267ec75dd03bbe53cd9b6242d2de99c6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

267ec75dd03bbe53cd9b6242d2de99c6_JaffaCakes118
Size

42KB
MD5

267ec75dd03bbe53cd9b6242d2de99c6
SHA1

06d380297c83f7878f35a0480f384ac3f4308850
SHA256

4c3bad5fbc66c7eb4c20e5ca03c51ea932163fe6b288efda5a14a327ab924065
SHA512

955af485766c968387660d475ea973dc3382bc973d589a6560fe3785e0274f4fa8b5f9ee470b177496f8e2979a7d3986cf8f7566878699334cfb7e44be186dc0
SSDEEP

768:EX6lB5wof8aeYsStW0p2WtM1Xgo8+0mlyFElg/sz:XBZteYsP0prtO3lyFE8sz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
267ec75dd03bbe53cd9b6242d2de99c6_JaffaCakes118

Files

267ec75dd03bbe53cd9b6242d2de99c6_JaffaCakes118
.exe windows:5 windows x86 arch:x86

5ee33d00812475ea266080d4c15664af

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msls31

LssbGetDurTrailInSubline
LsModifyLineHeight
LsCreateSubline
LsdnSubmitSublines
LsDestroySubline
LsdnDistribute
LsQueryLinePointPcp
LsTruncateSubline
LsPointXYFromPointUV
LsdnResolvePrevTab
LsdnGetCurTabInfo
LsDisplaySubline
LsdnSetRigidDup
LsdnQueryPenNode
LsPointUV2FromPointUV1
LsMatchPresSubline
LsdnGetDup
LsQueryPointPcpSubline
LsGetHihLsimethods
LsSetModWidthPairs
LssbGetPlsrunsFromSubline
LsCompressSubline
LssbFDoneDisplay
LsSqueezeSubline
LsForceBreakSubline
LsExpandSubline
LsdnFinishDelete
LssbFDonePresSubline
LsGetWarichuLsimethods
LsResetRMInCurrentSubline

opengl32

glMapGrid1f
glFinish
glLightiv
glVertex3s
glRasterPos2iv
glPopMatrix
glColor3sv
glAreTexturesResident
glSelectBuffer
wglSwapMultipleBuffers
glTexCoord4fv
glIndexf
glEvalCoord2dv
glDrawElements
glScaled
glColor4d
glBlendFunc
glEvalCoord2f
glPushName
glVertex3sv
glPixelMapusv
GlmfInitPlayback
glFogfv
glMaterialiv
glTexSubImage1D
wglDescribeLayerPlane
glTexCoord1s
glVertex2f
glColor3b
glInitNames
glColor3i
wglGetCurrentDC

wininet

PrivacyGetZonePreferenceW
CreateUrlCacheEntryW
FtpCommandA
InternetGetCertByURL
InternetWriteFileExW
CreateUrlCacheContainerW
InternetSetDialStateA
RetrieveUrlCacheEntryFileW
FtpCreateDirectoryW
InternetConfirmZoneCrossingA
InternetAutodial
InternetEnumPerSiteCookieDecisionA
InternetReadFileExA
InternetShowSecurityInfoByURLA
InternetFindNextFileA
InternetClearAllPerSiteCookieDecisions
InternetAutodialCallback
ParseX509EncodedCertificateForListBoxEntry
InternetSetCookieExA
FindNextUrlCacheEntryW
InternetCreateUrlW
InternetSetOptionExA
GetUrlCacheEntryInfoA
InternetQueryDataAvailable
IsUrlCacheEntryExpiredA
InternetTimeToSystemTimeA
DeleteUrlCacheContainerA
InternetGoOnlineW
FtpRenameFileW
FtpOpenFileW
InternetCrackUrlW
InternetWriteFile
InternetConfirmZoneCrossingW
InternetGoOnline
FtpPutFileA
InternetOpenA
DllInstall
FtpRenameFileA

setupapi

CM_Query_And_Remove_SubTree_ExA
CM_Get_Log_Conf_Priority_Ex
CM_Set_DevNode_Registry_Property_ExW
CM_Get_Device_ID_Size_Ex
CM_Get_Class_Name_ExW
SetupQuerySpaceRequiredOnDriveA
CM_Get_Sibling_Ex
SetupVerifyInfFileA
SetupDiSelectOEMDrv
SetupDiGetINFClassW
SetupSetSourceListA
CM_Get_Hardware_Profile_InfoA
SetupGetTargetPathA
MyFree
CM_Modify_Res_Des
SetupDiGetDeviceRegistryPropertyA
CM_Get_Next_Log_Conf
SetupDiSelectDevice
SetupDiGetClassImageListExA
SetupDiGetSelectedDriverA
SetupDefaultQueueCallbackW
pSetupFree
CM_Get_Child_Ex
CM_Add_Empty_Log_Conf
SetupDiClassNameFromGuidExA
SetupOpenFileQueue
SetupGetInfFileListA
CM_Enable_DevNode
CM_Get_Resource_Conflict_DetailsW
SetupQuerySourceListW
pSetupGetCurrentDriverSigningPolicy
SetupDiGetClassDescriptionA
IsUserAdmin
SetupDiOpenClassRegKey
CM_Get_Device_Interface_List_SizeW
pSetupSetGlobalFlags
pSetupGetFileTitle
CM_Open_Class_KeyA
SetupPromptReboot
SetupDiDeleteDevRegKey
SetupRemoveSectionFromDiskSpaceListW
CM_Get_Res_Des_Data_Ex
pSetupCaptureAndConvertAnsiArg
CM_Get_Parent

