3d9a3ae524812b349a3d86ccbfed0507_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3d9a3ae524812b349a3d86ccbfed0507_JaffaCakes118
Size

62KB
MD5

3d9a3ae524812b349a3d86ccbfed0507
SHA1

4e781fa8c1a256cc1a76ac236318a4e63c6d89b9
SHA256

977122ba30473ae4cb22273271460d273da3df0d27898bb9c4126dc977b2b93e
SHA512

d4037e33929b720d4ab4ec954ecd28b292c743cd1b33c36951f80a8058d7c767a9a6e5218614a6c71c62a489f473cf31ccb123be57da19ad683b0ee965d045a6
SSDEEP

1536:SKdUJT2snaNUBO7BnIZoMQuF3azgsL4hkwgNr+z8vWCe8n:S8qNnaKO7BnYoMQQ3azgsEhkwgdvre

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3d9a3ae524812b349a3d86ccbfed0507_JaffaCakes118

Files

3d9a3ae524812b349a3d86ccbfed0507_JaffaCakes118
.exe windows:6 windows x86 arch:x86

a4ef62bd2c2df3ac401c7010c2cfa347

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

rdrleakdiag.pdb

Imports

advapi32

TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
EventWrite
EnumServicesStatusExW
OpenSCManagerW
QueryServiceConfigW
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenServiceW

kernel32

IsWow64Process
ReadProcessMemory
UnmapViewOfFile
CloseHandle
CreateFileW
HeapFree
GetVersionExW
HeapAlloc
GetProcessHeap
GetLastError
GetModuleHandleW
K32GetModuleFileNameExW
MapViewOfFile
CreateFileMappingW
WaitForMultipleObjects
GetCurrentProcess
WaitForSingleObject
SetProcessShutdownParameters
SetConsoleCtrlHandler
GetProcessTimes
CreateDirectoryW
DeleteFileW
GetTempFileNameW
GetTempPathW
HeapSetInformation
LoadLibraryW
GetProcAddress
FreeLibrary
GetSystemTimeAsFileTime
SetFilePointer
GetProcessId
GetModuleFileNameW
LocalAlloc
LocalFree
SetLastError
OpenProcess
UnhandledExceptionFilter
TerminateProcess
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
Sleep
InterlockedExchange
WriteFile
GetCurrentProcessId
RemoveDirectoryW

user32

LoadStringW

msvcrt

_wtol
_wcsicmp
memcpy
memset
qsort
wcsrchr
__wgetmainargs
_cexit
_exit
_XcptFilter
_vsnwprintf
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
exit

ntdll

RtlReleaseSRWLockExclusive
NtSetEvent
RtlAcquireSRWLockExclusive
RtlAllocateHeap
NtClose
NtQueryInformationThread
NtWaitForSingleObject
EtwEventUnregister
EtwEventRegister
RtlNtStatusToDosError
NtCreateMutant
NtResetEvent
NtCreateEvent
RtlCreateProcessReflection
NtReleaseMutant
NtQueryInformationProcess
NtDuplicateObject
NtOpenProcess
NtCreateThreadEx
RtlInitUnicodeString
RtlEqualUnicodeString
RtlFreeHeap

wer

WerReportAddFile
WerReportSetParameter
WerReportCreate
WerReportSubmit
WerReportCloseHandle

shlwapi

ord348

dbghelp

MiniDumpWriteDump

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

mbasfva
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a4ef62bd2c2df3ac401c7010c2cfa347

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

ntdll

wer

shlwapi

dbghelp

version

Sections

.text Size: 26KB - Virtual size: 26KB

.data Size: 512B - Virtual size: 3KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 29KB - Virtual size: 30KB

mbasfva Size: - Virtual size: 4KB

.text
Size: 26KB - Virtual size: 26KB

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 29KB - Virtual size: 30KB

mbasfva
Size: - Virtual size: 4KB