437cbddb403536052da2484594b1b326_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

437cbddb403536052da2484594b1b326_JaffaCakes118
Size

356KB
MD5

437cbddb403536052da2484594b1b326
SHA1

464e0c5007699b925a3725f5cb9e57e90f48bf16
SHA256

665fb751118a5a098f786e278589fe224e216a929d85688ec8d8a8f19537af72
SHA512

51e9384d915644eb9471073d8d507cb8707f8e96cafaaac1c487b7acf7b98855f8d842a4a619ba69057361f915e4beb611d78c8374b643f184c8c6b74a7bb65a
SSDEEP

6144:rJCsArgpdiPNBCU0hgZb7NVS9qlBFc1d6YpOV6vqvXeuIS4ChZYu:rUMpd+zCFgJXKLMVPvXPIS9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
437cbddb403536052da2484594b1b326_JaffaCakes118

Files

437cbddb403536052da2484594b1b326_JaffaCakes118
.exe windows:5 windows x86 arch:x86

13ccb585d99062a509595969c6a8c7b1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MonitorFromWindow
GetKeyboardLayoutNameW
TabbedTextOutW
GetUpdateRgn
CheckMenuItem
IsWindowInDestroy
SetMenuContextHelpId
SetScrollInfo
GetClipCursor
ChildWindowFromPoint
ShowOwnedPopups
SetClassLongW
GetWindowTextLengthA
DestroyCaret
GetInputDesktop
EmptyClipboard
SendDlgItemMessageW
IsZoomed
SetWindowLongA
wsprintfA
GetDoubleClickTime
AllowSetForegroundWindow
SetSysColors
DefMDIChildProcW
GetLastInputInfo
GetMessageA
PtInRect
ChangeMenuW
GetWindowModuleFileNameW
SendNotifyMessageW
GetIconInfo
IMPQueryIMEA
LoadLocalFonts

wintrust

CryptCATPersistStore
TrustOpenStores
CryptCATAdminEnumCatalogFromHash
WTHelperCertIsSelfSigned
WinVerifyTrust
WTHelperGetAgencyInfo
CryptSIPVerifyIndirectData
WVTAsn1SpcStatementTypeDecode
WTHelperGetProvCertFromChain
SoftpubInitialize
OfficeInitializePolicy
SoftpubDllUnregisterServer
CryptCATAdminCalcHashFromFileHandle
WVTAsn1CatMemberInfoDecode
WVTAsn1SpcPeImageDataDecode
CryptCATAdminPauseServiceForBackup
FindCertsByIssuer
SoftpubLoadMessage
CryptCATGetMemberInfo
TrustFindIssuerCertificate
CryptCATAdminAddCatalog
CryptCATVerifyMember
TrustDecode
WVTAsn1CatNameValueEncode
mscat32DllUnregisterServer
WintrustAddDefaultForUsage
WintrustLoadFunctionPointers
TrustIsCertificateSelfSigned
CryptCATPutMemberInfo
DriverCleanupPolicy
CryptCATGetAttrInfo
CryptCATEnumerateAttr
WVTAsn1CatNameValueDecode
GenericChainCertificateTrust
WTHelperCertFindIssuerCertificate
MsCatFreeHashTag
SoftpubFreeDefUsageCallData
WTHelperGetProvSignerFromChain
WTHelperOpenKnownStores
WVTAsn1SpcMinimalCriteriaInfoEncode
WTHelperGetFileName

kernel32

GetShortPathNameA
VerLanguageNameA
GetProfileIntA
GetFirmwareEnvironmentVariableW
WaitNamedPipeW
GlobalAddAtomW
GetVolumePathNamesForVolumeNameW
QueryDosDeviceA
DosDateTimeToFileTime
GetNamedPipeInfo
GetSystemTimeAsFileTime
DosPathToSessionPathA
SetTimeZoneInformation
GetFileAttributesExW
SetLastError
GetConsoleInputExeNameW
SetSystemPowerState
GetConsoleMode
GlobalReAlloc
QueryPerformanceCounter
VDMConsoleOperation
VirtualAlloc
GlobalFindAtomW
GetTapeStatus
LZOpenFileW
LZCreateFileW
UnregisterConsoleIME
NlsGetCacheUpdateCount
DisconnectNamedPipe
ReadProcessMemory
GetConsoleScreenBufferInfo
ReadConsoleOutputCharacterA
OutputDebugStringA
RtlCaptureStackBackTrace
GetStartupInfoW
LoadLibraryA
LockFileEx
FindFirstFileW
DefineDosDeviceA
GetConsoleCursorMode
GetModuleHandleW
GetQueuedCompletionStatus
GetSystemPowerStatus
IsBadWritePtr

