283bd4da7f74d96bba28eaf8b69312fc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

283bd4da7f74d96bba28eaf8b69312fc_JaffaCakes118
Size

179KB
MD5

283bd4da7f74d96bba28eaf8b69312fc
SHA1

cd71e41d71eec3aae2c56ff8f76e094111b8e9bd
SHA256

c71049aa6178428e5ae3fcf04bf3f06123fe8f0b54b6f7c6598db6081b4b1be4
SHA512

1a9a21d8f78ba66c90a865b7038f835969806039f9ee36238ef6841f953f4037ae7d2d73dc70921f9f15bcf7911f9e00e5f4be89b18645d8b07d33fd4b7aa4cf
SSDEEP

3072:vpBnzXiSQvj5Ib4NhhMjgVoyIe1lSTcNmfwbtDSogsFRShZAQ1ZyyNme+qnm/H:3yR9LNMAee1lLB2VgSAkZ+vUmf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
283bd4da7f74d96bba28eaf8b69312fc_JaffaCakes118

Files

283bd4da7f74d96bba28eaf8b69312fc_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c642e0cca71ae765101b375714b7a770

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

LookupAccountSidW
QueryServiceConfigW
GetAce
LookupPrivilegeValueA
GetSecurityDescriptorControl
LockServiceDatabase
RegGetKeySecurity
RegQueryValueExW
SetNamedSecurityInfoW
IsValidSecurityDescriptor
RegRestoreKeyW
RegEnumKeyExW
SetEntriesInAclA
OpenProcessToken
EnumDependentServicesW
LookupPrivilegeDisplayNameA
RegSaveKeyW
OpenServiceW
DeleteService
AllocateAndInitializeSid
ControlService
SetSecurityInfo
GetSecurityInfo
OpenSCManagerW
StartServiceA
AddAce
RegDeleteValueW
RegCloseKey
FreeInheritedFromArray
UnlockServiceDatabase
GetTokenInformation
IsValidAcl
ChangeServiceConfigW
LookupPrivilegeNameA
RegOpenKeyExW
GetInheritanceSourceW
GetAclInformation
ChangeServiceConfig2W
GetNamedSecurityInfoW
QueryServiceStatus
SetEntriesInAclW
RegCreateKeyExW
InitializeAcl
CloseServiceHandle
FreeSid
QueryServiceLockStatusW
AdjustTokenPrivileges
RegSetValueExW
RegDeleteKeyW
EqualSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
CreateServiceW
RegEnumValueW

iphlpapi

GetIpAddrTable

shell32

SHGetFolderPathW

kernel32

LoadLibraryExW
GetCalendarInfoW
GetOEMCP
UnmapViewOfFile
CreateProcessW
GetLocaleInfoA
LocalAlloc
CreateEventA
SetLastError
LCMapStringW
SetUnhandledExceptionFilter
RtlUnwind
LocalFree
GetStringTypeW
DeviceIoControl
GetEnvironmentStringsW
UnhandledExceptionFilter
FlushFileBuffers
GetDateFormatA
GetTimeZoneInformation
FreeLibrary
GetStartupInfoA
ReadFile
GetModuleHandleW
HeapAlloc
GetCommandLineA
WriteConsoleW
GetLastError
InterlockedDecrement
TlsFree
GetCurrentProcessId
MultiByteToWideChar
CopyFileW
TlsAlloc
GetFileAttributesW
WriteConsoleA
HeapDestroy
GetProcAddress
GetTempPathW
GetModuleFileNameA
CreateFileA
TlsGetValue
MapViewOfFile
WideCharToMultiByte
HeapSize
WriteFile
GetConsoleCP
GetCPInfo
GetExitCodeProcess
FreeEnvironmentStringsW
GetTimeFormatA
GetConsoleOutputCP
CreateFileMappingA
SetWaitableTimer
SetEndOfFile
SetFileAttributesW
LeaveCriticalSection
GetSystemDirectoryW
DeleteFileW
EnumResourceNamesA
GetFileType
IsValidCodePage
ExpandEnvironmentStringsW
CloseHandle
ResetEvent
IsDebuggerPresent
SetEnvironmentVariableA
FileTimeToSystemTime
SetStdHandle
ExitProcess
GetTickCount
GetEnvironmentVariableW
CreateWaitableTimerA
RaiseException
TlsSetValue
TerminateProcess
InitializeCriticalSection
InterlockedIncrement
SetFilePointer
GetSystemTime
GetConsoleMode
EnterCriticalSection
LCMapStringA
CreateThread
Sleep
GetVersionExW
HeapReAlloc
DeleteCriticalSection
VirtualFree
CompareStringA
GetProcessHeap
GetCurrentProcess
CancelWaitableTimer
SetEvent
CreateDirectoryW
MoveFileExW
GetSystemTimeAsFileTime
InitializeCriticalSection
CompareStringW
VirtualAlloc
GetModuleHandleA
FileTimeToLocalFileTime
HeapCreate
SetHandleCount
SystemTimeToFileTime
GetVersionExA
HeapFree
QueryPerformanceCounter
GetACP
WaitForSingleObject
GetCurrentThreadId
GetEnvironmentStrings
LoadLibraryA
CreateFileW
FreeEnvironmentStringsA
GetStdHandle
GetStringTypeA

newdev

UpdateDriverForPlugAndPlayDevicesW

mprapi

MprConfigServerConnect
MprConfigServerDisconnect
MprConfigGetFriendlyName

user32

DestroyWindow
CreateWindowExW
SendMessageA
IsWindow
EnumChildWindows
GetDlgItem
GetWindowThreadProcessId

setupapi

SetupDiCreateDeviceInfoList
SetupDiSetClassInstallParamsW
SetupGetLineTextA
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceRegistryPropertyA
SetupDiCreateDeviceInfoA
CMP_WaitNoPendingInstallEvents
SetupOpenInfFileA
SetupDiGetClassDescriptionW
SetupDiDeleteDeviceInfo
SetupCloseInfFile
SetupDiCallClassInstaller
SetupDiGetDeviceInstanceIdW
SetupDiEnumDeviceInfo
SetupDiBuildClassInfoList
SetupDiClassNameFromGuidW
SetupDiDestroyDeviceInfoList
SetupCopyOEMInfW
SetupDiGetClassDevsW
SetupDiGetDeviceInstallParamsA
SetupDiSetDeviceRegistryPropertyW
SetupDiGetClassDevsA
SetupDiClassGuidsFromNameW
SetupGetInfFileListA
CM_Get_DevNode_Status

rpcrt4

UuidCreate

ole32

CoGetMalloc
CoSetProxyBlanket
CoCreateInstance
CoTaskMemFree
CoInitializeEx
CoUninitialize
CoInitializeSecurity
CoQueryProxyBlanket
StringFromGUID2

Sections

.text
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 380KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c642e0cca71ae765101b375714b7a770

Headers

File Characteristics

Imports

advapi32

iphlpapi

shell32

kernel32

newdev

mprapi

user32

setupapi

rpcrt4

ole32

Sections

.text Size: 95KB - Virtual size: 95KB

.rdata Size: 6KB - Virtual size: 6KB

.bss Size: 75KB - Virtual size: 74KB

.rsrc Size: 1024B - Virtual size: 380KB

.text
Size: 95KB - Virtual size: 95KB

.rdata
Size: 6KB - Virtual size: 6KB

.bss
Size: 75KB - Virtual size: 74KB

.rsrc
Size: 1024B - Virtual size: 380KB