453e9d420e6a44c4fb9e5730d99e6b83_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

453e9d420e6a44c4fb9e5730d99e6b83_JaffaCakes118
Size

869KB
MD5

453e9d420e6a44c4fb9e5730d99e6b83
SHA1

2fed31b69f89b7184098a4859e611359456eaf9d
SHA256

97eaadbe20310c73f43fca91ef62d8ca5bca46aa37177c0b68977c3344e159eb
SHA512

b136de69c2e8e72b5c6f10a83e92ed527c0c24680221d75f784aeb2089020d9859b74a0fc40ceea47cd808ec6574ed41e9c058442d0726ba1960eca04dbdb4b0
SSDEEP

12288:0NJIuVAbDLA9k4BVCHgaFX3T37k+rwleq5nK4s4Q1bU/JkSzPMuWnf8f/wovVw:0pVAbXam7h3rohfQJ8PMLEf/woNw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
453e9d420e6a44c4fb9e5730d99e6b83_JaffaCakes118

Files

453e9d420e6a44c4fb9e5730d99e6b83_JaffaCakes118
.exe windows:5 windows x86 arch:x86

2a0ed501a885e1697271080f4aeb37f3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtRegisterThreadTerminatePort
RtlSecondsSince1980ToTime
RtlLookupAtomInAtomTable
RtlUlongByteSwap
RtlSetIoCompletionCallback
NtOpenObjectAuditAlarm
CsrClientCallServer
ZwCreateProcessEx
RtlpNtCreateKey
NtDelayExecution
RtlNewSecurityGrantedAccess
RtlLargeIntegerAdd
ZwSetBootOptions
NtOpenIoCompletion
wcspbrk
RtlInitUnicodeStringEx
ZwClearEvent
NtAccessCheckByTypeResultListAndAuditAlarm
NtResumeThread
LdrFindResource_U
RtlVerifyVersionInfo
_fltused
NtSetTimerResolution
ZwMapViewOfSection
ZwRequestPort
ZwDeleteAtom
RtlFindLastBackwardRunClear
NtLoadDriver
ZwPrivilegeCheck
RtlCreateBootStatusDataFile
ZwTerminateProcess
RtlSubtreePredecessor
ZwQueryTimerResolution
ZwSetSystemPowerState
RtlZombifyActivationContext
DbgUiRemoteBreakin
NtVdmControl
NtRemoveProcessDebug
RtlConvertExclusiveToShared
ZwReplyWaitReceivePort
_aullshr
NtCreateProfile
RtlTimeToSecondsSince1970
RtlUniform
islower
RtlLengthSid
NtQueryDirectoryObject
ZwQuerySystemEnvironmentValue
RtlImageDirectoryEntryToData
NtNotifyChangeDirectoryFile
DbgUiSetThreadDebugObject
ZwCreateJobSet
RtlDestroyEnvironment
_ultoa
RtlEqualComputerName
RtlExtendedMagicDivide
wcschr
RtlSetProcessIsCritical
NtDebugContinue
RtlInitializeGenericTableAvl
isdigit
ZwQuerySymbolicLinkObject
RtlRestoreLastWin32Error
RtlGUIDFromString
NtOpenSemaphore
RtlFindClearRuns
NtQueryDefaultUILanguage
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle
RtlEnterCriticalSection
RtlDeleteElementGenericTableAvl
RtlGetCompressionWorkSpaceSize

secur32

SetContextAttributesA
SaslEnumerateProfilesW
InitializeSecurityContextA
AddCredentialsA
ExportSecurityContext
SaslEnumerateProfilesA
SaslGetProfilePackageA
QuerySecurityContextToken
LsaEnumerateLogonSessions
SecpFreeMemory
SetContextAttributesW
LsaRegisterLogonProcess
QueryContextAttributesW
DeleteSecurityPackageA
QuerySecurityPackageInfoW
CredUnmarshalTargetInfo
VerifySignature
GetComputerObjectNameA
AddSecurityPackageA
LsaFreeReturnBuffer
SaslGetProfilePackageW
AddCredentialsW
InitializeSecurityContextW
FreeContextBuffer
SaslInitializeSecurityContextA
TranslateNameW
CredMarshalTargetInfo
GetUserNameExW

