4e060083718c1cc9c7d5f46136e3014b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4e060083718c1cc9c7d5f46136e3014b_JaffaCakes118
Size

14.2MB
MD5

4e060083718c1cc9c7d5f46136e3014b
SHA1

ef382abda7e937e3cc6c271bf0a09717ebac1e76
SHA256

371c035f0d274dcc46a61f00d394ec16178e21ea308205966f29e5d6bc40a634
SHA512

a43b07c8562de04c829a6aaf2660ee56a8b8332d57889f977c3cca9f9dea686bbe450e4a8568ddc1ffdfaed5e2ad518fa0a5012b95c764bc0939e9c82eb88065
SSDEEP

393216:E9OUbrAjA1cfL9jXcx+no0XPGSxG7VKfSM70gKwNf3fRcNFs:E7T1cxjMx+no0U5KfSO0gJ/fRMs

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/miniZ.exe
unpack001/miniZ_gui.exe

Files

4e060083718c1cc9c7d5f46136e3014b_JaffaCakes118
.zip
miniZ.exe
.exe windows:6 windows x64 arch:x64

4a477f26b8e826f6f7a0882e661dca5d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

wsock32

WSACleanup
WSAGetLastError
WSASetLastError
closesocket
gethostname
listen
htonl
bind
accept
gethostbyname
socket
setsockopt
send
recv
htons
connect
WSAStartup

crypt32

CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetCertificateContextProperty

advapi32

CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource

kernel32

ChangeTimerQueueTimer
CreateTimerQueueTimer
SignalObjectAndWait
CreateTimerQueue
InitializeSListHead
IsDebuggerPresent
DeleteTimerQueueTimer
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LCMapStringW
CompareStringW
GetCPInfo
CreateEventW
InitializeCriticalSectionAndSpinCount
DecodePointer
EncodePointer
GetNumaHighestNodeNumber
RtlPcToFileHeader
RegisterWaitForSingleObject
UnregisterWait
ExpandEnvironmentStringsA
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetTickCount
ReleaseSemaphore
GetModuleHandleA
GetProcAddress
CreateEventA
OpenEventA
SetEvent
ResetEvent
GetCurrentThreadId
Sleep
GetCurrentProcessId
WaitForSingleObjectEx
CloseHandle
GetProcessHeap
HeapAlloc
HeapFree
GetLastError
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLogicalProcessorInformation
LocalFree
FormatMessageA
OpenProcess
GetVersionExA
FreeLibrary
LoadLibraryA
RaiseException
SetUnhandledExceptionFilter
WaitForSingleObject
GetCurrentProcess
CreateThread
GetModuleFileNameW
MultiByteToWideChar
GetEnvironmentVariableA
SetEnvironmentVariableA
SetErrorMode
LoadLibraryExW
SetLastError
GetSystemTime
GetStdHandle
GetFileType
WriteFile
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
FindClose
FindFirstFileW
FindNextFileW
WideCharToMultiByte
ConvertFiberToThread
ConvertThreadToFiber
QueryPerformanceCounter
GlobalMemoryStatus
GetEnvironmentVariableW
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
DuplicateHandle
GetCurrentThread
SetThreadPriority
GetThreadPriority
GetThreadContext
SetThreadContext
GetSystemDirectoryA
GetProcessAffinityMask
WaitForMultipleObjects
CreateSemaphoreA
QueryPerformanceFrequency
HeapCreate
HeapDestroy
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
SwitchToThread
GetNativeSystemInfo
VirtualAlloc
VirtualFree
VirtualProtect
FreeLibraryAndExitThread
SetThreadAffinityMask
VerSetConditionMask
GetFileAttributesW
GetFullPathNameW
GetSystemDirectoryW
LocalAlloc
VerifyVersionInfoW
GetThreadTimes
GetVersionExW
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
GetExitCodeThread

user32

GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW

vcruntime140

strstr
__RTDynamicCast
strchr
memcmp
__std_type_info_compare
__C_specific_handler
wcsstr
strrchr
longjmp
wcsrchr
__uncaught_exception
__uncaught_exceptions
__vcrt_InitializeCriticalSectionEx
__intrinsic_setjmp
__std_exception_copy
__current_exception
__std_terminate
_purecall
__processing_throw
__AdjustPointer
memchr
memset
memcpy
__CxxFrameHandler3
_CxxThrowException
__std_exception_destroy
memmove

