488560cec6285c395b365d7d0b48a572_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

488560cec6285c395b365d7d0b48a572_JaffaCakes118
Size

359KB
MD5

488560cec6285c395b365d7d0b48a572
SHA1

c85e608d4c11d742d8aab72cf8010717bfcfb1b8
SHA256

42f59a31e4f3e2c022d89b371eefd9e8bc6694814759e3d0d08d78f20bf27f49
SHA512

07f363f1ee08645e15798c6e1d76c6902b5941690981ba7c120ded2c864759c8e43b33417c544621db68dd5dc64208f2ee714d75e73f2bf7f0c314f1e4750526
SSDEEP

6144:EKGYFu4EurvIs8HfCFaRTZhHLmPSZ8+4CCmxVceM3xr4z1WOc97i+1iTDb:fGvSIsy9TZhsh+4C5xq3xcZWOc9WsYb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
488560cec6285c395b365d7d0b48a572_JaffaCakes118

Files

488560cec6285c395b365d7d0b48a572_JaffaCakes118
.exe windows:5 windows x86 arch:x86

67289416526f8a784078955649d5c940

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateSocketHandle
GlobalLock
GetSystemTimeAdjustment
GetConsoleKeyboardLayoutNameW
GlobalUnWire
GetUserGeoID
LoadLibraryA
SetMessageWaitingIndicator
IsValidLocale
GetProfileStringW
GlobalFix
GetPrivateProfileStringW
DnsHostnameToComputerNameA
ResetEvent
GetModuleHandleW
PrivCopyFileExW
DefineDosDeviceA
CreateNamedPipeW
LocalSize
SetInformationJobObject
lstrcpy
EnterCriticalSection
lstrlenW
GetCompressedFileSizeA
GetConsoleTitleW
VirtualAlloc
CreateSemaphoreW
LeaveCriticalSection
DeleteCriticalSection
SetFilePointerEx

expsrv

EbDestroyContext
rtcGetAllSettings
__vbaFileCloseAll
__vbaLateMemStAd
rtcRightVar
_adj_fdivr_m16i
__vbaVarLateMemStAd
__vbaVarCopy
rtcSpaceBstr
__vbaDateVar
__vbaVargVarCopy
__vbaAryDestruct
rtcPackTime
__vbaStrR4
rtcIsArray
__vbaI2Abs
rtCyFromErrVar
__vbaR8Str
__vbaVarTstGe
__vbaRedimPreserveVar2
__vbaNew
__vbaAryRebase1Var
rtcUpperCaseBstr
__vbaAryRecMove
__vbaUdtVar
__vbaVarTextTstNe
__vbaPutFxStr3
__vbaVarTstLe
rtcFileAttributes
__vbaR4ForNextCheck
__vbaStrUI1

gdi32

GetOutlineTextMetricsA
GetWinMetaFileBits
GdiDeleteSpoolFileHandle
SetSystemPaletteUse
DdEntry43
SetMagicColors
SetPaletteEntries
AnimatePalette
CheckColorsInGamut
StartPage
GetLogColorSpaceW
GetGlyphIndicesW
RemoveFontResourceExA
GetWorldTransform
GetCharABCWidthsFloatW
DdEntry40
SetICMMode
EngCopyBits
Ellipse
GetFontData
SetWindowExtEx
GetTextCharacterExtra
GetEUDCTimeStampExW
InvertRgn
CLIPOBJ_ppoGetPath
Polyline
GdiEntry12
GetROP2
GetTextCharsetInfo

cfgmgr32

CM_Get_DevNode_Registry_PropertyA
CM_Get_Next_Res_Des_Ex
CM_Free_Log_Conf
CM_Get_HW_Prof_FlagsA
CM_Get_Hardware_Profile_Info_ExW
CM_Get_Device_ID_ListA
CM_Query_And_Remove_SubTree_ExA
CM_Uninstall_DevNode
CM_Add_Res_Des_Ex
CM_Detect_Resource_Conflict
CM_Get_Hardware_Profile_InfoW
CM_Get_Device_ID_ListW
CM_Get_Depth
CM_Add_Res_Des
CM_Get_Next_Res_Des
CM_Get_Resource_Conflict_Count
CM_Get_Child
CM_Get_HW_Prof_Flags_ExW
CM_Set_HW_Prof_FlagsA
CM_Free_Res_Des_Handle
CM_Get_Device_ID_List_SizeW
CM_Get_Device_Interface_ListW
CM_Register_Device_Driver
CM_Add_ID_ExW
CM_Set_HW_Prof_Flags_ExA
CM_Get_Class_Registry_PropertyA
CM_Get_Device_ID_List_Size_ExW
CM_Open_Class_KeyA
CM_Get_Device_ID_List_Size_ExA
CM_Get_Device_Interface_AliasA
CM_Get_Device_IDA