setupapi

SetupInstallServicesFromInfSectionExA
SetupFreeSourceListA
CM_Add_Empty_Log_Conf
SetupScanFileQueue
SetupInstallFileExA
SetupDiInstallDeviceInterfaces
SetupDiEnumDriverInfoW
SetupDiSetDriverInstallParamsW
SetupDiOpenDeviceInterfaceA
pSetupVerifyQueuedCatalogs
pSetupMakeSurePathExists
SetupGetLineCountW
SetupDiGetINFClassA
pSetupSetArrayToMultiSzValue
SetupQueueDefaultCopyW
SetupScanFileQueueA
CM_Query_Arbitrator_Free_Data
pSetupModifyGlobalFlags
SetupDiGetSelectedDevice
CM_Get_Resource_Conflict_DetailsW
CM_Set_HW_Prof_FlagsA
CM_Open_Class_Key_ExW
CM_Intersect_Range_List
SetupDiSetClassRegistryPropertyA
SetupQueueRenameA
CM_Set_HW_Prof_Ex
SetupDiGetClassImageListExW
SetupDiClassNameFromGuidExW
CM_Get_Device_Interface_Alias_ExW
CM_Set_DevNode_Registry_PropertyA
SetupPrepareQueueForRestoreW
CM_Get_Device_Interface_AliasA
pSetupDestroyRunOnceNodeList
CM_Get_Child
pSetupStringTableAddStringEx
SetupDiClassGuidsFromNameExA
pSetupStringTableLookUpStringEx
CM_Get_Device_Interface_List_SizeA
CM_Get_Device_ID_ListW
SetupAddToSourceListA

hhsetup

?AddLocationHistory@CTitle@@QAEKKPBD00PBVCLocation@@00H@Z
??1CFIFOString@@QAE@XZ
??4CTitle@@QAEAAV0@ABV0@@Z
?RemoveAll@CFIFOString@@QAEXXZ
?GetParent@CFolder@@QAEPAV1@XZ
?Close@CCollection@@QAEKXZ
?AddTitle@CCollection@@QAEPAVCTitle@@PBG0000GIPAVCLocation@@PAKH0@Z
?Add@CPointerList@@QAEPAUListItem@@PAX@Z
?GetIdW@CLocation@@QAEPBGXZ
??1CPointerList@@QAE@XZ
?SetMasterCHM@CCollection@@QAEXPBDG@Z
?AddChildFolder@CFolder@@QAEPAV1@PBGKPAKG@Z
?SetTitle@CLocation@@QAEXPBG@Z
?GetNextFolder@CFolder@@QAEPAV1@XZ
?SetFirstChildFolder@CFolder@@QAEXPAV1@@Z
?GetOrder@CFolder@@QAEKXZ
?AddFolder@CCollection@@QAEPAVCFolder@@PBDKPAKG@Z
?GetNextLocation@CLocation@@QAEPAV1@XZ
?GetId@CLocation@@QBEPADXZ
?GetNextTitle@CTitle@@QAEPAV1@XZ
?SetMasterCHM@CCollection@@QAEXPBGG@Z
?GetVersion@CCollection@@QAEKXZ
?FindLocation@CCollection@@QAEPAVCLocation@@PBGPAI@Z
?GetVolumeW@CLocation@@QAEPBGXZ
?GetIdW@CTitle@@QAEPBGXZ
??0CFIFOString@@QAE@XZ
?HandleTitle@CCollection@@AAEKPAVCParseXML@@PAD@Z
?FirstLocation@CCollection@@QAEPAVCLocation@@XZ
?SetExTitlePtr@CFolder@@QAEXPAVCExTitle@@@Z
?DeleteFolders@CCollection@@AAEXPAPAVCFolder@@@Z
?Dirty@CCollection@@QAEXXZ
?DeleteChildren@CCollection@@AAEXPAPAVCFolder@@@Z
?SetVolume@CLocation@@QAEXPBG@Z
?AddLocation@CCollection@@QAEPAVCLocation@@PBD000PAK@Z
?AddCollection@CCollection@@QAEPAVCColList@@XZ
??1CCollection@@QAE@XZ
?Open@CCollection@@QAEKPBD@Z
?GetLangId@CCollection@@QAEGPBG@Z
?GetTitleW@CLocation@@QAEPBGXZ
?GetColNo@CCollection@@QAEKXZ

