4c287c0fd2679ae00a671284505e26e4_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

4c287c0fd2679ae00a671284505e26e4_JaffaCakes118
Size

366KB
MD5

4c287c0fd2679ae00a671284505e26e4
SHA1

5ccb1ed524d33154210711bd2a22661fbded74a8
SHA256

c7693ca7a6ca826bf211d5e56c88798a44cd342c951c996a2820164a42f45af1
SHA512

9c170e496d7f36356f65b05c82fb8baef4a9d97bbebbbadaaad2e7bdb51de1b884fef21f5f97d51f6db0c12049d84bdf656e63de1618bb8db10374c5232280a5
SSDEEP

6144:EYKNkMVa6TVQv9mZwMRAhy+AVYQ0LvJwGS3wUnLpSpYkL72Q0kBY5S:eFVa6CITNgY4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c287c0fd2679ae00a671284505e26e4_JaffaCakes118

Files

4c287c0fd2679ae00a671284505e26e4_JaffaCakes118
.exe windows:5 windows x86 arch:x86

d2920edb09c5264690c3d6c022714e1c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
StrCmpNIW
StrToIntW
StrCmpIW
PathGetArgsW
SHDeleteValueW
SHGetValueW
StrCpyNW
PathAppendW
ChrCmpIW

advapi32

SetSecurityDescriptorDacl
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
DeregisterEventSource
RegisterEventSourceW
RegQueryValueExW
FreeSid
SetFileSecurityW
RegOpenKeyExA
InitializeSecurityDescriptor
CloseServiceHandle
OpenServiceW
OpenSCManagerW
QueryServiceConfigW
QueryServiceStatus
LsaClose
LsaOpenPolicy
LsaQueryInformationPolicy
ReportEventW
RegQueryValueExA

kernel32

GetFileSize
CreateFileW
CreateProcessW
WriteFile
GetSystemDirectoryW
GetCommandLineW
GetTimeFormatW
GetDateFormatW
GetLocalTime
GetLocaleInfoW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDiskFreeSpaceExW
GetVersionExW
FormatMessageW
CreateEventW
ResetEvent
SetEvent
WaitForSingleObject
CreateFileMappingW
MapViewOfFile
ExpandEnvironmentStringsW
GetFileAttributesW
UnmapViewOfFile
CloseHandle
ReadFile
GetCurrentProcess
FlushInstructionCache
GetCurrentThreadId
lstrcpynW
GlobalAlloc
GlobalLock
GlobalUnlock
EnterCriticalSection
GetStartupInfoW
GetModuleHandleA
RemoveDirectoryW
GetComputerNameW
GetVolumeNameForVolumeMountPointW
FindFirstFileW
FindNextFileW
FindClose
SetLastError
lstrcmpW
DeleteFileW
SetFileAttributesW
LeaveCriticalSection
GetShortPathNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
lstrlenA
GetWindowsDirectoryW
GetLastError
LoadLibraryW
GetProcAddress
FreeLibrary
HeapCreate
GetSystemInfo
GetModuleFileNameW
lstrcatW
HeapDestroy
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
GetSystemTimeAsFileTime
MultiByteToWideChar
lstrlenW
lstrcpyW

gdi32

CloseMetaFile
CreateRectRgnIndirect
CreateMetaFileW
SetWindowExtEx
DeleteMetaFile
CreateDCW
GetDeviceCaps
LPtoDP
SaveDC
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
DeleteDC
RestoreDC

user32

CharNextW
DestroyWindow
DefWindowProcW
ReleaseDC
GetDC
PtInRect
UnionRect
SetWindowLongW
GetWindowLongW
CallWindowProcW
IsWindow
GetKeyState
DestroyAcceleratorTable
InvalidateRect
EndPaint
GetClientRect
BeginPaint
IsChild
GetFocus
SetFocus
ShowWindow
GetParent
wsprintfW
LoadCursorW
GetClassInfoExW
CreateWindowExW
SetWindowPos
SendMessageW
MapWindowPoints
SystemParametersInfoW
GetWindowRect
GetWindow
LoadStringW
GetDesktopWindow
AdjustWindowRectEx
GetSystemMetrics
LoadImageW
MessageBoxW
ExitWindowsEx
SetForegroundWindow
FindWindowW
SetCursor
SetWindowRgn
OffsetRect
EqualRect
IntersectRect
wvsprintfW
RegisterClassExW

srrstr

ord5
ord2
ord10
ord3
ord6

srclient

DisableSR
SRRemoveRestorePoint
SRSetRestorePointW
EnableFIFO
DisableFIFO
EnableSR

ole32

OleSaveToStream
WriteClassStm
OleLoadFromStream
CreateDataAdviseHolder
OleRegGetMiscStatus
CreateOleAdviseHolder
OleRegGetUserType
OleRegEnumVerbs
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoRegisterClassObject
CoRevokeClassObject

oleaut32

SysStringByteLen
OleCreatePropertyFrame
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantInit
DispCallFunc
VariantChangeType
VariantClear
SysStringLen
LoadRegTypeLi
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysAllocStringByteLen
SysFreeString
SysAllocString

msvcrt

_ftol
wcscmp
wcsstr
wcschr
_wtoi
strtol
realloc
wcsncmp
_wtol
_c_exit
_exit
__CxxFrameHandler
free
malloc
??2@YAPAXI@Z
_purecall
_wcsnicmp
_except_handler3
_XcptFilter
_cexit
_controlfp
??3@YAXPAX@Z
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit

winsta

WinStationCloseServer
WinStationIsHelpAssistantSession
WinStationEnumerateW
WinStationOpenServerW
WinStationFreeMemory

Exports

Exports

??0CCounter@@QAE@XZ
??1CCounter@@QAE@XZ
??4CCounter@@QAEAAV0@ABV0@@Z
?Down@CCounter@@QAEKXZ
?GetCount@CCounter@@QAEJXZ
?Init@CCounter@@QAEKXZ
?Up@CCounter@@QAEXXZ
?WaitForZero@CCounter@@QAEKXZ

Sections

.text
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 262KB - Virtual size: 282KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d2920edb09c5264690c3d6c022714e1c

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

advapi32

kernel32

gdi32

user32

srrstr

srclient

ole32

oleaut32

msvcrt

winsta

Exports

Exports

Sections

.text Size: 94KB - Virtual size: 94KB

.data Size: 8KB - Virtual size: 14KB

.rsrc Size: 262KB - Virtual size: 282KB

.text
Size: 94KB - Virtual size: 94KB

.data
Size: 8KB - Virtual size: 14KB

.rsrc
Size: 262KB - Virtual size: 282KB