ABV0@@Z
??_7CComPlusObject@@6B@
SysprepComplus
DllGetClassObject
??_7CComPlusInterface@@6B@
RegDBBackup
??4CComPlusTypelib@@QAEAAV0@ABV0@@Z
??_7CComPlusComponent@@6B@
CGMIsAdministrator
COMPlusUninstallActionW
??0CComPlusObject@@QAE@ABV0@@Z
??0CComPlusComponent@@QAE@ABV0@@Z
??4CComPlusObject@@QAEAAV0@ABV0@@Z
??0CComPlusInterface@@QAE@ABV0@@Z
WinlogonHandlePendingInfOperations
StartMTSTOCOM

odbctrac

TraceSQLSetStmtAttrW
TraceOpenLogFile
TraceVersion
TraceSQLPutData
TraceSQLSpecialColumns
TraceSQLDisconnect
TraceSQLTables
TraceSQLNumResultCols
TraceSQLColAttribute
TraceSQLNativeSql
TraceSQLSetPos
TraceSQLProcedureColumns
TraceSQLFreeStmt
TraceSQLCloseCursor
TraceSQLDescribeColW
TraceSQLGetConnectOptionW
TraceReturn
TraceSQLFreeHandle
TraceSQLSetConnectAttr
TraceSQLPrimaryKeysW
TraceSQLParamData
TraceSQLCopyDesc
TraceSQLTablePrivileges
TraceSQLStatistics
TraceSQLExecDirectW
TraceSQLSpecialColumnsW
TraceSQLBindParam
TraceSQLParamOptions
TraceSQLGetDescField
TraceSQLFetchScroll
TraceSQLGetStmtOption
TraceSQLExtendedFetch
TraceSQLSetConnectAttrW
TraceSQLDrivers
TraceSQLSetDescFieldW
TraceSQLTransact
TraceSQLColumnPrivileges
TraceSQLSetCursorName
TraceCloseLogFile

msvcrt40

_adj_fdiv_r
div
?setp@streambuf@@IAEXPAD0@Z
??0istream@@IAE@ABV0@@Z
_getmbcp
_assert
??_7filebuf@@6B@
_ismbcspace
__p__environ
iswgraph
??1bad_cast@@UAE@XZ
??6ostream@@QAEAAV0@H@Z
fscanf
??_Gistream_withassign@@UAEPAXI@Z
__iscsym
??_Dofstream@@QAEXXZ
memchr
?iword@ios@@QBEAAJH@Z
_mbsrchr
??_Eios@@UAEPAXI@Z
_HUGE
iswdigit
_ftime
_wstat
_mbsdup
wcscat
strtod
?opfx@ostream@@QAEHXZ
??0strstreambuf@@QAE@H@Z
scanf
??0ifstream@@QAE@ABV0@@Z
_errno
_ismbbgraph
?sync@streambuf@@UAEHXZ
??0ios@@IAE@XZ
memmove
_hypot
?setrwbuf@stdiobuf@@QAEHHH@Z
_fpreset
?open@filebuf@@QAEPAV1@PBDHH@Z

cmutil

??4CRandom@@QAEAAV0@ABV0@@Z
CmStripFileNameW
?Init@CmLogFile@@QAEJPAUHINSTANCE__@@HPBD@Z
?CIni_SetFile@CIniA@@KGXPAPADPBD@Z
CmLoadSmallIconA
?SetICSDataPath@CIniW@@QAEXPBG@Z
?CIniA_DeleteEntryFromReg@CIniA@@IBEHPAUHKEY__@@PBD1@Z
?CIniW_DeleteEntryFromReg@CIniW@@IBEHPAUHKEY__@@PBG1@Z
?Log@CmLogFile@@QAAXW4_CMLOG_ITEM@@ZZ
?SetHInst@CIniW@@QAEXPAUHINSTANCE__@@@Z
WzToSzWithAlloc
?SetWriteICSData@CIniW@@QAEXH@Z
CmLoadImageW
?SetPrimaryRegPath@CIniA@@QAEXPBD@Z
?SetFile@CIniW@@QAEXPBG@Z
?LoadEntry@CIniA@@IBEPADPBD@Z
??1CIniW@@QAE@XZ
?GPPS@CIniA@@QBEPADPBD00@Z
??0CmLogFile@@QAE@XZ
??_FCIniW@@QAEXXZ
?GetHInst@CIniW@@QBEPAUHINSTANCE__@@XZ
?GetSection@CIniA@@QBEPBDXZ
?WPPB@CIniA@@QAEXPBD0H@Z
?Generate@CRandom@@QAEHXZ
CmStrchrA
?SetPrimaryRegPath@CIniW@@QAEXPBG@Z
CmBuildFullPathFromRelativeA
CmLoadStringW
??4CIniA@@QAEAAV0@ABV0@@Z
?GetPrimaryRegPath@CIniA@@QBEPBDXZ
??0CRandom@@QAE@I@Z
??0CIniA@@QAE@PAUHINSTANCE__@@PBD111@Z
?Write@CmLogFile@@AAEJPAG@Z
?Init@CRandom@@QAEXK@Z
?CIniA_GetEntryFromReg@CIniA@@IBEPAEPAUHKEY__@@PBD1KK@Z
?Stop@CmLogFile@@QAEJXZ
?CIni_SetFile@CIniW@@KGXPAPAGPBG@Z
?GetPrimaryRegPath@CIniW@@QBEPBGXZ
?GPPI@CIniW@@QBEKPBG0K@Z
MakeBold

Sections

.text
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 244KB - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 443KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f59a4a0f74c80dbac6ae4f4e68648e0a

Headers

DLL Characteristics

File Characteristics

Imports

msvcirt

kernel32

ntdll

catsrvut

odbctrac

msvcrt40

cmutil

Sections

.text Size: 103KB - Virtual size: 103KB

.rdata Size: 244KB - Virtual size: 244KB

.data Size: 20KB - Virtual size: 443KB

.rsrc Size: 16KB - Virtual size: 16KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 103KB - Virtual size: 103KB

.rdata
Size: 244KB - Virtual size: 244KB

.data
Size: 20KB - Virtual size: 443KB

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 1024B - Virtual size: 1024B