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
_beginthreadex
_initterm_e
_initterm
_get_initial_narrow_environment
terminate
_set_app_type
_seh_filter_exe
_cexit
exit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
abort
_configure_narrow_argv
_invalid_parameter_noinfo
_errno
system
_endthreadex
perror
raise
_crt_atexit
signal
strerror
_exit
strerror_s
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-string-l1-1-0

_stricmp
_strnicmp
strncmp
strspn
_strdup
isalpha
__strncnt
isxdigit
strtok
strcspn
islower
_wcsdup
strncpy
_wcsupr
iswprint
_wcsnicmp
tolower
isspace
isdigit
_wcsicmp
toupper
_strupr
strncat_s
isupper
strcmp

api-ms-win-crt-heap-l1-1-0

malloc
_set_new_mode
_free_base
_callnewh
_calloc_base
_malloc_base
realloc
free
calloc

api-ms-win-crt-math-l1-1-0

exp
__setusermatherr
ldexp
frexp
powf
log10
sqrt
pow

api-ms-win-crt-stdio-l1-1-0

_fsopen
fgetc
fflush
fputc
__stdio_common_vswprintf
fsetpos
_get_stream_buffer_pointers
putc
__stdio_common_vsprintf_s
ungetc
feof
ferror
fputs
fopen
fclose
fgets
_fileno
fread
fseek
ftell
_setmode
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsscanf
_set_fmode
setvbuf
_wfopen
__stdio_common_vsprintf
fwrite
fgetpos
_fseeki64
__p__commode

api-ms-win-crt-locale-l1-1-0

_unlock_locales
__pctype_func
_configthreadlocale
___lc_locale_name_func
___lc_codepage_func
___mb_cur_max_func
setlocale
localeconv
_lock_locales
___lc_collate_cp_func

api-ms-win-crt-convert-l1-1-0

strtod
strtol
atof
strtof
atoi
strtoul

api-ms-win-crt-time-l1-1-0

_localtime64
_gmtime64
_time64
strftime
_ftime64_s
_Strftime
_Gettnames

api-ms-win-crt-utility-l1-1-0

srand
rand_s
rand
qsort
div

api-ms-win-crt-filesystem-l1-1-0

_stat64i32
_unlock_file
_lock_file

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-multibyte-l1-1-0

_ismbblead

Exports

Exports

NvOptimusEnablementCuda

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 887KB - Virtual size: 886KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 168KB - Virtual size: 499KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ctors
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dtors
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.nv_fatb
Size: 60.2MB - Virtual size: 60.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.nvFatBi
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
miniZ.exe.sha256sum
miniZ_gui.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 377KB - Virtual size: 377KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
miniZ_gui.exe.sha256sum

Sharing

General

Malware Config

Signatures

Files

4a477f26b8e826f6f7a0882e661dca5d

Headers

DLL Characteristics

File Characteristics

Imports

wsock32

crypt32

advapi32

kernel32

user32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

Exports

Exports

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 887KB - Virtual size: 886KB

.data Size: 168KB - Virtual size: 499KB

.pdata Size: 108KB - Virtual size: 108KB

.ctors Size: 512B - Virtual size: 8B

.dtors Size: 512B - Virtual size: 8B

.nv_fatb Size: 60.2MB - Virtual size: 60.2MB

.nvFatBi Size: 512B - Virtual size: 192B

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 26KB - Virtual size: 26KB

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 377KB - Virtual size: 377KB

.rsrc Size: 39KB - Virtual size: 38KB

.reloc Size: 512B - Virtual size: 12B

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 887KB - Virtual size: 886KB

.data
Size: 168KB - Virtual size: 499KB

.pdata
Size: 108KB - Virtual size: 108KB

.ctors
Size: 512B - Virtual size: 8B

.dtors
Size: 512B - Virtual size: 8B

.nv_fatb
Size: 60.2MB - Virtual size: 60.2MB

.nvFatBi
Size: 512B - Virtual size: 192B

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 26KB - Virtual size: 26KB

.text
Size: 377KB - Virtual size: 377KB

.rsrc
Size: 39KB - Virtual size: 38KB

.reloc
Size: 512B - Virtual size: 12B