3ebb2b99698f98384d2e2c12cf8f0bcb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3ebb2b99698f98384d2e2c12cf8f0bcb_JaffaCakes118
Size

179KB
MD5

3ebb2b99698f98384d2e2c12cf8f0bcb
SHA1

12fa60f93802a5aaf915f32bfd08ab7142840347
SHA256

96c57de8cd20397186222d03640301936c082172a28a1f5bee7ce774f3cd90cd
SHA512

c23381f0da44d4fad24fcd31410b2fb72bf5d49f75fc872139ca6666a5bfc669bb13c5c192730dbf65e8088ffee7d8a8d442cc1533357c3238dbd46a9cd4f834
SSDEEP

3072:XUdUvPjZfdhsptVwwS32cOkLyoX0+V3S4qye4CEsWvnhn:XZjXWrxkLNE+6ypCEs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3ebb2b99698f98384d2e2c12cf8f0bcb_JaffaCakes118

Files

3ebb2b99698f98384d2e2c12cf8f0bcb_JaffaCakes118
.exe windows:5 windows x86 arch:x86

d59abe671348455506714f306b7ab49e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

__setusermatherr
atoi
wcscat
wcschr
_except_handler3
_snwprintf
_wcsicmp
wcsncat
wcstok
memmove
swprintf
_snprintf
wcsstr
wcspbrk
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__p__commode
_adjust_fdiv
wcsncmp
wcscpy
wcslen
_controlfp
__p__fmode
__set_app_type
wcscmp

advapi32

RegQueryInfoKeyW
AddAccessAllowedAce
RegEnumValueW
SetSecurityDescriptorDacl
EnumServicesStatusW
AllocateLocallyUniqueId
RegNotifyChangeKeyValue
SetKernelObjectSecurity
RegEnumKeyExW
RegQueryInfoKeyA
QueryServiceConfigW
AdjustTokenPrivileges
SynchronizeWindows31FilesAndWindowsNTRegistry
QueryWindows31FilesMigration
OpenProcessToken
LogonUserW
OpenThreadToken
LookupAccountSidW
CheckTokenMembership
RegCreateKeyExW
LsaGetUserName
CreateProcessAsUserW
RegQueryValueExA
RegDeleteValueW
FreeSid
InitializeSecurityDescriptor
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
CloseServiceHandle
ControlService
StartServiceW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
DeregisterEventSource
ReportEventW
GetTokenInformation
RegisterEventSourceW
GetUserNameW
RevertToSelf
ImpersonateLoggedOnUser
DuplicateToken
RegOpenKeyW

kernel32

SetTimerQueueTimer
FindClose
FindFirstFileW
Beep
CloseProfileUserMapping
ExitProcess
DelayLoadFailureHook
OpenProfileUserMapping
GetDriveTypeW
GetStartupInfoA
GetModuleHandleA
GlobalGetAtomNameW
SetNamedPipeHandleState
TransactNamedPipe
AssignProcessToJobObject
CreateJobObjectW
CreateIoCompletionPort
SetInformationJobObject
GetQueuedCompletionStatus
TerminateJobObject
VirtualQuery
PostQueuedCompletionStatus
VirtualFree
InitializeCriticalSection
CreateFileA
LocalFree
LocalAlloc
lstrcatW
lstrcpyW
GetCurrentThreadId
Sleep
FormatMessageW
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemTimeAsFileTime
ReleaseMutex
SetWaitableTimer
WaitForSingleObject
CloseHandle
UnregisterWaitEx
RegisterWaitForSingleObject
CreateWaitableTimerW
GetCurrentProcessId
CreateEventW
LoadLibraryW
CreateMutexW
GlobalFree
GlobalAlloc
lstrlenW
GetTimeFormatW
GetUserDefaultLCID
FileTimeToSystemTime
FileTimeToLocalFileTime
GetProfileIntW
lstrcmpiW
lstrcpynW
GetShortPathNameW
GetModuleHandleW
GetProfileStringW
ReleaseSemaphore
CreateSemaphoreW
GetCurrentThread
WaitForSingleObjectEx
CreateThread
SetEvent
LoadResource
FindResourceW
SetThreadExecutionState
DefineDosDeviceW
GetComputerNameW
SetEnvironmentVariableW
VirtualLock
GetCurrentProcess
MoveFileExW
SearchPathW
GetTickCount
LocalReAlloc
ExpandEnvironmentStringsW
TerminateThread
ResumeThread
SetLastError
GetExitCodeProcess
WriteProfileStringW
ExitThread
DeleteFileW
TerminateProcess
CreateProcessW
GetSystemDirectoryW
ReadFile
CreateFileW
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
SetThreadPriority
SetPriorityClass
OpenEventW
DebugBreak
WaitForMultipleObjectsEx
SleepEx
InterlockedExchange
RaiseException
LoadLibraryExW
lstrcmpW
LeaveCriticalSection
EnterCriticalSection
CompareStringW
UnregisterWait
GetPrivateProfileStringW
CreateRemoteThread
OpenProcess
SetErrorMode
SetUnhandledExceptionFilter
GetEnvironmentVariableW
LocalSize
VirtualAlloc
VirtualQueryEx

