4a455cdcb4384a96933135e4d6c342bf_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4a455cdcb4384a96933135e4d6c342bf_JaffaCakes118
Size

389KB
MD5

4a455cdcb4384a96933135e4d6c342bf
SHA1

3afd9a085ac989b6bd65b857fc885f32c62711f9
SHA256

9c32bdec1185c1373372c1aabffb3de97a9a8527f30a9fb47c136ac66541e897
SHA512

db0554a99c0cdfc05ae4aa3cc57d5378b5d7423e6d8a731e5ea6a3a1a2db91804ef3900157c1e695ad335b8096bb8ade8de2b22955a7d08887caad833578168b
SSDEEP

12288:NKt8kaYGO+H0ftAjEbDqpQ2hLS/zS5M0D9lcG1iN:Nwtl8E44zS5M0D9la

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4a455cdcb4384a96933135e4d6c342bf_JaffaCakes118

Files

4a455cdcb4384a96933135e4d6c342bf_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b9f9902c2d23d5c1bc5982d29c37582a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsBadReadPtr
GetConsoleKeyboardLayoutNameW
FindCloseChangeNotification
LoadLibraryA
WritePrivateProfileStructA
CallNamedPipeA
GlobalFindAtomA
EnumResourceNamesA
SetConsoleMenuClose
SwitchToFiber
GetQueuedCompletionStatus
GetPriorityClass
DeleteTimerQueue
SetProcessAffinityMask
GetStartupInfoA
RtlMoveMemory
SetLocalPrimaryComputerNameA
GetPrivateProfileSectionNamesW
GetLogicalDriveStringsA
GetNamedPipeHandleStateA
CreateEventA
BuildCommDCBW
SetConsoleHardwareState
GlobalUnfix
CreateHardLinkW
InitializeCriticalSection
LZOpenFileA
SetHandleContext
LeaveCriticalSection
IsProcessInJob
FindActCtxSectionStringW
SetFileApisToANSI
UnregisterWait
VirtualAlloc
GetConsoleNlsMode
FatalAppExitA
DefineDosDeviceW
RegisterWaitForSingleObject
UnregisterConsoleIME
GetExitCodeProcess
FindResourceExW
GetCurrentDirectoryW
IsValidCodePage
RemoveDirectoryW
GetThreadTimes
InterlockedPushEntrySList
Heap32ListNext
GetConsoleAliasesLengthA
GlobalMemoryStatusEx

secur32

SecpTranslateName
AddCredentialsW
ExportSecurityContext
GetSecurityUserInfo
QuerySecurityContextToken
AddSecurityPackageW
QueryCredentialsAttributesW
SecpFreeMemory
QuerySecurityPackageInfoA
GetUserNameExW
EncryptMessage
GetComputerObjectNameA
SaslIdentifyPackageW
AcquireCredentialsHandleA
ApplyControlToken
TranslateNameA
GetUserNameExA
SetContextAttributesW
SaslIdentifyPackageA
SaslEnumerateProfilesW
ImportSecurityContextA
SaslGetProfilePackageA
FreeContextBuffer
SaslEnumerateProfilesA
LsaConnectUntrusted
UnsealMessage
InitSecurityInterfaceA

opengl32

glRasterPos3sv
glTexCoord4fv
glVertex4s
wglMakeCurrent
glNormal3b
glTexParameterfv
glEvalPoint2
glTexGenf
glIndexd
glDeleteTextures
glIsList
wglUseFontBitmapsA
glEvalPoint1
glDisableClientState
glTexCoord3iv
glGetTexParameterfv
glFinish
glClear
wglSwapMultipleBuffers
glVertex4d
glPolygonMode
glTexCoord3sv
glPushMatrix
glFogi
glTranslated
glScaled
glVertex2f
glRectd
glColor3uiv
glBegin
glGetTexGendv
glIndexi
glMap2d
glIndexPointer
wglGetCurrentContext
glTexCoord4dv
glTexGeniv
glLightfv
glColor3ub
glColor4bv
glRasterPos4dv

mpr

WNetGetSearchDialog
WNetGetResourceInformationW
WNetGetResourceParentA
WNetCancelConnectionW
WNetGetConnection2W
WNetGetNetworkInformationA
WNetDisconnectDialog1A
WNetEnumResourceA
WNetCancelConnection2A
WNetGetProviderNameW
WNetAddConnection2A
WNetConnectionDialog2
WNetPropertyDialogA
WNetGetUniversalNameW
WNetGetConnection2A
WNetGetProviderTypeW
WNetCancelConnection2W
WNetUseConnectionW
WNetConnectionDialog
WNetGetHomeDirectoryW
WNetGetProviderTypeA
WNetGetLastErrorW
MultinetGetConnectionPerformanceW
MultinetGetConnectionPerformanceA
WNetFormatNetworkNameA
WNetGetPropertyTextA
WNetGetProviderNameA
WNetGetUserW
WNetOpenEnumA
WNetAddConnectionA
WNetGetResourceParentW
WNetOpenEnumW
WNetPasswordChangeNotify
WNetConnectionDialog1A
WNetGetResourceInformationA
WNetEnumResourceW