msvcrt40

??1bad_typeid@@UAE@XZ
??0bad_cast@@QAE@ABQBD@Z
?str@strstreambuf@@QAEPADXZ
_chgsign
??4istream_withassign@@QAEAAVistream@@ABV1@@Z
?str@ostrstream@@QAEPADXZ
?pbackfail@streambuf@@UAEHH@Z
??_7stdiobuf@@6B@
?setmode@ofstream@@QAEHH@Z
strlen
strcmp
_isnan
wcsftime
_telli64
??_E__non_rtti_object@@UAEPAXI@Z
_adj_fdiv_m32
_beginthread
_setsystime
??4streambuf@@QAEAAV0@ABV0@@Z
??5istream@@QAEAAV0@AAF@Z
??_7istrstream@@6B@
_loaddll
??1__non_rtti_object@@UAE@XZ
??0ifstream@@QAE@ABV0@@Z
??_8stdiostream@@7Bostream@@@
_mbsinc
bsearch
_mbsnbset
tanh
_cgets
__setusermatherr
_setmode
_mbsnbicmp
??0iostream@@QAE@PAVstreambuf@@@Z
??_7exception@@6B@
memchr
__CxxLongjmpUnwind
__STRINGTOLD
??0__non_rtti_object@@QAE@ABV0@@Z
_ftime

netapi32

I_NetDatabaseRedo
NetpHexDump
NetGroupSetUsers
I_NetServerTrustPasswordsGet
NetpwPathCanonicalize
NetLogonGetTimeServiceParentDomain
NetGetJoinableOUs
NetUserSetInfo
NetShareDel
NetLocalGroupAddMember
NetApiBufferSize
NetEnumerateComputerNames
DsGetDcNameW
DsRoleDnsNameToFlatName
I_NetLogonSamLogoff
NetUseAdd
DsRoleGetPrimaryDomainInformation
NetUseDel
NetReplExportDirLock
NetValidateName
NetShareEnum
NetServerGetInfo
NetReplSetInfo
NetpAddTlnFtinfoEntry
DsRoleFreeMemory
NetShareEnumSticky
NetShareAdd
NetpDbgPrint
NetShareDelSticky
DsAddressToSiteNamesExA
NetServiceGetInfo
DsRoleCancel
NetLocalGroupDel
I_NetLogonSamLogon
NetReplExportDirDel
DsGetDcNameA
NetAlertRaise
NetpGetConfigBool
NetErrorLogClear
NetWkstaUserSetInfo

w32topl

ToplSTHeapAdd
ToplDeleteComponents
ToplScheduleCacheCreate
ToplListRemoveElem
ToplGraphNumberOfVertices
ToplFree
ToplGraphInit
ToplIsToplException
ToplVertexFree
ToplGetSpanningTreeEdgesForVtx
ToplEdgeGetToVertex
ToplVertexDestroy
ToplListSetIter
ToplVertexGetParent
ToplVertexGetInEdge
ToplIterGetObject
ToplIterFree
ToplSTHeapDestroy
ToplGraphFindEdgesForMST
ToplEdgeSetWeight
ToplVertexSetId
ToplScheduleMaxUnavailable
ToplSTHeapExtractMin
ToplListNumberOfElements
ToplScheduleMerge
ToplVertexCreate
ToplVertexGetOutEdge
ToplEdgeCreate
ToplVertexGetId
ToplScheduleDuration
ToplMakeGraphState
ToplEdgeDestroy

tcpmonui

??1CTcpMibABC@@UAE@XZ
??0CTcpMibABC@@QAE@XZ
LocalAddPortUI
??0CPortABC@@QAE@XZ
??_7CPortABC@@6B@
??0CTcpMibABC@@QAE@ABV0@@Z
?Read@CPortABC@@UAEKQAXPAEKPAK@Z
??4CPortABC@@QAEAAV0@ABV0@@Z
??_7CTcpMibABC@@6B@
??4CTcpMibABC@@QAEAAV0@ABV0@@Z
??1CPortABC@@UAE@XZ
InitializePrintMonitorUI
LocalConfigurePortUI
??0CPortABC@@QAE@ABV0@@Z

Sections

.text
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 157KB - Virtual size: 574KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

13ccb585d99062a509595969c6a8c7b1

Headers

DLL Characteristics

File Characteristics

Imports

user32

wintrust

kernel32

msvcrt40

netapi32

w32topl

tcpmonui

Sections

.text Size: 77KB - Virtual size: 77KB

.rdata Size: 112KB - Virtual size: 112KB

.data Size: 157KB - Virtual size: 574KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 77KB - Virtual size: 77KB

.rdata
Size: 112KB - Virtual size: 112KB

.data
Size: 157KB - Virtual size: 574KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 1024B - Virtual size: 1024B