59f5df46bfc2c12add6aa43dcd8b3ed4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

59f5df46bfc2c12add6aa43dcd8b3ed4_JaffaCakes118
Size

328KB
MD5

59f5df46bfc2c12add6aa43dcd8b3ed4
SHA1

7dd8a370411e6d4db48c46e3be879e4348b1c6cc
SHA256

c72923424db45bb7c26d61b8f35712f74e51265691e106b2f0436fe2fbb0ec82
SHA512

47e6ca2caf178f0750d154b08c34d3b825ce66015459a2fc197962f23c8fb85142f9a9105644acd77bcff9bc4408f941b507f21e4b1dbf6122e0731915d8d03f
SSDEEP

6144:KPX6v1rY+jNgM7uiV0b2y829hvjcBGpTOiT9ejcb3:lvBY+jNg7pb2y86hvjcBGpTOFYr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
59f5df46bfc2c12add6aa43dcd8b3ed4_JaffaCakes118

Files

59f5df46bfc2c12add6aa43dcd8b3ed4_JaffaCakes118
.exe windows:5 windows x86 arch:x86

718f302fb8fbc74ba0706f288e1087bb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\build\source\rnadmin\rel32s\realsched.pdb

Imports

ole32

CreateClassMoniker
CoRevokeClassObject
CoRegisterClassObject
CoInitializeEx
GetRunningObjectTable
CoUninitialize

version

GetFileVersionInfoA
VerQueryValueA

kernel32

ResetEvent
WaitForSingleObject
GetVersionExA
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
SetEvent
OpenEventA
TerminateThread
SuspendThread
ResumeThread
FormatMessageA
WaitForMultipleObjects
LocalFree
LocalUnlock
LocalLock
LocalAlloc
Sleep
CreateThread
RaiseException
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
FindCloseChangeNotification
FindFirstChangeNotificationA
GetExitCodeThread
LoadLibraryW
ReleaseMutex
CreateMutexA
WideCharToMultiByte
lstrlenW
GetDriveTypeA
MultiByteToWideChar
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
CreateMutexW
SetLastError
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleExA
GetSystemInfo
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
CreateFileA
GetTempFileNameA
GetTempPathA
GetVersion
GetModuleFileNameA
FindClose
GetDiskFreeSpaceA
GetWindowsDirectoryA
FindNextChangeNotification
FindNextFileA
RemoveDirectoryA
DeleteFileA
GetFileAttributesA
CreateDirectoryA
MoveFileA
GetTickCount
SetCurrentDirectoryA
GetCurrentDirectoryA
IsBadWritePtr
VirtualProtect
IsBadReadPtr
GetModuleHandleA
SetUnhandledExceptionFilter
SetProcessWorkingSetSize
GetCurrentProcess
WriteFile
GetThreadContext
VirtualQuery
GetCurrentProcessId
OpenProcess
SetFilePointer
GlobalMemoryStatus
DeviceIoControl
CreateFileW
SetEnvironmentVariableA
GetEnvironmentVariableA
LCMapStringW
LCMapStringA
ReadFile
GetFullPathNameA
GetConsoleMode
GetConsoleCP
SetStdHandle
GetStringTypeW
GetStringTypeA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
SetHandleCount
GetTimeZoneInformation
GetStdHandle
VirtualAlloc
VirtualFree
HeapDestroy
HeapCreate
ExitProcess
HeapSize
TlsFree
TlsSetValue
LoadLibraryA
GetProcAddress
FreeLibrary
CreateEventA
GetLastError
CloseHandle
CreateProcessA
SetErrorMode
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
FindFirstFileA
SetEnvironmentVariableW
TlsAlloc
TlsGetValue
GetModuleHandleW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
SetFileAttributesA
GetProcessHeap
SetEndOfFile
GetFileType
PeekNamedPipe
GetFileInformationByHandle
HeapReAlloc
RtlUnwind
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
GetCommandLineA
GetDateFormatA
GetTimeFormatA
GetSystemTimeAsFileTime
ExitThread
HeapAlloc
HeapFree

user32

CharPrevA
CharNextA
RegisterWindowMessageA
ReleaseDC
GetClassInfoExA
UnregisterClassA
SetWindowsHookExA
GetMessageA
TranslateMessage
DispatchMessageA
GetClassInfoA
RegisterClassA
GetSystemMetrics
CreateWindowExA
DefWindowProcA
PostQuitMessage
SetTimer
KillTimer
DestroyWindow
PostThreadMessageA
FindWindowA
PostMessageA
IsWindow
SendMessageA
GetDC
RegisterClassExA
UnhookWindowsHookEx

advapi32

RegDeleteValueA
FreeSid
RegEnumKeyA
RegCreateKeyA
RegSetValueA
RegQueryValueA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegEnumKeyExA
RegNotifyChangeKeyValue
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegCloseKey

gdi32

GetDeviceCaps

shell32

SHGetFolderPathW
SHGetFolderPathA

shlwapi

PathGetDriveNumberW
PathAppendA
PathAddBackslashA
PathAppendW

setupapi

SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiDeleteDeviceInfo
SetupDiDestroyDeviceInfoList
CM_Get_Parent
CM_Get_Device_ID_Size
CM_Get_Device_IDW
SetupDiGetDeviceInstanceIdW

Sections

.text
Size: 207KB - Virtual size: 206KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 9KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.drdata
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

718f302fb8fbc74ba0706f288e1087bb

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ole32

version

kernel32

user32

advapi32

gdi32

shell32

shlwapi

setupapi

Sections

.text Size: 207KB - Virtual size: 206KB

.rdata Size: 43KB - Virtual size: 43KB

.data Size: 9KB - Virtual size: 20KB

.rsrc Size: 1KB - Virtual size: 1KB

.drdata Size: 60KB - Virtual size: 60KB

.text
Size: 207KB - Virtual size: 206KB

.rdata
Size: 43KB - Virtual size: 43KB

.data
Size: 9KB - Virtual size: 20KB

.rsrc
Size: 1KB - Virtual size: 1KB

.drdata
Size: 60KB - Virtual size: 60KB