pdh

PdhVbAddCounter
PdhBrowseCountersHW
PdhVbGetCounterPathFromList
PdhEnumLogSetNamesA
PdhAdd009CounterA
PdhRemoveCounter
PdhLookupPerfNameByIndexA
PdhGetDefaultPerfObjectHA
PdhRelogW
PdhLookupPerfNameByIndexW
PdhIsRealTimeQuery
PdhSetCounterScaleFactor
PdhBindInputDataSourceW
PdhVerifySQLDBW
PdhGetDataSourceTimeRangeH
PdhRelogA
PdhGetCounterInfoA
PdhSetDefaultRealTimeDataSource
PdhExpandCounterPathA
PdhCollectQueryData
PdhGetLogSetGUID
PdhCreateSQLTablesA
PdhListLogFileHeaderA
PdhConnectMachineW
PdhVbGetCounterPathElements
PdhVbGetOneCounterPath
PdhVbOpenLog
PdhConnectMachineA
PdhCloseQuery
PdhVbGetLogFileSize
PdhEnumObjectItemsW
PdhBrowseCountersW
PdhGetRawCounterArrayA
PdhGetCounterTimeBase
PdhExpandWildCardPathHW
PdhTranslate009CounterW
PdhOpenLogW
PdhCalculateCounterFromRawValue
PdhEnumMachinesW
PdhAdd009CounterW
PdhGetRawCounterArrayW
PdhTranslate009CounterA
PdhVbOpenQuery

ufat

??1ROOTDIR@@UAE@XZ
?AllocChain@FAT@@QAEKKPAK@Z
?QueryNthCluster@FAT@@QBEKKK@Z
??0FILEDIR@@QAE@XZ
??0EA_HEADER@@QAE@XZ
?QueryName@FAT_DIRENT@@QBEEPAVWSTRING@@@Z
?Initialize@CLUSTER_CHAIN@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@PAVFAT_SA@@PBVFAT@@KK@Z
?Set12@FAT@@AAEXKK@Z
Chkdsk
?Initialize@ROOTDIR@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@KJ@Z
?InitFATChkDirty@REAL_FAT_SA@@QAEEPAVLOG_IO_DP_DRIVE@@PAVMESSAGE@@@Z
?GetEa@EA_SET@@QAEPAU_EA@@KPAJPAE@Z
?Read@CLUSTER_CHAIN@@UAEEXZ
?QueryEaSetClusterNumber@EA_HEADER@@QBEGG@Z
?QueryLongName@FATDIR@@QAEEJPAVWSTRING@@@Z
?Read@EA_SET@@UAEEXZ
?QueryAllocatedClusters@FAT@@QBEKXZ
?QueryLastAccessTime@FAT_DIRENT@@QBEEPAT_LARGE_INTEGER@@@Z
?QueryLengthOfChain@FAT@@QBEKKPAK@Z
?Initialize@EA_SET@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@PAVFAT_SA@@PBVFAT@@KK@Z
?SearchForDirEntry@FATDIR@@QAEPAXPBVWSTRING@@@Z
?FreeChain@FAT@@QAEXK@Z
?QueryCensusAndRelocate@FAT_SA@@QAEEPAU_CENSUS_REPORT@@PAVINTSTACK@@PAE@Z
??1REAL_FAT_SA@@UAE@XZ
??0CLUSTER_CHAIN@@QAE@XZ
ChkdskEx
??1FAT_SA@@UAE@XZ
?Write@CLUSTER_CHAIN@@UAEEXZ
?QueryFreeSectors@REAL_FAT_SA@@QBEKXZ
??1EA_SET@@UAE@XZ
Format
?QueryLastWriteTime@FAT_DIRENT@@QBEEPAT_LARGE_INTEGER@@@Z
?Initialize@EA_HEADER@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@PAVFAT_SA@@PBVFAT@@KK@Z
?Read@REAL_FAT_SA@@UAEEPAVMESSAGE@@@Z
?Initialize@REAL_FAT_SA@@UAEEPAVLOG_IO_DP_DRIVE@@PAVMESSAGE@@E@Z
?IsValidCreationTime@FAT_DIRENT@@QBEEXZ
??0FAT_SA@@QAE@XZ
??1FAT_DIRENT@@UAE@XZ
?IsValidLastAccessTime@FAT_DIRENT@@QBEEXZ
?Index12@FAT@@ABEKK@Z
FormatEx
??0EA_SET@@QAE@XZ

Sections

.text
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 195KB - Virtual size: 656KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b9f9902c2d23d5c1bc5982d29c37582a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

secur32

opengl32

mpr

pdh

ufat

Sections

.text Size: 98KB - Virtual size: 98KB

.rdata Size: 76KB - Virtual size: 76KB

.data Size: 195KB - Virtual size: 656KB

.rsrc Size: 17KB - Virtual size: 17KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 98KB - Virtual size: 98KB

.rdata
Size: 76KB - Virtual size: 76KB

.data
Size: 195KB - Virtual size: 656KB

.rsrc
Size: 17KB - Virtual size: 17KB

.reloc
Size: 1024B - Virtual size: 1024B