1bb95583768db41fca977970bbe0fe06_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

1bb95583768db41fca977970bbe0fe06_JaffaCakes118
Size

588KB
MD5

1bb95583768db41fca977970bbe0fe06
SHA1

8dbdebd2cfe5b6d071b325eaab24ea682377e17d
SHA256

a45819a682009e164a0e44cbcde856559f8c7c390742e1d24bbd68fe7bfabea3
SHA512

b732dade72d5ca46962ce6eb0ad6b0f96e86fd60ae30641fc4c34869e46636d01fc3c4545b196be04e8b9f5a3d83834ef4f3122e0fbc38a2ceab39ce82dde48f
SSDEEP

12288:Hxtzfl8EmN95SKTifcNjvYRoo1QBPP2E7ZgT7FoyNjGyDe3mjw:Hbl8EmN95KkFvEook2E7ivKyNjGyD3w

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1bb95583768db41fca977970bbe0fe06_JaffaCakes118

Files

1bb95583768db41fca977970bbe0fe06_JaffaCakes118
.exe windows:6 windows x86 arch:x86

366a15cab9ba617be7218bf386b42512

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

s:\YTB\AutoUpdater\Main\YahooAUService\Release\YahooAUService.pdb

Imports

imagehlp

ImageEnumerateCertificates
ImageGetCertificateHeader
ImageGetCertificateData

shlwapi

StrRChrA

winhttp

WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpConnect
WinHttpSendRequest
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpCloseHandle
WinHttpQueryOption
WinHttpSetOption
WinHttpCrackUrl
WinHttpReceiveResponse
WinHttpOpen

kernel32

LoadResource
FindResourceW
LoadLibraryExW
GetCommandLineW
DeleteFileW
LockResource
FindResourceExW
lstrlenA
WideCharToMultiByte
ReadFile
GetFileSize
CreateFileW
GetShortPathNameW
GetExitCodeProcess
TerminateProcess
CreateProcessW
OpenProcess
Process32NextW
ProcessIdToSessionId
Process32FirstW
CreateToolhelp32Snapshot
GetProcAddress
LoadLibraryW
GetVersionExW
IsBadReadPtr
FindClose
FindFirstFileW
GetFileAttributesW
CreateDirectoryExW
lstrcpyW
GetTempPathW
lstrcatW
RemoveDirectoryW
FindNextFileW
TryEnterCriticalSection
GetTickCount
DeleteTimerQueueTimer
CreateTimerQueueTimer
LoadLibraryA
CreateFileA
lstrcmpA
lstrcmpiA
DebugBreak
GetCurrentProcessId
QueryPerformanceCounter
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SizeofResource
MultiByteToWideChar
FreeLibrary
SetEvent
InterlockedDecrement
InterlockedIncrement
CreateEventW
CreateThread
GetCurrentThreadId
GetModuleHandleW
Sleep
GetModuleFileNameW
WaitForSingleObject
CloseHandle
lstrcmpiW
GetLastError
RaiseException
lstrlenW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
VirtualQuery
GetStringTypeW
SetEndOfFile
GetStringTypeA
GetCPInfo
LCMapStringW
SetFilePointer
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStartupInfoA
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
GetModuleFileNameA
GetStdHandle
WriteFile
HeapCreate
VirtualAlloc
VirtualFree
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
ExitProcess
LCMapStringA
GetStartupInfoW
DeleteFileA
MoveFileA
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
RtlUnwind
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
GetModuleHandleA

user32

UnregisterClassA
LoadStringW
PostThreadMessageW
MessageBoxW
CharNextW
TranslateMessage
CharUpperW
DispatchMessageW
GetMessageW

advapi32

CryptEncrypt
RegOpenKeyExA
RegQueryValueExA
CryptDecrypt
CryptReleaseContext
CryptDeriveKey
CryptDestroyKey
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptAcquireContextW
OpenProcessToken
DuplicateTokenEx
SetTokenInformation
CreateProcessAsUserW
ChangeServiceConfigW
ChangeServiceConfig2W
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
ControlService
DeleteService
CreateServiceW
RegEnumKeyExW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
SetServiceStatus
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegQueryInfoKeyW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW

shell32

SHGetPathFromIDListW
SHGetMalloc
SHGetSpecialFolderLocation

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoInitializeSecurity
CoRevokeClassObject
CoRegisterClassObject
CoUninitialize
CoTaskMemFree
CoInitialize
StringFromGUID2
CoCreateInstance
CoCreateGuid
OleRun
CLSIDFromString
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUnmarshalInterface

oleaut32

SafeArrayCreateVector
SafeArrayPutElement
SafeArrayDestroy
VariantClear
VariantInit
SysStringByteLen
SysAllocStringByteLen
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
SysFreeString
GetErrorInfo

Sections

.text
Size: 406KB - Virtual size: 406KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

366a15cab9ba617be7218bf386b42512

Headers

File Characteristics

PDB Paths

Imports

imagehlp

shlwapi

winhttp

kernel32

user32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 406KB - Virtual size: 406KB

.rdata Size: 134KB - Virtual size: 134KB

.data Size: 22KB - Virtual size: 42KB

.rsrc Size: 21KB - Virtual size: 20KB

.text
Size: 406KB - Virtual size: 406KB

.rdata
Size: 134KB - Virtual size: 134KB

.data
Size: 22KB - Virtual size: 42KB

.rsrc
Size: 21KB - Virtual size: 20KB