345ff08529debaa3364d63892e1e333f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

345ff08529debaa3364d63892e1e333f_JaffaCakes118
Size

873KB
MD5

345ff08529debaa3364d63892e1e333f
SHA1

71b53bb26fc6510c6566de559da64d39d4ba5228
SHA256

f966db99686930967dd30c0d81a51f9d7d394800c43477ceed15f488d065001b
SHA512

ff24dd91a0764b31fe5fb38908ce96b3eae6221b0eb2afb4d4e4c392f27a1767ae063a5a768ec71e54fe5e17ea1da60eb45d40e21bc00e26a8104dce8a96af26
SSDEEP

24576:GV4LppatBizbmERNWzTHyKw/E5iEajcMXH66D:GV4tpoANCTHyKw/aajcM/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
345ff08529debaa3364d63892e1e333f_JaffaCakes118

Files

345ff08529debaa3364d63892e1e333f_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f111045efcc4a2f832fdf623c1b93f03

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

sqlunirl

_CreateAcceleratorTable_@8
_GetGlyphOutline_@28
_PostThreadMessage_@16
_RegDeleteValue_@8
_GetEnvironmentStrings_@4
_IsCharUpper_@4
_ObjectDeleteAuditAlarm_@12
_NDdeShareSetInfo_@24
_GetTempFileName_@16
_EnumResourceLanguages_@20
_RegisterClass_@4
_GlobalFindAtom_@4
_lstrcpyn_@12
_RegCreateKeyEx_@36
_PeekMessage@20
_OpenEvent_@12
_LoadMenu@8
_SendMessage@16
_RegReplaceKey_@16
_EnumWindowStations_@8
__lcreat_@8
_GetKeyboardLayoutName_@4
_MessageBox@16
_CreateWindowStation_@16
_PrintDlg_@4
_BuildCommDCB_@8
_ResetDC_@8
_GetProfileSection_@12
_RegSetValueEx_@24
_GetFileVersionInfoSize_@8
wsprintf_
_OpenWindowStation_@12

ntdll

RtlGetLongestNtPathLength
NtSetInformationJobObject
RtlAbortRXact
RtlAddAce
ZwLoadKey
NtCompleteConnectPort
RtlIpv4AddressToStringA
ZwDeleteObjectAuditAlarm
RtlInt64ToUnicodeString
NtCancelTimer
ZwSecureConnectPort
RtlLengthRequiredSid
ZwDebugContinue
_ftol
NtResumeThread
ZwQuerySecurityObject
RtlFreeUnicodeString
RtlpWaitForCriticalSection
ZwFsControlFile
RtlFormatMessage
RtlDeleteElementGenericTable
strcspn
_vsnwprintf
KiUserCallbackDispatcher
_ltow
NtSetDebugFilterState
ZwGetPlugPlayEvent
NtReplyWaitReceivePortEx

user32

SetDlgItemInt
GetKeyboardLayout
MBToWCSEx
GetMessageTime
CreateSystemThreads
GetComboBoxInfo
SetWindowStationUser
DrawIconEx
InvalidateRgn
EnumWindowStationsA
DdeConnectList
QuerySendMessage
GetDlgItem
SetSysColorsTemp
UnregisterClassA
GetWindowModuleFileNameA
UnregisterHotKey
EnableWindow
MenuItemFromPoint
ShowWindow
GetRawInputDeviceInfoW
GetDesktopWindow
GetCaretBlinkTime
ReplyMessage
IsCharLowerA
CallWindowProcW
GetPropA
DialogBoxIndirectParamW
DlgDirListComboBoxW
GetMessageW
ShowOwnedPopups
GetMessageA
DdeQueryConvInfo
GetDlgItemTextW
CharLowerA
RegisterHotKey
ShowCaret
LoadRemoteFonts
DestroyMenu
SetCaretBlinkTime

kernel32

AddConsoleAliasW
SetCommState
EnumDateFormatsExA
GetCPInfoExW
CreateHardLinkA
VirtualAllocEx
ExpandEnvironmentStringsW
GetTapeStatus
GetModuleHandleA
LocalSize
SizeofResource
RemoveDirectoryW
FindNextFileA
GetLocalTime
GetConsoleAliasesLengthA
VirtualAlloc
EnumDateFormatsA
SetNamedPipeHandleState
lstrcmpiW
HeapDestroy
OpenWaitableTimerA
GetCurrentProcessId
FlushViewOfFile
SetFilePointerEx
SetWaitableTimer
SetVolumeLabelW
LocalLock
SetClientTimeZoneInformation
GetHandleContext
DeleteFileA
FindFirstVolumeW
IsBadHugeReadPtr
IsValidLocale
SetSystemTimeAdjustment
EnumResourceLanguagesW
CloseConsoleHandle
GetProcessId
SetConsoleCtrlHandler
IsValidCodePage
LoadLibraryA
GetPrivateProfileIntA
CreateFileMappingA
FindFirstVolumeMountPointW
GlobalUnWire
EnumSystemLocalesW
GetDriveTypeW

secur32

LsaFreeReturnBuffer
SecpTranslateNameEx
GetUserNameExW
LsaUnregisterPolicyChangeNotification
DeleteSecurityContext
SecpFreeMemory
AddSecurityPackageW
QueryCredentialsAttributesA
AddCredentialsA
DeleteSecurityPackageA
FreeCredentialsHandle
GetComputerObjectNameA
SetContextAttributesA
DeleteSecurityPackageW
SaslInitializeSecurityContextA
GetComputerObjectNameW
SaslIdentifyPackageA
InitializeSecurityContextA
SaslAcceptSecurityContext
SealMessage
ImportSecurityContextA
CredMarshalTargetInfo
InitSecurityInterfaceA
UnsealMessage
AcquireCredentialsHandleW
SaslGetProfilePackageW
MakeSignature
QuerySecurityPackageInfoA
EnumerateSecurityPackagesW
ApplyControlToken
TranslateNameA
QueryCredentialsAttributesW
LsaLookupAuthenticationPackage
VerifySignature
LsaConnectUntrusted
SaslEnumerateProfilesW

crtdll

?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
_mbsdec
_ultow
_heapmin
_mbctombb
_read
_creat
tan
_ismbbalpha
iswprint
_CIacos
__pxcptinfoptrs
_cwait
iscntrl
_mbsicmp
fscanf
wcslen
_strrev
time
_wcslwr
_getche
log10
_timezone_dll
_swab
strstr
free
_setmode
swscanf
strcpy
_iob
fclose
_ultoa
printf

Sections

.text
Size: 574KB - Virtual size: 574KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 289KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f111045efcc4a2f832fdf623c1b93f03

Headers

DLL Characteristics

File Characteristics

Imports

sqlunirl

ntdll

user32

kernel32

secur32

crtdll

Sections

.text Size: 574KB - Virtual size: 574KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 289KB - Virtual size: 1.7MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 574KB - Virtual size: 574KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 289KB - Virtual size: 1.7MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 1024B