2b3edd3dd070599b3db4ba2690d3ea68_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2b3edd3dd070599b3db4ba2690d3ea68_JaffaCakes118
Size

300KB
MD5

2b3edd3dd070599b3db4ba2690d3ea68
SHA1

7e491ef5cbd325fd52dd6592648034a5746f27a8
SHA256

1046e0b718a3e0f96b7daa258d37e92abe042a661e901e29a0a906551cc746c4
SHA512

829c72143771afb242593b5ddebce36121a433a49f224b98398a30591df5860c098f4fdd944e9181dc8034e0695970ca5fbd42548f0861f04bda613463c386eb
SSDEEP

6144:iZ5yZCwIxtn9jcSiUqlENL4+M+3Mkw3T47qMK799WrMurIMYp:iXjed+M0MkwvRRcAurgp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b3edd3dd070599b3db4ba2690d3ea68_JaffaCakes118

Files

2b3edd3dd070599b3db4ba2690d3ea68_JaffaCakes118
.exe windows:5 windows x86 arch:x86

19ddc8579400979fed7d0bf8488192aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtCreateEvent
RtlDestroyHeap
NtDuplicateObject
RtlAppendUnicodeToString
NtQueryAttributesFile
RtlSetSaclSecurityDescriptor
RtlAddAccessAllowedAce
RtlInsertElementGenericTable
wcscat
RtlSystemTimeToLocalTime
RtlExtendedLargeIntegerDivide
RtlAllocateAndInitializeSid
wcsstr
RtlCompareMemory
RtlGetDaclSecurityDescriptor
RtlDosPathNameToNtPathName_U
qsort
RtlAllocateHeap
NtQueryKey
RtlInitializeCriticalSectionAndSpinCount
NtUnmapViewOfSection
RtlCreateSecurityDescriptor
NtQuerySecurityObject
NtSetValueKey
RtlQueryRegistryValues
wcscmp
RtlFreeAnsiString
RtlFormatCurrentUserKeyPath
RtlFreeSid
NtQueryObject
RtlIntegerToUnicodeString

rpcrt4

RpcBindingFromStringBindingW
UuidToStringW
RpcBindingSetAuthInfoW
RpcBindingFree
CStdStubBuffer_CountRefs
NdrOleAllocate
CStdStubBuffer_Connect
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
NdrCStdStubBuffer_Release
CStdStubBuffer_DebugServerQueryInterface
NdrDllGetClassObject
RpcRaiseException
NdrOleFree
RpcBindingToStringBindingW
RpcServerUnregisterIf
NdrCStdStubBuffer2_Release
IUnknown_AddRef_Proxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_AddRef
RpcServerInqBindings
NdrClientCall2
CStdStubBuffer_Invoke
UuidCreate
NdrStubForwardingFunction
RpcServerUseProtseqEpW
RpcStringFreeA
RpcStringFreeW
RpcServerRegisterIfEx
NdrDllUnregisterProxy
RpcBindingSetAuthInfoExW

user32

PeekMessageW
GetActiveWindow
LoadIconA
GetDlgItem
IsRectEmpty
SendMessageW
RegisterClassA
SetDlgItemTextW
SetRect
GetWindowDC
GetAncestor
GetSystemMenu
GetParent
KillTimer
DestroyIcon
IsIconic
wsprintfW
wsprintfA
MoveWindow
GetWindowRect
UpdateWindow
DrawTextA
DrawFocusRect
GetFocus
IsWindowEnabled
GetMessagePos
RegisterClipboardFormatW
LoadImageW
GetDC

kernel32

InitializeCriticalSection
lstrcmpiW
MapViewOfFile
GetCurrentThreadId
OpenMutexA
lstrcpynA
lstrcatA
GetCurrentDirectoryW
TerminateProcess
GetLocaleInfoW
GetVersion
SetStdHandle
DeleteFileW
GetCurrentProcessId
GetStringTypeA
VirtualAlloc
MultiByteToWideChar
FreeLibrary
WriteConsoleW
DeleteFileA
GetCommandLineW
GetDriveTypeW
GetFileSize
GetModuleFileNameW
EnterCriticalSection
IsBadWritePtr
ExpandEnvironmentStringsW
HeapSize
CreateFileA
GetConsoleMode
ReleaseSemaphore
FormatMessageA
GetEnvironmentStringsW
GetExitCodeThread
SetFileAttributesW
GetTickCount
ExitProcess
GetProcessHeap
GetUserDefaultLCID
FreeEnvironmentStringsA
HeapDestroy
GetCurrentProcess
Sleep
GetExitCodeProcess

shlwapi

StrCmpNIA
PathRemoveFileSpecA
SHDeleteValueA
SHRegGetBoolUSValueW
PathFindFileNameW
StrToIntW
PathIsURLW
PathIsRootW
StrCpyNW
SHStrDupW
PathRemoveExtensionW
PathAppendA
PathRemoveBackslashW
UrlIsW
PathFindExtensionW
PathFileExistsW
StrDupW
StrCmpNW
SHDeleteKeyA
PathFindFileNameA
PathIsRelativeW
wnsprintfW
StrCmpW

version

GetFileVersionInfoA
GetFileVersionInfoW
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA
VerQueryValueW

advapi32

RegEnumValueW
IsValidSecurityDescriptor
LookupPrivilegeValueA
LockServiceDatabase
GetSecurityDescriptorLength
CryptGenRandom
DuplicateTokenEx
SetSecurityDescriptorGroup
RegQueryValueExW
AdjustTokenPrivileges
CryptDestroyKey
RegSetValueExA
GetSidLengthRequired
CopySid
RevertToSelf
DeregisterEventSource
RegCreateKeyW
SetFileSecurityW
UnlockServiceDatabase
CryptAcquireContextW
GetSecurityDescriptorOwner
GetLengthSid
CryptDestroyHash
GetUserNameA
QueryServiceStatus
RegSetValueExW
CryptCreateHash
GetTraceEnableLevel
QueryServiceConfigW
ImpersonateLoggedOnUser
CryptGetHashParam
CryptHashData
ControlService
RegQueryValueW
CheckTokenMembership
AllocateAndInitializeSid
ConvertSidToStringSidW

shell32

SHBrowseForFolderA
SHBrowseForFolderW
SHGetSpecialFolderPathW
ShellExecuteW
ShellExecuteExW
SHGetMalloc
SHGetPathFromIDListW
SHGetDesktopFolder
SHFileOperationW
SHBindToParent
DragQueryFileA
SHGetPathFromIDListA
DragQueryFileW
ShellExecuteA
SHChangeNotify
SHGetFolderPathW
CommandLineToArgvW
SHGetFileInfoW

Sections

.code
Size: 277KB - Virtual size: 276KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT_DATA
Size: 1KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

19ddc8579400979fed7d0bf8488192aa

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

rpcrt4

user32

kernel32

shlwapi

version

advapi32

shell32

Sections

.code Size: 277KB - Virtual size: 276KB

.edata Size: 1KB - Virtual size: 1KB

RT_DATA Size: 1KB - Virtual size: 203KB

.rsrc Size: 19KB - Virtual size: 19KB

.code
Size: 277KB - Virtual size: 276KB

.edata
Size: 1KB - Virtual size: 1KB

RT_DATA
Size: 1KB - Virtual size: 203KB

.rsrc
Size: 19KB - Virtual size: 19KB