1b08e2a9b5d4b35033810bf391ae0fbf_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

1b08e2a9b5d4b35033810bf391ae0fbf_JaffaCakes118
Size

166KB
MD5

1b08e2a9b5d4b35033810bf391ae0fbf
SHA1

fc7d66d266c307cf475623aa516b61a743281bb8
SHA256

8ed610ac3be8d81187648c1d81f08be1e058675ef570b10627dc347ad17df46d
SHA512

61653f4340b2f9ed730bb92b6de7fc6219eda5292aadd809bf78aebdd99dcd53e521c5a97db384e35334e9a80fae7b6266d3671a7392261992ec9b3a601e2fa0
SSDEEP

3072:are81t2R00C3pPV7T9krISBhyvw/qR5GC46JtsiS1N1bnmQEVuB9VAAnsN:DiH0CDT+rXBhyNLT6iM9mg/GAs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b08e2a9b5d4b35033810bf391ae0fbf_JaffaCakes118

Files

1b08e2a9b5d4b35033810bf391ae0fbf_JaffaCakes118
.exe windows:5 windows x86 arch:x86

22a2599fdac9e28092302f8ff7630b5f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlValidateUnicodeString
_aullrem
NtOpenProcessToken
ZwOpenKey
NtOpenThread
ZwSetIoCompletion
LdrShutdownThread
ZwSetEventBoostPriority
ZwEnumerateBootEntries
NtSetSystemEnvironmentValueEx
RtlInitializeCriticalSectionAndSpinCount
iscntrl
strpbrk
NtRenameKey
RtlSetUserFlagsHeap
NtReleaseKeyedEvent
RtlMultiByteToUnicodeN
NtSetBootOptions
LdrUnlockLoaderLock
ZwSetThreadExecutionState
DbgUserBreakPoint
ZwCloseObjectAuditAlarm
RtlDeleteResource
iswspace
RtlGetLengthWithoutLastFullDosOrNtPathElement
_ftol
RtlDosSearchPath_Ustr
ZwQueryVirtualMemory
NtEnumerateSystemEnvironmentValuesEx
RtlDeleteSecurityObject
DbgUiStopDebugging
RtlImageRvaToSection
RtlVerifyVersionInfo
RtlInterlockedPushListSList
NtResumeThread
NtSystemDebugControl
NtLockFile
ZwOpenThreadTokenEx
NlsMbOemCodePageTag
RtlFreeThreadActivationContextStack
RtlAppendAsciizToString
RtlUpcaseUnicodeStringToOemString
mbstowcs
NtSetDefaultHardErrorPort
_wtoi
ZwSetEaFile
RtlAllocateHeap
ZwCreateSection
RtlpApplyLengthFunction
RtlDoesFileExists_U
RtlInsertElementGenericTableAvl
NtPlugPlayControl
LdrLoadDll
RtlNewSecurityObjectWithMultipleInheritance
NtAccessCheckAndAuditAlarm
NtTranslateFilePath
RtlActivateActivationContextEx
RtlCreateQueryDebugBuffer
RtlValidateHeap
ZwDeleteObjectAuditAlarm
ZwSetHighEventPair
RtlDestroyEnvironment
RtlpUnWaitCriticalSection
ZwCancelIoFile
RtlCopyLuidAndAttributesArray
ZwAddBootEntry
NtLockProductActivationKeys
NtShutdownSystem
NtCreateNamedPipeFile
NtSetEvent

sqlunirl

_QueryServiceConfig_@16
_StartService_@12
_IsCharAlphaNumeric_@4
_SearchPath_@24
_GetCommandLine_@0
_CopyFile_@12
_NDdeShareSetInfo_@24
_ObjectPrivilegeAuditAlarm_@24
_tsystem
_GetUnicodeRedirectionLayer@0
_LoadLibrary@4
_CommConfigDialog_@12
_CreateWindowStation_@16
_DeviceCapabilities_@20
__hwrite_@12
_CreateAcceleratorTable_@8
_GetFileAttributes_@4
_GetProfileSection_@12
_GetDriveType_@4
_CharToOemBuff_@12
_WriteProfileSection_@8
_CopyFileEx_@24
_WaitNamedPipe_@8
_CreateEvent_@16
_CreateMetaFile_@4
_NDdeTrustedShareEnum_@24
_EnumResourceLanguages_@20
_SendNotifyMessage_@16
_PageSetupDlg_@4
_CreateColorSpace_@4
_DefWindowProc@16
_BackupEventLog_@8
_FormatMessage@28
_GetCharABCWidthsFloat_@16
_EnumProps_@8

