2c9950b4f98dda0db5ee85779101442d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2c9950b4f98dda0db5ee85779101442d_JaffaCakes118
Size

512KB
MD5

2c9950b4f98dda0db5ee85779101442d
SHA1

4a5aabc7a4b4d6ebba537d2021ec7446910a3084
SHA256

87cd01e365c6480f49796d7f0e78bc84727223c109987ff2f03d0365fc9a8e67
SHA512

99f611f2914d8e39a7e8aac40e350381be647476e40d1dde5354be6444f706b829ffb9703ecceb5cf45a51fa0d7e3a0a2bfa579476bfa67e4d0e7bef3d60fb4a
SSDEEP

6144:nanaW11AnZyxG5WODEZpj7D5lS7qsqe9Sz//4fWZF3H9dQZYLj5y7Wf7xLUnw+H/:5W1CJDeS7qsqegnF3d5Lj5qIg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2c9950b4f98dda0db5ee85779101442d_JaffaCakes118

Files

2c9950b4f98dda0db5ee85779101442d_JaffaCakes118
.exe windows:6 windows x86 arch:x86

00343febca3cd9fbf348f00addb3a138

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

helppane.pdb

Imports

advapi32

GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
TraceEvent
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
UnregisterTraceGuids
RegEnumKeyExW
GetSidSubAuthority
IsValidSid
GetTokenInformation
InitializeSid
GetSidLengthRequired
CopySid
GetLengthSid
OpenProcessToken
OpenThreadToken
EqualSid
RegCreateKeyW
RegOpenKeyW
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid

kernel32

TerminateThread
GetExitCodeThread
GetSystemInfo
CreateMutexW
lstrcmpiW
ReleaseMutex
SetCurrentDirectoryW
GetSystemDirectoryW
RegisterApplicationRestart
HeapSetInformation
LoadLibraryExW
CompareStringW
ResetEvent
LocalFree
FormatMessageW
MulDiv
WaitForMultipleObjects
ResumeThread
CreateThread
Sleep
LocalAlloc
OpenProcess
GetUserDefaultUILanguage
DelayLoadFailureHook
LoadLibraryExA
ProcessIdToSessionId
ExpandEnvironmentStringsW
GetSystemWindowsDirectoryW
GetFileMUIPath
GetBinaryTypeW
SetEvent
GetQueuedCompletionStatus
InterlockedExchange
WaitForSingleObject
PostQueuedCompletionStatus
CreateEventW
CreateIoCompletionPort
GetCurrentThread
CloseHandle
GetLastError
FindResourceExW
SizeofResource
InterlockedCompareExchange
SetLastError
GetCurrentThreadId
GetCurrentProcess
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
RaiseException
InterlockedIncrement
OpenEventW
GetUserDefaultLCID
GetSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
InitializeCriticalSectionAndSpinCount
RegQueryValueExA
RegSetValueExA
GetNativeSystemInfo
RegQueryValueExW
FindResourceA
OutputDebugStringA
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
VirtualAlloc
VirtualFree
LoadLibraryA
lstrlenA
WideCharToMultiByte
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
GetCurrentProcessId
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSection
lstrlenW
LoadLibraryW
FreeLibrary
FindResourceW
LoadResource
FlushInstructionCache
GetProcAddress
GetModuleHandleW
GetVersionExW
InterlockedDecrement
LockResource

gdi32

CreateDIBSection
CreateFontIndirectW
GetDeviceCaps
CreateCompatibleDC
DeleteDC
GetStockObject
DeleteObject
GetObjectW
SelectObject
GetTextExtentPoint32W
SetBkMode
SetTextColor
GetTextMetricsW