sqlunirl

_GetOpenFileName@4
_FindText_@4
_SHGetFileInfo_@20
_DlgDirList_@20
_GetKeyboardLayoutName_@4
newWideCharFromMultiByte
_LoadImage_@24
_GetDefaultCommConfig_@12
_OpenMutex_@12
_CommDlg_OpenSave_GetSpec@12
_SetComputerName_@4
_GetEnvironmentStrings_@4
_ShellExecuteEx_@4
_GetVersionEx@4
_NDdeSetShareSecurity_@16
_ShellExecute_@24
_trename
_GetDiskFreeSpaceEx@16
_GetTextExtentExPoint_@28
_SetFileSecurity_@12
_OpenBackupEventLog_@8
_FindNextFile_@8
_StartServiceCtrlDispatcher_@4
_FindExecutable_@12
_IsCharAlpha_@4
_OutputDebugString_@4

opengl32

glVertex2sv
glTexCoord3s
glColor4bv
glGetPolygonStipple
glShadeModel
glTexImage1D
glCopyTexImage2D
glVertex2f
glLightModeli
glBindTexture
glStencilOp
glVertex2iv
glRasterPos4f
glDepthFunc
glIndexi
glTexGend
glIndexsv
glVertex3d
glGenTextures
glTexGendv
glIsEnabled
glColorMaterial
glNormal3dv
glPixelTransferi
glLightf
glColor3ub
glColor3b
glColor4iv
glGetDoublev
glDepthMask
glTexSubImage2D
glRasterPos2sv
glVertex3i

imagehlp

StackWalk
SymEnumSym
UpdateDebugInfoFileEx
ReBaseImage
SymLoadModule
RemoveRelocations
BindImageEx
ImageDirectoryEntryToDataEx
ImageRvaToSection
SymFindFileInPath
CheckSumMappedFile
SetImageConfigInformation
SymGetModuleInfo
UnmapDebugInformation
SearchTreeForFile
SymGetOptions
SymGetLineFromAddr
ReBaseImage64
SymLoadModule64
FindDebugInfoFileEx
ImagehlpApiVersionEx
SymEnumerateSymbolsW
ImageDirectoryEntryToData
SymGetModuleBase64
SymGetSymFromName64
SymGetSymPrev
SymFunctionTableAccess64
SplitSymbols
SymGetLineFromName
SymGetSymFromAddr
FindExecutableImageEx
SymUnloadModule
SymRegisterCallback64
SymGetSymPrev64
SymEnumerateSymbols64
SymEnumerateSymbols

user32

GetMenuState
SetDlgItemTextA
EnableWindow
GetDlgCtrlID
UnhookWinEvent
DlgDirListW
DdeQueryConvInfo
GetDesktopWindow
GetScrollPos
DispatchMessageW
SendMessageTimeoutW
LoadMenuW
GetUserObjectInformationW
GetProgmanWindow
GetFocus
LoadLocalFonts
SetTaskmanWindow
GetClipboardSequenceNumber
OpenDesktopA
ShowCursor
PrivateExtractIconsW
ChangeMenuA
GetRegisteredRawInputDevices
OpenInputDesktop
IsCharUpperA
GetMouseMovePointsEx
CopyRect
CharNextExA

iprop

PropStgNameToFmtId
FmtIdToPropStgName
PropVariantClear
StgCreatePropStg
FreePropVariantArray
PropVariantCopy
StgOpenPropStg
StgCreatePropSetStg

wiavideo

DllGetClassObject
DllUnregisterServer
DllRegisterServer

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 300KB - Virtual size: 724KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

67289416526f8a784078955649d5c940

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

expsrv

gdi32

cfgmgr32

sqlunirl

opengl32

imagehlp

user32

iprop

wiavideo

Sections

.text Size: 27KB - Virtual size: 27KB

.rdata Size: 32KB - Virtual size: 32KB

.data Size: 300KB - Virtual size: 724KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 27KB - Virtual size: 27KB

.rdata
Size: 32KB - Virtual size: 32KB

.data
Size: 300KB - Virtual size: 724KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 1KB - Virtual size: 1KB