3cec5845fc281be1c7bf6a03ca386846_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3cec5845fc281be1c7bf6a03ca386846_JaffaCakes118
Size

157KB
MD5

3cec5845fc281be1c7bf6a03ca386846
SHA1

9772836247c41f428f01a2403fb3cb469024c546
SHA256

4dc97d80d38c04133c709175f82a0bc19d377fef404f4e8d9673d45ba1eca662
SHA512

007a37dce7c74fdfd899880b4ea83e6830775cedcd0467191a55670b50a298b7f976ae986fe922673f0613cc8c31272998bac7fb1f9c92b11fc5029011e69e70
SSDEEP

3072:FM7OImdgCh9a7qCpELNw8wJ/ZOgjy2NLWCZYtTolIzwlGC/OrbJe6tNDuWd89:FMv7/xxOgACizzOcnjD5d89

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3cec5845fc281be1c7bf6a03ca386846_JaffaCakes118

Files

3cec5845fc281be1c7bf6a03ca386846_JaffaCakes118
.exe windows:4 windows x86 arch:x86

86c783d3d5064283b3ac775aa4f2cae0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\Projects\release_scout_curry3\Src\Common\Toolkit\NMDllHost\Release\NMDllHost.pdb

Imports

kernel32

GetCurrentThreadId
GetCommandLineW
MultiByteToWideChar
GetProcAddress
InterlockedDecrement
VirtualProtect
VirtualQuery
GetCurrentProcess
SetLastError
FindActCtxSectionGuid
InterlockedIncrement
CreateThread
FreeConsole
Sleep
SetEvent
CreateEventW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
WaitForSingleObject
LoadLibraryA
CloseHandle
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
IsBadReadPtr
GetEnvironmentVariableW
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
IsDebuggerPresent
InterlockedCompareExchange
LoadLibraryW
FreeLibrary
GetCurrentProcessId

user32

PostThreadMessageW
CharNextW
CharUpperW
MessageBoxW
GetMessageW
DispatchMessageW
TranslateMessage

advapi32

RegOpenKeyW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

shell32

SHGetSpecialFolderPathW

ole32

CoRegisterClassObject
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CLSIDFromString
StringFromGUID2
CoRegisterSurrogate
CoCreateInstance
CoSuspendClassObjects
CoResumeClassObjects
CoRevokeClassObject

oleaut32

VariantClear

msvcp80

?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W0@Z

msvcr80

??_V@YAXPAX@Z
memset
_wcsicmp
_stricmp
_wtoi
free
vswprintf_s
malloc
iswdigit
wcstol
wcsncmp
calloc
_wcslwr_s
_snwprintf_s
wcsncpy_s
_except_handler4_common
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_wcsnicmp
??2@YAPAXI@Z
_purecall
memcpy_s
memmove_s
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_invalid_parameter_noinfo
__CxxFrameHandler3
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
??3@YAXPAX@Z

dbghelp

ImageNtHeader
ImageDirectoryEntryToData

psapi

EnumProcessModules

Sections

.text
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.trdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

86c783d3d5064283b3ac775aa4f2cae0

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcp80

msvcr80

dbghelp

psapi

Sections

.text Size: 48KB - Virtual size: 45KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 952B

.trdata Size: 76KB - Virtual size: 76KB

.text
Size: 48KB - Virtual size: 45KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 952B

.trdata
Size: 76KB - Virtual size: 76KB