47e43f7afe22b4e6d7412c663838a02b_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

47e43f7afe22b4e6d7412c663838a02b_JaffaCakes118
Size

140KB
MD5

47e43f7afe22b4e6d7412c663838a02b
SHA1

c4bbb3b2e5750dd15230d17ee609f48d2fae35f8
SHA256

c33099fcfa5c3510e128bc65b26be98706172469ff0b6d6b492fa5d605ee52c0
SHA512

74b97693d9545b11150871200f54bbfec6d78606ec56883500f71e64a7cdd002578855e51b8ade91df7705fe33f89f7e468d600af8ee791fbef42c05fa3537ed
SSDEEP

3072:tzZkFJElOuXRcLT3AGgZ1nu7wrxIqqQwmbWRKTHN/N16JkYWDXciw:tzZTOuhcPwGgXu7wrqpENF1XDk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
47e43f7afe22b4e6d7412c663838a02b_JaffaCakes118

Files

47e43f7afe22b4e6d7412c663838a02b_JaffaCakes118
.dll windows:5 windows x86 arch:x86

0728bfbdc039994cfaa661930ea583bf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

f:\nt_dnsrv\base\ntsetup\msoobci\obj\i386\msoobci.pdb

Imports

kernel32

LoadLibraryA
GetCurrentProcess
SetFileAttributesW
SetLastError
GetSystemInfo
RemoveDirectoryW
lstrcmpW
MoveFileW
MoveFileExW
MultiByteToWideChar
UnmapViewOfFile
GetShortPathNameW
GetModuleFileNameW
GetSystemDirectoryW
MapViewOfFile
CreateFileMappingW
GetProcAddress
FreeLibrary
InterlockedCompareExchange
LoadLibraryW
GetWindowsDirectoryW
LocalFree
ExpandEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
lstrcatW
lstrlenW
lstrcpyW
GetVersionExW
Sleep
WaitForSingleObject
GetExitCodeProcess
GetFullPathNameW
FindFirstFileW
FindNextFileW
FindClose
CopyFileW
GetPrivateProfileStructW
GetPrivateProfileStringW
WritePrivateProfileStructW
WritePrivateProfileStringW
CreateFileW
DeleteFileW
GetCurrentThread
CloseHandle
GetFileAttributesW
OutputDebugStringW
CreateDirectoryW
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
lstrcpynW

msvcrt

wcscpy
_adjust_fdiv
_initterm
memmove
wcsrchr
strtol
_except_handler3
swprintf
wcstoul
wcsncmp
_wcsnicmp
realloc
_snwprintf
wcschr
wcslen
iswctype
_wcsicmp
wcscmp
malloc
wcstol
free

ntdll

RtlNtStatusToDosError
RtlFreeUnicodeString
RtlNtPathNameToDosPathName
RtlInitUnicodeString
RtlpEnsureBufferSize

setupapi

SetupQueueDeleteW
pSetupSetQueueFlags
SetupSetDirectoryIdW
SetupDiSetDeviceRegistryPropertyW
SetupDiGetDeviceRegistryPropertyW
SetupPromptForDiskW
SetupGetStringFieldW
SetupGetIntField
SetupFindNextLine
SetupFindFirstLineW
SetupCloseInfFile
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupFindNextMatchLineW
SetupGetFieldCount
SetupDiGetActualSectionToInstallW
SetupOpenInfFileW
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
SetupPromptReboot
SetupDefaultQueueCallbackW
SetupQueryInfFileInformationW
SetupGetInfInformationW
SetupGetFileCompressionInfoW
SetupQueueCopyW
SetupQueueRenameW
SetupCloseFileQueue
SetupTermDefaultQueueCallback
SetupInstallServicesFromInfSectionW
SetupInstallFromInfSectionW
SetupCommitFileQueueW
SetupScanFileQueueW
SetupInstallFilesFromInfSectionW
SetupInitDefaultQueueCallbackEx
SetupOpenFileQueue
SetupOpenAppendInfFileW
SetupGetLineCountW
pSetupGetQueueFlags

advapi32

RegDeleteValueW
OpenThreadToken
AccessCheck
FreeSid
RevertToSelf
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
AllocateAndInitializeSid
RegCloseKey
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegQueryValueExW
ImpersonateSelf
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW

user32

wvsprintfW
CharNextW
GetUserObjectInformationW
GetProcessWindowStation
CharPrevW
ExitWindowsEx

ole32

CoTaskMemFree
StringFromGUID2
IIDFromString
StringFromIID

Exports

Exports

DoInstall
DoInstallA
DoInstallW
DoUninstall
DoUninstallA
DoUninstallW
DriverInstallComponents
InstallComponentA
InstallComponentW
InstallInfSectionA
InstallInfSectionW
IsInteractiveWindowStation
IsUserAdmin
ProxyRemoteInstall
ProxyRemoteInstallA
ProxyRemoteInstallW
UninstallComponent

Sections

.text
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 460B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0728bfbdc039994cfaa661930ea583bf

Headers

File Characteristics

PDB Paths

Imports

kernel32

msvcrt

ntdll

setupapi

advapi32

user32

ole32

Exports

Exports

Sections

.text Size: 41KB - Virtual size: 40KB

.data Size: 512B - Virtual size: 460B

.rsrc Size: 95KB - Virtual size: 95KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 41KB - Virtual size: 40KB

.data
Size: 512B - Virtual size: 460B

.rsrc
Size: 95KB - Virtual size: 95KB

.reloc
Size: 2KB - Virtual size: 2KB