advapi32

SystemFunction033
RegDeleteKeyW
LsaLookupSids
QueryServiceLockStatusA
CopySid
BuildImpersonateExplicitAccessWithNameA
SetSecurityDescriptorControl
CryptSetProviderExW
StartServiceCtrlDispatcherW
GetPrivateObjectSecurity
SystemFunction019
ConvertSDToStringSDRootDomainW
GetEffectiveRightsFromAclW
ConvertSecurityDescriptorToAccessW
EnumDependentServicesA
EnumServicesStatusW
ElfReportEventW
CryptSignHashA
DuplicateTokenEx
GetServiceDisplayNameA
UnlockServiceDatabase
SystemFunction022
LogonUserW
LsaQueryTrustedDomainInfoByName
CredIsMarshaledCredentialA
SystemFunction024
DeregisterEventSource

msvcrt40

?open@filebuf@@QAEPAV1@PBDHH@Z
tmpnam
_environ
atof
_fcloseall
??5istream@@QAEAAV0@PAD@Z
_itoa
_outpd
?xalloc@ios@@SAHXZ
_mtlock
??_Estrstream@@UAEPAXI@Z
_clearfp
printf
_execve
_abnormal_termination
_ismbckata
__argv
_execlp
?binary@filebuf@@2HB
_wsystem
?endl@@YAAAVostream@@AAV1@@Z
_pwctype
?open@fstream@@QAEXPBDHH@Z
_mbctolower
wcscpy

kernel32

GetProfileStringA
SetConsoleTitleW
OpenJobObjectW
lstrcatW
DeleteCriticalSection
LockResource
GetNumaNodeProcessorMask
TryEnterCriticalSection
GetTimeZoneInformation
TlsAlloc
VirtualAlloc
GetEnvironmentVariableW
FillConsoleOutputCharacterW
CreateNamedPipeA
GetVolumePathNamesForVolumeNameW
CopyLZFile
FindNextVolumeW
GetCurrentDirectoryW
LeaveCriticalSection
GetPrivateProfileIntA
GlobalAddAtomW
LocalUnlock
GetExpandedNameA
GetWindowsDirectoryA
FoldStringA
GetNamedPipeHandleStateW
FindFirstChangeNotificationA
GetProcessHeaps
GetFileSizeEx
CreateFiber
InterlockedPushEntrySList
GetProcessVersion
SetCommState
SetConsoleDisplayMode
SetConsoleCP
HeapAlloc
GetThreadContext
LoadLibraryA
CreateProcessInternalW
ContinueDebugEvent
GetNamedPipeHandleStateA
GetBinaryType
EnterCriticalSection
GetSystemTimeAsFileTime
QueryPerformanceFrequency
WideCharToMultiByte
Process32NextW
GetProcAddress

msvcrt

exit

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 285KB - Virtual size: 284KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 519KB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2a0ed501a885e1697271080f4aeb37f3

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

secur32

setupapi

hhsetup

advapi32

msvcrt40

kernel32

msvcrt

Sections

.text Size: 61KB - Virtual size: 61KB

.rdata Size: 285KB - Virtual size: 284KB

.data Size: 519KB - Virtual size: 1.9MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 1016B

.text
Size: 61KB - Virtual size: 61KB

.rdata
Size: 285KB - Virtual size: 284KB

.data
Size: 519KB - Virtual size: 1.9MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 1016B