user32

SetWindowPos
GetClientRect
IsWindowVisible
IsWindowEnabled
AdjustWindowRectEx
ReleaseDC
GetDC
SetFocus
DefWindowProcW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
ClientToScreen
GetParent
TrackPopupMenuEx
CheckMenuRadioItem
GetSubMenu
LoadMenuW
CharLowerBuffW
SetWindowTextW
SetTimer
KillTimer
DestroyWindow
GetWindowThreadProcessId
GetClassNameW
MoveWindow
GetKeyState
DestroyMenu
EnumChildWindows
EnableMenuItem
GetMenu
SendMessageW
GetWindowLongW
SetWindowLongW
CallWindowProcW
UnregisterClassA
InvalidateRect
LoadStringW
PostMessageW
IsWindow
CharNextW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
BringWindowToTop
CheckDlgButton
IsDlgButtonChecked
EnableWindow
GetDlgItem
GetShellWindow
DeleteMenu
ShowWindow
GetSystemMetrics
GetSysColor
SetActiveWindow
SystemParametersInfoW
DestroyIcon
PostQuitMessage
LockWindowUpdate
GetWindowPlacement
GetWindowRect
IsZoomed
IsIconic
MonitorFromRect
MonitorFromPoint
GetMonitorInfoW
GetProcessDefaultLayout
LoadCursorW
SetCursor
GetFocus
GetSysColorBrush
TrackMouseEvent

msvcrt

malloc
free
wcscpy_s
wcscat_s
_ftol2_sse
_resetstkoflw
_purecall
memcpy_s
memmove_s
__RTDynamicCast
_wcsnicmp
_wcsicmp
memset
_itow
_wtoi
_beginthreadex
wcsncat_s
_wsplitpath_s
iswspace
wcsncpy_s
??0exception@@QAE@ABQBD@Z
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
wcsstr
swprintf_s
exit
wcschr
_ftol2
_ltow
_itoa
calloc
_controlfp
_onexit
_lock
__dllonexit
_unlock
_errno
realloc
_except_handler4_common
?terminate@@YAXXZ
??1type_info@@UAE@XZ
__set_app_type
_CxxThrowException
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
_XcptFilter
_exit
_cexit
_ultow_s
wcsrchr
iswdigit
_vscwprintf
vswprintf_s
_strlwr_s
_ultoa_s
wcsnlen
strncmp
_msize
wcsncmp
_itoa_s
_i64toa_s
_ui64toa_s
_gcvt_s
_get_errno
_set_errno
_fpclass
_wcstoi64
_wcstoui64
_HUGE
wcstod
swscanf
_vsnwprintf
wcspbrk
memcpy
_wcslwr
memmove
__wgetmainargs
__p__fmode
__CxxFrameHandler3
_callnewh
??1exception@@UAE@XZ

comctl32

ImageList_LoadImageW
PropertySheetW
ImageList_GetImageCount
ImageList_Create
ImageList_GetIconSize
ImageList_Draw
ImageList_Add
ImageList_Destroy
ord380
InitCommonControlsEx
ord344
ord345

ole32

StringFromCLSID
CoGetClassObject
CreateStreamOnHGlobal
PropVariantClear
OleGetClipboard
CoImpersonateClient
CoRevertToSelf
OleInitialize
CoInitializeSecurity
CoResumeClassObjects
OleUninitialize
CoTaskMemFree
CoRegisterClassObject
CoRevokeClassObject
CoTaskMemRealloc
CoTaskMemAlloc
CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

SysStringLen
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysFreeString
VariantClear
DispCallFunc
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
SysAllocStringLen
SafeArrayGetUBound
SafeArrayUnlock
SafeArrayLock
VariantCopyInd
VariantCopy
SafeArrayDestroy
SafeArrayRedim
SafeArrayCreate
VarBstrCat
VarBstrCmp
SafeArrayGetLBound
GetErrorInfo
VariantInit

shell32

SHGetPropertyStoreForWindow
ShellExecuteW

shlwapi

ord12
UrlEscapeW
UrlUnescapeW
SHStrDupW

rpcrt4

RpcStringFreeA
UuidCreateNil
UuidFromStringA
UuidIsNil
UuidCreate
UuidToStringA

Sections

.text
Size: 359KB - Virtual size: 359KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pqtevqn
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

00343febca3cd9fbf348f00addb3a138

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

ole32

oleaut32

shell32

shlwapi

rpcrt4

Sections

.text Size: 359KB - Virtual size: 359KB

.data Size: 12KB - Virtual size: 11KB

.rsrc Size: 92KB - Virtual size: 91KB

.reloc Size: 48KB - Virtual size: 49KB

pqtevqn Size: - Virtual size: 4KB

.text
Size: 359KB - Virtual size: 359KB

.data
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 92KB - Virtual size: 91KB

.reloc
Size: 48KB - Virtual size: 49KB

pqtevqn
Size: - Virtual size: 4KB