4aa45371b5f0aad77187ba6678b6e17c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4aa45371b5f0aad77187ba6678b6e17c_JaffaCakes118
Size

22KB
MD5

4aa45371b5f0aad77187ba6678b6e17c
SHA1

36c1752861d9e871af97106b7c2d74f3834ad03c
SHA256

d8f0756c7218f55fc49aca1aa15d80f3b29a0f9d09faa95bb378509784e0002e
SHA512

a82e66dc607726e7df25c9b040deabf275e3d0f6739984bc9f65cdfbc7c5ce9bc6d39c3aaa52b8cd2cd25f7b377c592320060b47bc58d0ed844652f75f99ea0f
SSDEEP

384:BYypWVRxDPW/zqJlDYG4MylA71xmEJR1AGE4gcIzsUdTdaKT5GOB:BHpKRxDyHG6lUxmEJfF0zsUdTdaiB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4aa45371b5f0aad77187ba6678b6e17c_JaffaCakes118

Files

4aa45371b5f0aad77187ba6678b6e17c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

8cd82838f49399414ed35d1c910a02ec

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\build\PO_REL_4_100_15_5\win_external_wl\src\wl\cpl\wltrysvc\Release\hp\wltrysvc.pdb

Imports

wtsapi32

WTSEnumerateSessionsA
WTSFreeMemory

kernel32

GetTickCount
QueryPerformanceCounter
ExitProcess
GetCurrentThreadId
GetSystemTimeAsFileTime
GetLastError
CreateEventA
WaitForMultipleObjects
OutputDebugStringA
CreateToolhelp32Snapshot
Process32First
Process32Next
ProcessIdToSessionId
lstrcpyA
GetCurrentProcessId
WaitForSingleObject
OpenProcess
GetCurrentThread
GetCurrentProcess
CloseHandle
TerminateProcess
lstrcatA
SetErrorMode
CreateProcessA
SetEvent
SetConsoleCtrlHandler
GetVersionExA
GetModuleHandleA
GetProcAddress
Sleep
GetModuleFileNameA
AllocConsole
GetStdHandle
GlobalAlloc
GlobalFree
FormatMessageA
LocalFree

user32

RegisterWindowMessageA
BroadcastSystemMessageA
RegisterClassA
CreateWindowExA
DefWindowProcA
DestroyWindow

advapi32

ControlService
RegCreateKeyExA
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
LsaStorePrivateData
LsaOpenPolicy
LsaAddAccountRights
LsaClose
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
StartServiceA
RegDeleteValueA
OpenServiceA
QueryServiceStatus
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
ChangeServiceConfig2A
RegDeleteKeyA
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
SetServiceStatus
GetUserNameA
IsValidSid
GetLengthSid
CopySid
LookupAccountNameA

msvcr71

__dllonexit
_onexit
_strdup
_controlfp
_strlwr
malloc
fprintf
_iob
_purecall
??_U@YAPAXI@Z
??_V@YAXPAX@Z
_mbscmp
_mbslen
_fdopen
_open_osfhandle
setvbuf
free
wcslen
mbstowcs
wcscat
wcscpy
_mbsrchr
strstr
_mbsicmp
sprintf
__CxxFrameHandler
??3@YAXPAX@Z
__security_error_handler
_except_handler3
_c_exit
_exit
_XcptFilter
_cexit
exit
__p___initenv
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8cd82838f49399414ed35d1c910a02ec

Headers

File Characteristics

PDB Paths

Imports

wtsapi32

kernel32

user32

advapi32

msvcr71

Sections

.text Size: 12KB - Virtual size: 12KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 104B

.rsrc Size: 2KB - Virtual size: 2KB

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 104B

.rsrc
Size: 2KB - Virtual size: 2KB