5d9be95d171f2c6d185279f585142379_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

5d9be95d171f2c6d185279f585142379_JaffaCakes118
Size

869KB
MD5

5d9be95d171f2c6d185279f585142379
SHA1

99c321d0c46509e450bc8e26f80d87860a4a8b38
SHA256

b60d4a705250437d51ba9ad80d719ab6b05df5bacba952874ac09ef3513641bd
SHA512

bc2ea60814ce8f34161021559d3b5e4858594fd048fae02eb1c7e76ae98053f399008d3e4ee7441a2324bcc88806bc4f1d0d3abfeb6c8d55d86443e14f1dce65
SSDEEP

24576:gsAnARApLoZuTTZ4gabyhhXV17aGjfGddT2t0U:gnA2poZuHZIEHljf0dSb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d9be95d171f2c6d185279f585142379_JaffaCakes118

Files

5d9be95d171f2c6d185279f585142379_JaffaCakes118
.exe windows:5 windows x86 arch:x86

34162d2cd2470f42b1c1d2aa49f33960

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateJobObjectA
GetCurrentConsoleFont
VirtualFree
GetVolumePathNameA
EraseTape
QueryPerformanceCounter
TlsGetValue
SetConsoleCP
GetTempFileNameW
OpenProcess
GetNamedPipeHandleStateA
SetComputerNameExA
RemoveDirectoryW
SetConsoleCursorMode
GetModuleHandleW
BaseFlushAppcompatCache
Heap32First
VirtualQueryEx
DeleteCriticalSection
GetConsoleScreenBufferInfo
IsValidLocale
_hread
GetConsoleAliasA
BuildCommDCBAndTimeoutsW
SetProcessWorkingSetSize
WriteFileEx
GetFileAttributesExA
VirtualAlloc
AddConsoleAliasA
GetHandleInformation
GetLocaleInfoA
FillConsoleOutputCharacterW
FindNextChangeNotification
GetDriveTypeA
UpdateResourceW
GetEnvironmentStrings
GetStartupInfoW
SetCalendarInfoA
FreeUserPhysicalPages
InitializeSListHead
LoadLibraryA
CreateActCtxW
SystemTimeToFileTime
WriteFileGather
MoveFileExW
QueueUserWorkItem
SetConsoleCursorPosition
GetConsoleAliasesLengthW
OpenThread
RegisterConsoleVDM
SetComputerNameExW
GlobalFindAtomW
ReadConsoleA
SetThreadLocale
GetPrivateProfileSectionA
FindActCtxSectionGuid
SignalObjectAndWait
OutputDebugStringA
GetConsoleAliasExesLengthA
GetTickCount
IsDebuggerPresent
SetMessageWaitingIndicator
GetExitCodeProcess
GlobalReAlloc
CommConfigDialogW
GetSystemDirectoryA
UnregisterWait
GetConsoleKeyboardLayoutNameA
DebugSetProcessKillOnExit
lstrcpynA
LZOpenFileA
EnumDateFormatsA
LocalAlloc
GetNativeSystemInfo
CreateSemaphoreA
EnumResourceLanguagesW
EnumResourceNamesW
SetTermsrvAppInstallMode
SearchPathW
GetThreadPriority
SleepEx

polstore

IPSecFreePolStr
IPSecSetPolicyData
IPSecCopyNFAData
IPSecEnumNegPolData
IPSecFreePolicyData
IPSecCopyPolicyData
IPSecOpenPolicyStore
IPSecFreeNegPolData
IPSecEnumNFAData
IPSecGetAssignedPolicyData
IPSecFreeNFAData
IPSecCreateNFAData
IPSecFreeMulNFAData
IPSecCreateFilterData
IPSecAllocPolStr
IPSecFreeISAKMPData
IPSecSetNegPolData
IPSecCopyISAKMPData
IPSecCreateNegPolData
IPSecUnassignPolicy
IPSecEnumPolicyData
IPSecEnumISAKMPData
IPSecCreatePolicyData
IPSecCopyNegPolData
IPSecCopyFilterData
IPSecEnumFilterData
IPSecCopyFilterSpec
IPSecDeletePolicyData
IPSecGetNegPolData
IPSecExportPolicies
IPSecDeleteNegPolData
IPSecGetFilterData
IPSecGetISAKMPData
IPSecIsDomainPolicyAssigned
IPSecDeleteISAKMPData
IPSecAllocPolMem