gdi32

RemoveFontResourceW
AddFontResourceW

user32

ExitWindowsEx
SetProcessWindowStation
PostMessageW
MoveWindow
ShowWindow
UpdateWindow
GetDlgItemTextW
CharNextW
CreateWindowExW
RegisterClassW
SetTimer
GetMessageTime
KillTimer
DefWindowProcW
RegisterHotKey
UnregisterHotKey
ReplyMessage
CreateDesktopW
SetUserObjectSecurity
DispatchMessageW
GetMessageW
GetAsyncKeyState
SetUserObjectInformationW
PostThreadMessageW
SetWindowPlacement
DeleteMenu
GetSystemMenu
GetWindowPlacement
EnumWindows
GetWindowTextW
SetWindowsHookW
UnhookWindowsHook
CallNextHookEx
MessageBoxW
CreateWindowStationW
SendDlgItemMessageW
SetCursor
LoadCursorW
SetFocus
CheckDlgButton
IsDlgButtonChecked
CloseWindowStation
CreateDialogParamW
OpenDesktopW
SwitchDesktop
SetForegroundWindow
GetParent
GetKeyState
LoadImageW
SetLastErrorEx
wvsprintfW
TranslateMessage
RegisterWindowMessageW
MsgWaitForMultipleObjects
PostQuitMessage
SendNotifyMessageW
FindWindowW
DestroyWindow
SystemParametersInfoW
SendMessageTimeoutW
GetThreadDesktop
OpenInputDesktop
SetThreadDesktop
GetDesktopWindow
FindWindowExW
DialogBoxParamW
CloseDesktop
GetWindowLongW
UpdatePerUserSystemParameters
SetWindowStationUser
LockWindowStation
UnlockWindowStation
SetLogonNotifyWindow
LoadLocalFonts
RegisterLogonProcess
MBToWCSEx
EnableWindow
GetWindowRect
GetSystemMetrics
SetWindowPos
EndDialog
wsprintfW
SetWindowLongW
SendMessageW
SetDlgItemTextW
SetWindowTextW
LoadStringW
GetDlgItem
PeekMessageW
DialogBoxIndirectParamW
GetUserObjectInformationW

rpcrt4

RpcImpersonateClient
RpcServerListen
RpcServerUseProtseqEpW
RpcServerRegisterIf
I_RpcMapWin32Status
NdrServerCall2
RpcRevertToSelf

ntdll

NtSetInformationProcess
RtlCreateSecurityDescriptor
RtlAddAce
RtlCreateAcl
RtlGetDaclSecurityDescriptor
RtlCopySid
RtlLengthSid
NtOpenThreadToken
NtSetInformationThread
NtDuplicateToken
NtDuplicateObject
RtlEqualSid
NtQueryInformationToken
NtAllocateLocallyUniqueId
RtlSetDaclSecurityDescriptor
NtOpenDirectoryObject
NtQuerySystemInformation
NtCreateEvent
RtlFreeHeap
NtCreatePagingFile
RtlDosPathNameToNtPathName_U
RtlRegisterWait
NtPrivilegeObjectAuditAlarm
NtOpenProcessToken
NtQuerySystemTime
RtlTimeToSecondsSince1980
NtPrivilegeCheck
DbgPrint
RtlNtStatusToDosError
RtlSubAuthoritySid
NtInitiatePowerAction
NtQueryInformationJobObject
NtFilterToken
NtOpenEvent
NtSetValueKey
RtlOemStringToUnicodeString
RtlInitAnsiString
NtReadFile
NtClose
RtlGetAce
RtlAddAccessAllowedAce
RtlFreeSid
NtCreateKey
NtOpenKey
RtlAppendUnicodeToString
RtlCopyUnicodeString
RtlDestroyHeap
RtlCreateHeap
NtQueryValueKey
RtlUpcaseUnicodeChar
RtlAppendUnicodeStringToString
RtlExpandEnvironmentStrings_U
NtQueryInformationFile
RtlQueryInformationAcl
NtQuerySecurityObject
RtlCompareUnicodeString
RtlLengthRequiredSid
RtlInitializeSid
NtOpenSymbolicLinkObject
NtSetSystemPowerState
NtRaiseHardError
NtSetSecurityObject
NtQuerySymbolicLinkObject
NtQueryVolumeInformationFile
NtFsControlFile
RtlAdjustPrivilege
NtOpenFile
NtQueryInformationProcess
DbgBreakPoint
RtlAllocateHeap
RtlAllocateAndInitializeSid
RtlDestroyEnvironment
NtShutdownSystem
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlCreateEnvironment
RtlSetEnvironmentVariable
NtCreatePort
RtlInitializeCriticalSection
RtlInitUnicodeString
RtlQueryEnvironmentVariable_U
NtAcceptConnectPort
RtlOpenCurrentUser
NtReplyPort
NtCompleteConnectPort
NtReplyWaitReceivePort

userenv

ord118
GetDefaultUserProfileDirectoryW
ord131
ord117
GetAllUsersProfileDirectoryW
DestroyEnvironmentBlock
UnloadUserProfile
CreateEnvironmentBlock
ord130
GetUserProfileDirectoryW
LoadUserProfileW
UnregisterGPNotification
RegisterGPNotification

nddeapi

ord611
ord612
ord613
ord603

sfc

ord1
ord2

secur32

GetUserNameExW

profmap

InitializeProfileMappingApi
RemapAndMoveUserW

Sections

.text
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 38KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d59abe671348455506714f306b7ab49e

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

gdi32

user32

rpcrt4

ntdll

userenv

nddeapi

sfc

secur32

profmap

Sections

.text Size: 131KB - Virtual size: 131KB

.data Size: 8KB - Virtual size: 8KB

.rsrc Size: 38KB - Virtual size: 40KB

.text
Size: 131KB - Virtual size: 131KB

.data
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 38KB - Virtual size: 40KB