22fe368e49838313d2d2cf7d3232b94b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

22fe368e49838313d2d2cf7d3232b94b_JaffaCakes118
Size

126KB
MD5

22fe368e49838313d2d2cf7d3232b94b
SHA1

2909c94906a9636aac45e2787d2e71cee984f70a
SHA256

794fc7a8a2172f8911f3349ea67f746f797e90a6cf3df1b3692f760250e58576
SHA512

1742cdc573de181d7b06966391cbdef66d3034c79262410426a9c067c6bf8ae94f73da10dfe855bec9be70d5544625a728b2608b60f7d4547a0f1e0b91db9821
SSDEEP

3072:RPYtxQZYWtoVnjM8DjZ8xL7ckr51VddSlOhdhJTU:RPSxQinVnAIN8x7ckrjYW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
22fe368e49838313d2d2cf7d3232b94b_JaffaCakes118

Files

22fe368e49838313d2d2cf7d3232b94b_JaffaCakes118
.exe windows:5 windows x86 arch:x86

7498259f6ead868ce8a7173d5a3fd5b6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntmarta

AccRewriteSetNamedRights
AccProvHandleSetAccessRights
AccProvIsAccessAudited
AccProvHandleGrantAccessRights
AccGetExplicitEntries
AccFreeIndexArray
AccProvGetAccessInfoPerObjectType
AccRewriteGetHandleRights
AccProvRevokeAccessRights
AccProvGetCapabilities
AccTreeResetNamedSecurityInfo
AccLookupAccountTrustee
EventNameFree
AccRewriteGetNamedRights
AccProvGetOperationResults
AccProvGetTrusteesAccess
AccSetEntriesInAList
AccGetInheritanceSource
AccProvGetAllRights
AccLookupAccountSid
AccGetAccessForTrustee
AccRewriteSetHandleRights
AccRewriteGetExplicitEntriesFromAcl

ws2_32

freeaddrinfo
WSAAddressToStringA
accept
getservbyport
WSASetServiceW
WSALookupServiceBeginA
socket
connect
getaddrinfo
WSAGetServiceClassInfoW
WSAAsyncGetProtoByNumber
WSASetLastError
WSAAsyncSelect
gethostname
WSAAccept
WSACloseEvent
WSAEventSelect
WSAHtons
closesocket
WSASetServiceA
WSCWriteNameSpaceOrder
WSApSetPostRoutine

kernel32

FreeEnvironmentStringsW
IsDBCSLeadByte
GetPrivateProfileSectionNamesA
FindActCtxSectionStringW
LoadLibraryA
CreateProcessInternalW
SetComPlusPackageInstallStatus
RtlUnwind
VirtualAlloc
ExitProcess
SetMessageWaitingIndicator
GetConsoleScreenBufferInfo
CreateMemoryResourceNotification
GetFileAttributesExA
GetSystemTimeAsFileTime
SetHandleInformation
LoadResource
CancelTimerQueueTimer
OpenWaitableTimerW
FreeResource
GetStartupInfoA
HeapFree
_lcreat

ntdll

ZwMapUserPhysicalPagesScatter
RtlxUnicodeStringToOemSize
ZwFlushInstructionCache
RtlSecondsSince1970ToTime
RtlEraseUnicodeString
RtlCreateProcessParameters
RtlxOemStringToUnicodeSize
RtlGetElementGenericTableAvl
LdrUnlockLoaderLock
NtWriteFile
RtlApplyRXact
NtAdjustPrivilegesToken
ZwGetWriteWatch
NtStartProfile
NtOpenThreadToken
RtlGetNtGlobalFlags
NtOpenSemaphore
RtlLookupElementGenericTableAvl

atmlib

ATMGetVersionExW
ATMAddFontExW
ATMFontAvailable
ATMFontStatus
ATMXYShowTextA
ATMMakePFM
ATMAddFontA
ATMGetMenuName
ATMRemoveFontA
ATMGetBuildStr
ATMGetFontInfoA
ATMAddFont
ATMGetGlyphListA
ATMEnumFontsW
ATMGetOutlineA
ATMXYShowTextW
ATMGetMenuNameW
ATMFontSelected
ATMSelectObject
ATMRemoveFontW
ATMGetVersion
ATMGetVersionExA

sqlunirl

_GetUserName@8
_LookupAccountName_@28
_GetTimeFormat_@24
_ChangeDisplaySettings_@8
_Shell_NotifyIcon_@8
_LoadImage_@24
_PrintDlg_@4
_CharToOemBuff_@12
_NDdeShareSetInfo_@24
_ResetDC_@8
_CommDlg_OpenSave_GetSpec@12
_SetICMProfile_@8
_LogonUser_@24
_FindFirstFileEx_@24
_LoadLibraryEx_@12
_GetProp@8
__hwrite_@12
_NDdeIsValidAppTopicList_@4
_CreateAcceleratorTable_@8

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7498259f6ead868ce8a7173d5a3fd5b6

Headers

DLL Characteristics

File Characteristics

Imports

ntmarta

ws2_32

kernel32

ntdll

atmlib

sqlunirl

Sections

.text Size: 43KB - Virtual size: 42KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 76KB - Virtual size: 216KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 200B

.text
Size: 43KB - Virtual size: 42KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 76KB - Virtual size: 216KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 200B