sqlunirl

_DefDlgProc_@16
_NDdeTrustedShareEnum_@24
_GetModuleFileName@12
_CharNext_@4
_GetClassName_@12
_GetTextFace_@12
_FormatMessage@28
_ExtTextOut@32
_OpenWindowStation_@12
_RegOpenKey_@12
_LookupPrivilegeName_@16
_PrintDlg_@4
_VkKeyScan_@4
_lstrcpy_@8
_GetEnvironmentVariable_@12
_GetWindowText@12
_SetFileAttributes_@8
_RegRestoreKey_@12
_LoadCursor@8
_GetComputerName@8
_ReplaceText_@4
_CopyEnhMetaFile_@8
_OpenBackupEventLog_@8
_DlgDirSelectEx_@16
_RegSetValueEx_@24
_DialogBoxParam_@20
_GetDiskFreeSpaceEx@16
_GetUnicodeRedirectionLayer@0
_CreateFileMapping_@24
_MAKEINTRESOURCE@4
_DeleteFile@4
_SetWindowsHook_@8
_CreateProcessAsUser_@44
_GetAtomName_@12
_GlobalAddAtom_@4
_CreateFile@28
_GetWindowsDirectory_@8
__lopen_@8

msvcrt40

_mbsncmp
?doallocate@strstreambuf@@MAEHXZ
_get_osfhandle
??_Dstdiostream@@QAEXXZ
?width@ios@@QAEHH@Z
_wgetdcwd
_wfreopen
_cabs
__p__pgmptr
??4stdiostream@@QAEAAV0@AAV0@@Z
_strcmpi
__pxcptinfoptrs
_getche
__wgetmainargs
realloc
fclose
?ebuf@streambuf@@IBEPADXZ
??_7istrstream@@6B@
??_Eistrstream@@UAEPAXI@Z
_wspawnv
putchar
?init@ios@@IAEXPAVstreambuf@@@Z
_mbsncpy
mbtowc
??0ifstream@@QAE@XZ
system
?xsputn@streambuf@@UAEHPBDH@Z
printf
??5istream@@QAEAAV0@AAN@Z
__threadid
_findfirsti64
strtol
?setbuf@strstreambuf@@UAEPAVstreambuf@@PADH@Z
_yn
??_Dstrstream@@QAEXXZ
??5istream@@QAEAAV0@AAF@Z
_vsnprintf
gets
??6ostream@@QAEAAV0@PBD@Z
_ismbbalpha
??5istream@@QAEAAV0@AAG@Z
__p__pctype
_access
??4filebuf@@QAEAAV0@ABV0@@Z
_beginthreadex
??5istream@@QAEAAV0@AAH@Z
_safe_fprem1
_ismbcpunct
_mbctombb
?rdbuf@fstream@@QBEPAVfilebuf@@XZ
_atoldbl
_mbclen
_purecall
??0ofstream@@QAE@PBDHH@Z
??4istream_withassign@@QAEAAVistream@@ABV1@@Z
??1filebuf@@UAE@XZ
_ismbblead
?ws@@YAAAVistream@@AAV1@@Z
??4bad_cast@@QAEAAV0@ABV0@@Z
??4ostream_withassign@@QAEAAV0@ABV0@@Z

crtdll

_tzname
strspn
fwrite
_cexit
_mbsncmp
_expand
ldiv
difftime
_ismbstrail
_CIlog10
_mbsnbset
_open
memcmp
_endthread
wcscmp
_memicmp
_read
_execvp
_execv
iswxdigit
qsort
_locking
_y0
_getcwd
_vsnwprintf
_write
_unloaddll
_msize
_hypot
_snwprintf
_wcsicmp
fgetc
__argv_dll

Sections

.text
Size: 165KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 327KB - Virtual size: 327KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 372KB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

34162d2cd2470f42b1c1d2aa49f33960

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

polstore

sqlunirl

msvcrt40

crtdll

Sections

.text Size: 165KB - Virtual size: 165KB

.rdata Size: 327KB - Virtual size: 327KB

.data Size: 372KB - Virtual size: 1.8MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 165KB - Virtual size: 165KB

.rdata
Size: 327KB - Virtual size: 327KB

.data
Size: 372KB - Virtual size: 1.8MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB