4536024dea4e125d114c91018689d9ea_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4536024dea4e125d114c91018689d9ea_JaffaCakes118
Size

790KB
MD5

4536024dea4e125d114c91018689d9ea
SHA1

d832a1776d159d93442b013cb3c2444769a2ffd1
SHA256

62d2fe53ee659f2daf51e3dc848afc5025792bf2525cdec0701eb5e8aea9bc02
SHA512

afdf56bfefb2063355279f3038b6be8fc5de9bc8ae5132a96168ddc5f89cc901aaf3cf47cf3a432659a9d6b8f8a5b408152a5597662725ee8ac28ae2a0a26aba
SSDEEP

12288:4QtnqFmP+3KuxRwBj4atGzblEOGSEzUWzblE4wEQRUcix7YrB:4QtnqFmP+dfwBj4atG+O2+nihYl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4536024dea4e125d114c91018689d9ea_JaffaCakes118

Files

4536024dea4e125d114c91018689d9ea_JaffaCakes118
.exe windows:4 windows x86 arch:x86

92cce714a843ca83e58d49070c94a117

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\ccViews\autobuild1_BR-0909-044C_6.0_Snapshot\WorkingDirectory1\SOLInstaller\1.2.10\Installer\AMT\Release\setup.pdb

Imports

kernel32

GetCurrentDirectoryW
CreateFileW
GetFileSize
ReadFile
MultiByteToWideChar
GetFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
LoadLibraryW
CreateMutexW
GetModuleFileNameA
WriteFile
GetLocalTime
GetCommandLineW
GetTickCount
SetFilePointer
BeginUpdateResourceW
EndUpdateResourceA
FindResourceW
LoadResource
SizeofResource
LockResource
UpdateResourceW
EnumResourceLanguagesW
GetUserDefaultUILanguage
GetUserDefaultLangID
GetVersion
ConvertDefaultLocale
GetLocaleInfoW
GetVersionExW
GetModuleHandleW
GetCurrentProcess
GetSystemInfo
GetSystemWow64DirectoryW
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
TerminateProcess
GetExitCodeProcess
RemoveDirectoryW
SetEvent
CreateThread
GlobalAlloc
GlobalLock
LoadLibraryExW
GlobalFree
ExitProcess
CompareStringW
CompareStringA
SetEndOfFile
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
LoadLibraryA
HeapSize
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStartupInfoA
SetHandleCount
GetFileType
GetStdHandle
HeapCreate
HeapDestroy
HeapReAlloc
VirtualAlloc
MoveFileW
GetTempFileNameW
GetTempPathW
GetFileAttributesW
CompareFileTime
GetEnvironmentVariableW
GetSystemDirectoryW
FreeLibrary
CreateEventW
GetProcAddress
SetErrorMode
Sleep
SetFileAttributesW
MoveFileExW
DeleteFileW
GetWindowsDirectoryW
WaitForSingleObject
CreateProcessW
SetLastError
VerifyVersionInfoW
VerSetConditionMask
FindNextFileW
FindClose
GetLastError
FindFirstFileW
lstrcpyW
LocalFree
WriteProfileStringW
LocalAlloc
GetProfileStringW
GetModuleFileNameW
WideCharToMultiByte
SetFileAttributesA
SetFileTime
LocalFileTimeToFileTime
VirtualFree
GetCurrentThreadId
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetOEMCP
DosDateTimeToFileTime
GetFileAttributesA
FileTimeToDosDateTime
FileTimeToLocalFileTime
CloseHandle
GetFileInformationByHandle
CreateFileA
CopyFileW
GlobalUnlock
GetACP
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetCPInfo
RtlUnwind
RaiseException
GetStartupInfoW
GetProcessHeap
GetVersionExA
GetModuleHandleA
DeleteFileA
GetConsoleMode
GetConsoleCP
HeapFree
HeapAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
InterlockedExchange
InterlockedCompareExchange
SetEnvironmentVariableA

user32

SetTimer
DialogBoxParamW
LoadStringW
GetWindowModuleFileNameW
GetWindowThreadProcessId
SendMessageW
EnumWindows
DialogBoxIndirectParamW
MonitorFromWindow
GetMonitorInfoW
OffsetRect
GetWindowLongW
AdjustWindowRect
GetWindowRect
DrawTextW
LoadIconW
SetRectEmpty
SetDlgItemTextW
PostMessageW
EnableWindow
wsprintfW
ReleaseDC
GetDC
KillTimer
SetFocus
EndDialog
ShowWindow
SetWindowPos
GetClientRect
GetDlgItem
SetWindowTextW
MessageBoxIndirectW
LoadImageW
ExitWindowsEx

gdi32

SetBkMode
SetTextColor
DeleteDC
GetTextExtentPoint32W
SelectObject
CreateCompatibleDC
DeleteObject
CreateFontW
GetStockObject

advapi32

OpenSCManagerW
RegSetValueExW
RegCloseKey
ChangeServiceConfig2W
RegQueryValueExW
RegOpenKeyExW
RegEnumValueW
IsTextUnicode
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
DeleteService
ControlService
StartServiceW
CloseServiceHandle
ChangeServiceConfigW
CreateServiceW
OpenServiceW
QueryServiceStatus
RegEnumKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegCreateKeyExW

shell32

SHCreateDirectoryExW
SHGetFolderPathW
SHCreateDirectoryExA

ole32

CoCreateInstance
CoInitialize
CoUninitialize

cabinet

ord11
ord13
ord14
ord20
ord22
ord23
ord10

msports

ComDBClose
ComDBReleasePort
ComDBClaimPort
ComDBGetCurrentPortUsage
ComDBOpen

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiSetDeviceRegistryPropertyW
SetupDiOpenDevRegKey
SetupDiGetDeviceRegistryPropertyW
SetupDiSetClassInstallParamsW
SetupFindNextLine
SetupGetStringFieldW
SetupGetLineTextW
SetupDiCallClassInstaller
SetupDiGetClassDevsW
SetupDiGetINFClassW
SetupOpenInfFileW
SetupCloseInfFile
SetupFindFirstLineW

shlwapi

PathAppendW
PathFileExistsW
PathFindFileNameW
PathRemoveFileSpecA
PathAddBackslashA
PathAppendA
PathRenameExtensionW
PathStripToRootW
PathIsRelativeW
PathRemoveBackslashW
PathIsRootW
PathIsDirectoryW
PathCombineW
PathFindExtensionW
PathStripPathW
SHDeleteKeyW
PathRemoveFileSpecW
PathFindFileNameA
PathAddBackslashW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

EnumProcessModules
GetModuleFileNameExW

Sections

.text
Size: 308KB - Virtual size: 304KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 332KB - Virtual size: 331KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.prdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

92cce714a843ca83e58d49070c94a117

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

cabinet

msports

setupapi

shlwapi

version

psapi

Sections

.text Size: 308KB - Virtual size: 304KB

.rdata Size: 64KB - Virtual size: 62KB

.data Size: 8KB - Virtual size: 19KB

.rsrc Size: 332KB - Virtual size: 331KB

.prdata Size: 68KB - Virtual size: 68KB

.text
Size: 308KB - Virtual size: 304KB

.rdata
Size: 64KB - Virtual size: 62KB

.data
Size: 8KB - Virtual size: 19KB

.rsrc
Size: 332KB - Virtual size: 331KB

.prdata
Size: 68KB - Virtual size: 68KB