1b2af8fda5fa148129f76986dfb5e1c0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

1b2af8fda5fa148129f76986dfb5e1c0_JaffaCakes118
Size

119KB
MD5

1b2af8fda5fa148129f76986dfb5e1c0
SHA1

af012e53d4243663e5f2fef9d55fe980da594851
SHA256

a2be05ef0e963dd104aa13343c238158dae2b2c4d2827170fbc7bcd15a7df4c3
SHA512

54abb4892dd661f699c1fb26fe8962f5a47c3a8406fb5b085fee026de6ffe3ee1e9c59c020baf262dfab613e22e7328417807ef5bb207ffb0f8654d1c5d009d5
SSDEEP

3072:d02gdQoD0TdkxSb2L0MI/O+ilXqkymoyj39+Vzhwpu+8zRzY:dBgdd+dkxZ4MI/OZXQmo632A89Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b2af8fda5fa148129f76986dfb5e1c0_JaffaCakes118

Files

1b2af8fda5fa148129f76986dfb5e1c0_JaffaCakes118
.exe windows:6 windows x86 arch:x86

96492b298bc428b6b5486d205cc84968

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

RAServer.pdb

Imports

advapi32

RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
InitializeAcl
InitializeSecurityDescriptor
MakeAbsoluteSD
IsValidRelativeSecurityDescriptor
RegQueryValueExW
IsValidSecurityDescriptor
MakeSelfRelativeSD
FreeSid
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
AddAccessAllowedAce
GetLengthSid
AllocateAndInitializeSid
AddAccessDeniedAce
GetAce
GetAclInformation
IsValidAcl
GetSecurityDescriptorDacl
DeleteAce
EqualSid
RegEnumValueW
CryptReleaseContext
CryptDestroyKey
CryptGenKey
CryptGetUserKey
CryptAcquireContextW
CryptExportKey
CryptDecrypt
CryptImportKey
CryptEncrypt
EventUnregister
EventWrite
EventRegister

kernel32

InterlockedDecrement
LoadLibraryW
GetProcAddress
GetModuleHandleW
lstrcmpiW
CloseHandle
CreateEventW
GetModuleFileNameW
FreeLibrary
InitializeCriticalSection
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
HeapFree
HeapAlloc
GetProcessHeap
WideCharToMultiByte
GetACP
WaitForSingleObject
CreateThread
Sleep
GetCurrentThreadId
SetEvent
GetCommandLineW
CompareStringW
InterlockedIncrement
ResetEvent
SetLastError
GetSystemDirectoryW
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryExA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedExchange
GetVersionExA
GetLastError
HeapSetInformation
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
OutputDebugStringA
lstrlenW
MultiByteToWideChar

user32

CharNextW
UnregisterClassA
CharUpperW
PostThreadMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadStringW

msvcrt

_onexit
__wgetmainargs
_callnewh
_controlfp
?what@exception@@UBEPBDXZ
??0exception@@QAE@XZ
wcsncmp
??1exception@@UAE@XZ
_lock
__dllonexit
_unlock
_errno
_wtol
?terminate@@YAXXZ
_except_handler4_common
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
memcpy
_wtoi
_vsnwprintf
wcscat_s
wcscpy_s
memset
_purecall
__CxxFrameHandler3
wcsncpy_s
_CxxThrowException
memcpy_s
free
malloc
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
realloc
_cexit
??0exception@@QAE@ABV0@@Z
iswdigit

shlwapi

StrCmpIW

oleaut32

SysAllocStringByteLen
SysStringByteLen
UnRegisterTypeLi
RegisterTypeLi
SafeArrayDestroy
SysAllocString
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
SysStringLen
SysFreeString
SafeArrayAccessData
SafeArrayCreateVector
SafeArrayUnaccessData
VarBstrCmp
SysAllocStringLen
VarBstrCat

ole32

CoWaitForMultipleHandles
CoResumeClassObjects
CoCreateInstance
StringFromGUID2
CoRegisterClassObject
CoRevokeClassObject
CoSuspendClassObjects
CoUninitialize
CoInitializeEx
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW
WTSEnumerateSessionsW

shell32

ShellExecuteW
SHGetSpecialFolderPathW

netapi32

NetLocalGroupGetInfo
NetLocalGroupAdd
NetLocalGroupDel
NetLocalGroupAddMembers
NetLocalGroupDelMembers
NetLocalGroupGetMembers
NetApiBufferFree

crypt32

CryptStringToBinaryW
CryptBinaryToStringW

Sections

.text
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

96492b298bc428b6b5486d205cc84968

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

shlwapi

oleaut32

ole32

wtsapi32

shell32

netapi32

crypt32

Sections

.text Size: 77KB - Virtual size: 76KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 14KB - Virtual size: 13KB

.reloc Size: 27KB - Virtual size: 27KB

.text
Size: 77KB - Virtual size: 76KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 14KB - Virtual size: 13KB

.reloc
Size: 27KB - Virtual size: 27KB