2665101570aef7c236c831de320853e2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2665101570aef7c236c831de320853e2_JaffaCakes118
Size

862KB
MD5

2665101570aef7c236c831de320853e2
SHA1

6b354f9e3fb8f3f22a633f30045e5f6c5594c18a
SHA256

c2a8fe0ff6d796ab5d2eee5d12ebbd81aa6ff2a464abd264283f556aa268911e
SHA512

b32f67a0f732ff89c43b2c4ad39d26edc4fc269e272ed9fcdefc52023a9f367bbd35d26a309683e949be6c6bdefe373600183c3f7e36f10dee68fefb8297a8f2
SSDEEP

24576:HC6aiiqpVAiiz0e1fK10S7b/j3OzKMWbCapdFFQ7jS1oTPaMM6fGuYXUn:i6aDqpVUK10S7+z7nMMjS1oE6fGuJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2665101570aef7c236c831de320853e2_JaffaCakes118

Files

2665101570aef7c236c831de320853e2_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6dc4dba0c3b6a76e9bd1d472ef3edb66

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

opengl32

glGetPixelMapusv
glViewport
glGetClipPlane
glTexCoord3sv
wglRealizeLayerPalette
glRasterPos4dv
glDisableClientState
glClipPlane
glColor4iv
glColor4dv
glRotatef
glVertex2f
glDepthRange
glIndexdv
glNormal3i
glLighti
glDrawArrays
glColor4s
glRotated
glRectiv
glGetString
glColor4us
glNormal3fv
glGetTexGendv
glEvalCoord2dv
glColor3uiv
glEvalCoord2f
glVertex4i
glTexCoord2i
glNormal3iv

uxtheme

GetThemeSysSize
IsThemePartDefined
GetThemeMetric
GetThemeString
OpenThemeData
GetThemePropertyOrigin
GetThemeFilename
CloseThemeData
EnableThemeDialogTexture
GetThemeTextExtent
IsThemeActive
GetThemeAppProperties
GetThemeColor
GetThemeSysInt
IsThemeDialogTextureEnabled
GetThemeSysBool
SetWindowTheme
GetThemeSysFont
GetThemeMargins
GetThemePartSize
DrawThemeBackground
GetThemeSysColorBrush
GetThemePosition
DrawThemeIcon
GetCurrentThemeName
GetThemeBackgroundContentRect
GetThemeDocumentationProperty
DrawThemeText
GetThemeIntList
DrawThemeEdge
GetThemeBackgroundExtent
EnableTheming
IsThemeBackgroundPartiallyTransparent
GetThemeSysString
GetThemeEnumValue
GetThemeTextMetrics

advapi32

SetEntriesInAuditListA
SetServiceBits
CredpConvertCredential
SystemFunction040
InitiateSystemShutdownA
SetTraceCallback
LsaSetForestTrustInformation
RegRestoreKeyA
A_SHAInit
AccessCheckByTypeAndAuditAlarmW
LsaOpenPolicySce
RegSaveKeyExW
WmiSetSingleInstanceA
ObjectDeleteAuditAlarmA
CredWriteDomainCredentialsA
CloseTrace
CreatePrivateObjectSecurityEx
GetUserNameW
AddAccessDeniedObjectAce
ConvertSecurityDescriptorToStringSecurityDescriptorW
RegRestoreKeyW
SystemFunction002
OpenEventLogW
InstallApplication
GetTrusteeTypeW
ElfOpenBackupEventLogA
ObjectOpenAuditAlarmW
IdentifyCodeAuthzLevelW
SetSecurityDescriptorRMControl
SystemFunction011
AddAccessDeniedAceEx
UnlockServiceDatabase
LogonUserExW
MapGenericMask
ConvertSecurityDescriptorToStringSecurityDescriptorA
CloseEncryptedFileRaw
BuildTrusteeWithSidW
CreatePrivateObjectSecurity
LsaGetRemoteUserName
ImpersonateSelf
GetInformationCodeAuthzLevelW
GetAuditedPermissionsFromAclW
ElfOpenEventLogW
LsaQueryTrustedDomainInfoByName

modemui

UnimodemGetDefaultCommConfig
drvCommConfigDialogA
UnimodemDevConfigDialog
drvGetDefaultCommConfigW
ModemPropPagesProvider
QueryModemForCountrySettings
UnimodemGetExtendedCaps
InvokeControlPanel
drvGetDefaultCommConfigA
drvCommConfigDialogW
drvSetDefaultCommConfigW
CountryRunOnce
drvSetDefaultCommConfigA
ModemCplDlgProc

crtdll

_tzset
iswspace
ispunct
_mbslen
_isctype
free
_ftime
_sopen
_j0
_CIasin
iscntrl
towlower
_CIacos
__argv_dll
_access
_flsbuf
_purecall
_rmtmp
_creat
_mbspbrk
realloc
_ismbcprint
_ismbclower
_splitpath
_mbstrlen
strncpy
_strtime
mbtowc
_ismbbalpha
wcstol
localeconv
_isatty
_osmode_dll
_stricmp

kernel32

SetComputerNameExA
lstrcmpiA
GetNumaNodeProcessorMask
GetCalendarInfoA
DosPathToSessionPathA
CancelTimerQueueTimer
Module32FirstW
FindActCtxSectionStringA
HeapCreate
RaiseException
MoveFileWithProgressA
GetProcAddress
LCMapStringA
GetCompressedFileSizeA
EnumerateLocalComputerNamesW
OutputDebugStringA
PeekNamedPipe
GetACP
CompareStringW
WritePrivateProfileStructA
GetPrivateProfileIntW
GetProfileStringW
GetOEMCP
ShowConsoleCursor
SetThreadUILanguage
OpenEventA
GetLastError
GetEnvironmentStringsW
CreateMailslotW
SetThreadLocale
VirtualAlloc
LoadLibraryA
CopyLZFile

msoert2

CreateStreamOnHFile
PVGetCertificateParam
HrCopyStreamCBEndOnCRLF
HrRewindStream
HrIStreamWToBSTR
HrGetMsgParam
PszAllocA
HrIsStreamUnicode
IsUpper
CleanupGlobalTempFiles
DeleteTempFile
IsDigit
FIsSpaceA
HrDecodeObject
IDrawText
CreateTempFileStream
HrGetBodyElement
GetExePath
HrCopyStreamCB
HrIndexOfWeek
CchFileTimeToDateTimeSz
HrGetCertificateParam
HrGetStreamSize
StripCRLF
FreeTempFileList
PszDupW
OpenFileStreamW
HrIStreamToBSTR
IsPrint
strtrim
HrCopyStream
CreateStreamOnHFileW
HrCreatePhonebookEntry
HrSafeGetStreamSize
BrowseForFolder
HrGetCertKeyUsage
UnlocStrEqNW
FIsSpaceW

Sections

.text
Size: 350KB - Virtual size: 350KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 337KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6dc4dba0c3b6a76e9bd1d472ef3edb66

Headers

DLL Characteristics

File Characteristics

Imports

opengl32

uxtheme

advapi32

modemui

crtdll

kernel32

msoert2

Sections

.text Size: 350KB - Virtual size: 350KB

.rdata Size: 170KB - Virtual size: 170KB

.data Size: 337KB - Virtual size: 1.7MB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 350KB - Virtual size: 350KB

.rdata
Size: 170KB - Virtual size: 170KB

.data
Size: 337KB - Virtual size: 1.7MB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1024B - Virtual size: 1024B