kernel32

ContinueDebugEvent
HeapDestroy
CreateJobSet
IsBadWritePtr
CreatePipe
GetTapePosition
IsDebuggerPresent
SetLocalPrimaryComputerNameW
VirtualAlloc
ExitProcess
ReleaseMutex
FindNextVolumeW
DeleteCriticalSection
WaitForMultipleObjectsEx
lstrcatW
WriteConsoleA
GetStringTypeA
CreateActCtxA
Process32NextW
BeginUpdateResourceW
EnterCriticalSection
HeapSummary
LoadLibraryA
SetFirmwareEnvironmentVariableW
OpenWaitableTimerA
GetExpandedNameW
SetConsoleFont
LeaveCriticalSection
SetCommTimeouts
SetConsoleTextAttribute
GlobalAddAtomA
GetProfileSectionA
GetModuleHandleW
Module32First
SetThreadAffinityMask
WriteConsoleOutputA

cmpbk32

PhoneBookFreeFilter
PhoneBookLoad
PhoneBookGetRegionNameA
PhoneBookGetCountryNameW
PhoneBookEnumNumbers
PhoneBookGetCurrentCountryId
PhoneBookEnumNumbersWithRegionsZero
PhoneBookGetPhoneDUNA
PhoneBookEnumCountries
PhoneBookGetPhoneCanonicalA
PhoneBookGetCountryId
PhoneBookGetPhoneType
PhoneBookUnload
PhoneBookParseInfoA
PhoneBookGetPhoneDescA
PhoneBookEnumRegions
PhoneBookCopyFilter
PhoneBookMatchFilter
PhoneBookGetPhoneNonCanonicalA
PhoneBookMergeChanges
PhoneBookGetCountryNameA
PhoneBookGetPhoneDispA
PhoneBookHasPhoneType

ntdll

RtlPopFrame
LdrUnloadDll
iswspace
NtSetDefaultUILanguage
DbgUiContinue
NtQueryVolumeInformationFile
RtlDestroyQueryDebugBuffer
KiUserCallbackDispatcher
wcsspn
ZwWaitLowEventPair
RtlTimeFieldsToTime
NtVdmControl
ZwSetUuidSeed
NtSetTimerResolution
RtlInitializeResource
NtCancelIoFile
ZwDebugContinue
RtlResetRtlTranslations
DbgUiGetThreadDebugObject
isalpha
ZwQueryInformationProcess
ZwQuerySystemEnvironmentValue
RtlIsActivationContextActive
_ui64tow
NtCreateProfile
RtlGetCallersAddress
RtlEqualPrefixSid
ZwIsSystemResumeAutomatic
RtlGetProcessHeaps
NtTerminateJobObject
NtOpenObjectAuditAlarm
ZwCreatePort
RtlGUIDFromString
DbgUiStopDebugging
ZwDeleteFile

advapi32

ConvertSDToStringSDRootDomainA
InstallApplication
RegOpenKeyExA
InitiateSystemShutdownExA
IsTokenUntrusted
RegSetValueA
EqualDomainSid
CryptEnumProvidersW
SystemFunction017
AdjustTokenGroups
OpenBackupEventLogW
IdentifyCodeAuthzLevelW
AddAccessAllowedAceEx
ObjectPrivilegeAuditAlarmW
RegOpenUserClassesRoot
AccessCheck
SaferComputeTokenFromLevel
MD5Update
SystemFunction025
DeleteAce
RegOpenKeyA
CryptDeriveKey
RegEnumKeyW
RegQueryValueExW
InitiateSystemShutdownA
CredIsMarshaledCredentialW
FreeInheritedFromArray
ConvertSecurityDescriptorToStringSecurityDescriptorA
LsaOpenPolicy

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5ee33d00812475ea266080d4c15664af

Headers

DLL Characteristics

File Characteristics

Imports

msls31

opengl32

wininet

setupapi

kernel32

cmpbk32

ntdll

advapi32

Sections

.text Size: 22KB - Virtual size: 22KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 10KB - Virtual size: 32KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 880B

.text
Size: 22KB - Virtual size: 22KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 10KB - Virtual size: 32KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 880B