user32

BeginDeferWindowPos
DdeQueryNextServer
SystemParametersInfoA
GetMenuItemInfoA
SetTimer
CharToOemW
GetWindowTextW
GetClipboardData
GetWindow
PostQuitMessage
ReasonCodeNeedsBugID
GetAltTabInfoA
EnterReaderModeHelper
SetClassWord
DdeCreateStringHandleW
ToAscii
GetKeyboardLayout
PrivateExtractIconsA
BroadcastSystemMessageW
GetClassLongW
EmptyClipboard
VkKeyScanA
MessageBeep
ChangeDisplaySettingsExW
DestroyCaret
GetWindowTextA
CheckDlgButton
IsCharAlphaNumericA
GetWindowDC
DdeQueryStringA
CreateIconFromResource
TrackPopupMenu
DdeReconnect
DdeGetLastError

kernel32

SetFileShortNameW
EnumResourceNamesA
FatalExit
LoadLibraryA
UnhandledExceptionFilter
EscapeCommFunction
ActivateActCtx
InitializeCriticalSectionAndSpinCount
GetSystemWow64DirectoryA
GlobalSize
WriteConsoleInputW
SetFileApisToOEM
VirtualAlloc
GetHandleContext
EnumSystemCodePagesA
CreateFiberEx
CommConfigDialogA
SetLocalPrimaryComputerNameA
GetLocaleInfoW
LZCreateFileW
PeekConsoleInputW
LocalCompact
HeapCompact
GetProcessIoCounters
FormatMessageW
GetProcessShutdownParameters
Module32NextW
DeleteVolumeMountPointW
GlobalFindAtomW
EraseTape
RegisterWowExec

msvcrt40

_stati64
__doserrno
??0__non_rtti_object@@QAE@PBD@Z
??6ostream@@QAEAAV0@E@Z
strncpy
??0fstream@@QAE@HPADH@Z
?overflow@strstreambuf@@UAEHH@Z
??0logic_error@@QAE@ABQBD@Z
??4istream@@IAEAAV0@PAVstreambuf@@@Z
??0iostream@@IAE@ABV0@@Z
abort
_wcsnset
_wtoi
?eatwhite@istream@@QAEXXZ
_adj_fdiv_m32
__threadid
??_8iostream@@7Bostream@@@
??0ostrstream@@QAE@XZ
??0ofstream@@QAE@XZ
_initterm
?hex@@YAAAVios@@AAV1@@Z
perror
strcspn
swscanf
_ismbcdigit
__p__mbctype
?put@ostream@@QAEAAV1@C@Z
?adjustfield@ios@@2JB
_CItanh
_wfullpath
??_Eiostream@@UAEPAXI@Z
??0istrstream@@QAE@PADH@Z
?openprot@filebuf@@2HB

netcfgx

DllGetClassObject
LanaCfgFromCommandArgs
NetPropPageProvider
HrDiAddComponentToINetCfg
NetClassInstaller
NetCfgDiagFromCommandArgs
NetCfgDiagRepairRegistryBindings

Sections

.text
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

22a2599fdac9e28092302f8ff7630b5f

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

sqlunirl

user32

kernel32

msvcrt40

netcfgx

Sections

.text Size: 82KB - Virtual size: 82KB

.rdata Size: 36KB - Virtual size: 36KB

.data Size: 44KB - Virtual size: 216KB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 82KB - Virtual size: 82KB

.rdata
Size: 36KB - Virtual size: 36KB

.data
Size: 44KB - Virtual size: 216KB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 1KB - Virtual size: 1KB