3819fb6a964814b2af3d11870a7aa5f4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3819fb6a964814b2af3d11870a7aa5f4_JaffaCakes118
Size

258KB
MD5

3819fb6a964814b2af3d11870a7aa5f4
SHA1

9fd327c355346219b30a698ce3078e67a6863c33
SHA256

9d0ec31231caf367230e1f56a92f63943b74ea477736f201e094f3123581a189
SHA512

2199ec4e30be6d8aa1c61c03e18905a23a8a9c659f925e401e8fd928fd903a79424f576f9dd31c6d98067c2d1fc2e604d9a8d21b1722852428182ded849b3e6c
SSDEEP

6144:vYoXuTiIwdc0KnohAad0G9t5GnuI1OyE5Ne/qPZAw:Vu2IUwOA2I1OJcav

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3819fb6a964814b2af3d11870a7aa5f4_JaffaCakes118

Files

3819fb6a964814b2af3d11870a7aa5f4_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a6cef1827545673035a388548437ddcc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

mqtgsvc.pdb

Imports

msvcrt

malloc
free
printf
_getche
__CxxFrameHandler
localtime
_vsnwprintf
wcschr
towupper
_wcsnicmp
wcscmp
wcscspn
iswspace
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__winitenv
exit
_cexit
_XcptFilter
_exit
_c_exit
_wcsicmp
wcscat
wcsstr
_except_handler3
??0exception@@QAE@XZ
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_CxxThrowException
_beginthreadex
_purecall
??0exception@@QAE@ABV0@@Z
_endthreadex
swprintf
_wtoi64
_controlfp
wcscpy
wcslen
_ui64tow
wcstok

msvcp60

??0bad_alloc@std@@QAE@PBD@Z
??1bad_alloc@std@@UAE@XZ
??0bad_alloc@std@@QAE@ABV01@@Z
?move@?$char_traits@G@std@@SAPAGPAGPBGI@Z
?length@?$char_traits@G@std@@SAIPBG@Z
?_Xlen@std@@YAXXZ
?copy@?$char_traits@G@std@@SAPAGPAGPBGI@Z
?_Xran@std@@YAXXZ
?compare@?$char_traits@G@std@@SAHPBG0I@Z
?assign@?$char_traits@G@std@@SAXAAGABG@Z
?find@?$char_traits@G@std@@SAPBGPBGIABG@Z

atl

ord30

advapi32

RegOpenKeyExW
RegQueryValueExW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegCreateKeyExW
RegSetValueExW
RegCloseKey
TraceMessage
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
ReportEventW
InitializeSecurityDescriptor
InitializeAcl
SetSecurityDescriptorDacl
MakeSelfRelativeSD
IsValidSid
GetLengthSid
LookupAccountNameW
OpenProcessToken
GetTokenInformation
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
AddAccessDeniedAce
AddAccessAllowedAce
SetServiceStatus
RegisterEventSourceW

kernel32

GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetSystemDirectoryW
WideCharToMultiByte
LocalFree
ExpandEnvironmentStringsW
ExitProcess
CreateThread
GetSystemInfo
InterlockedCompareExchange
CreateSemaphoreW
ReleaseSemaphore
GetLocalTime
GetComputerNameW
InterlockedIncrement
InterlockedDecrement
CancelIo
CloseHandle
GetLastError
CreateIoCompletionPort
ResumeThread
WaitForSingleObject
SetEvent
CreateEventW
LeaveCriticalSection
GetTickCount
EnterCriticalSection
SetThreadPriority
InitializeCriticalSection
DeleteCriticalSection
Sleep
PostQueuedCompletionStatus
ResetEvent
GetQueuedCompletionStatus

rpcrt4

RpcStringFreeW
UuidToStringW

user32

CharLowerW
CharUpperW
wsprintfW

oleaut32

SystemTimeToVariantTime
VariantChangeType
SysStringByteLen
SysAllocStringByteLen
SysStringLen
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
VariantClear
VariantCopy
VariantInit
SysAllocString
SysFreeString
GetErrorInfo

ole32

CLSIDFromString
CLSIDFromProgID
CoCreateInstance
CoInitializeEx
CoUninitialize
OleRun

mqrt

MQReceiveMessageByLookupId
MQOpenQueue
MQPathNameToFormatName
MQReceiveMessage
MQCloseQueue
MQCloseCursor
MQCreateCursor
MQCreateQueue

Sections

.text
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PACK
Size: 144KB - Virtual size: 380KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a6cef1827545673035a388548437ddcc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

msvcp60

atl

advapi32

kernel32

rpcrt4

user32

oleaut32

ole32

mqrt

Sections

.text Size: 109KB - Virtual size: 109KB

.data Size: 2KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

PACK Size: 144KB - Virtual size: 380KB

.text
Size: 109KB - Virtual size: 109KB

.data
Size: 2KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

PACK
Size: 144KB - Virtual size: 380KB