63e224486e974a90f76f158f9186dff0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

63e224486e974a90f76f158f9186dff0_JaffaCakes118
Size

144KB
MD5

63e224486e974a90f76f158f9186dff0
SHA1

b3bfe496d893036d7460612e44370a64a4ef8552
SHA256

63889889051a370e70184162c7774bdfd587842af5536e70e0e41a07ed41f199
SHA512

d7faba88f0da705aadc45c5fa75761244cb5dc130f2ad5d8d427a59b6c4ae4787591057cd6443ce10411973fc05fc6eccc3894cf4ef89b91d6223bef327c54be
SSDEEP

3072:NtO98HWCMNYaXcpDYc+Ij3h6CEPQSKpipEDSa0iPnslWMf589OCB8n1:q98HWCMNDcpDNDh6VTORb0qhMmOCB8n1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
63e224486e974a90f76f158f9186dff0_JaffaCakes118

Files

63e224486e974a90f76f158f9186dff0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c26b4a03e224e1d8172b9f5936fad20b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceEvent
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
RegCloseKey
RegQueryValueExW
StartServiceW
OpenServiceW
RegOpenKeyExW
CreateServiceW
CloseServiceHandle
OpenSCManagerW
GetLengthSid
CopySid
FreeSid
AllocateAndInitializeSid
CreateWellKnownSid
SetThreadToken
RevertToSelf
IsWellKnownSid
OpenThreadToken
DeregisterEventSource
ReportEventW
RegisterEventSourceW
MapGenericMask
GetAce
GetSecurityDescriptorDacl
OpenProcessToken
RegDeleteKeyW
GetTokenInformation
RegEnumKeyExW
RegSetValueExW
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteValueW
RegEnumValueW
RegCreateKeyExW
LogonUserW
QueryServiceStatus
CredFree
CredWriteW
CredReadW
CredDeleteW
RegConnectRegistryW

kernel32

UnregisterWaitEx
GetLastError
SetLastError
LocalFree
LocalAlloc
GetVersionExW
HeapSetInformation
CreateEventW
RegisterWaitForSingleObject
InterlockedExchange
ExpandEnvironmentStringsW
GetFullPathNameW
CreateFileW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetComputerNameExW
CompareStringW
WideCharToMultiByte
GetCurrentThread
CloseHandle
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
FormatMessageW
EnumUILanguagesW
GetLocaleInfoW
FreeLibrary
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
OutputDebugStringA
InterlockedCompareExchange
Sleep
VirtualAlloc

msvcrt

wcstoul
_purecall
wcsncmp
_wtoi64
wcschr
_scwprintf
_wtoi
_CxxThrowException
iswalnum
_ultow
_onexit
_lock
__dllonexit
_unlock
_controlfp
?terminate@@YAXXZ
memmove
memset
__set_app_type
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_vsnwprintf
iswspace
_wcsnicmp
_exit
_cexit
__wgetmainargs
_errno
__CxxFrameHandler
_iob
fwprintf
_wcsicmp
wcsstr
memcpy
_itow

ntdll

RtlUnwind

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx

oleaut32

VarCmp
VariantClear
SysAllocString
SysFreeString
SysStringLen
VariantInit

crypt32

CryptAcquireCertificatePrivateKey
CryptDecodeObjectEx
CertFindExtension
CertFreeCertificateContext
CertFreeCertificateChain
CertGetEnhancedKeyUsage
CryptBinaryToStringW
CertCloseStore
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertGetCertificateContextProperty
CertFindCertificateInStore
CertOpenStore
CertGetNameStringW
CryptStringToBinaryW

netapi32

NetApiBufferFree
NetGetJoinInformation

rpcrt4

UuidCreate

userenv

RegisterGPNotification
UnregisterGPNotification
LeaveCriticalPolicySection
EnterCriticalPolicySection

ws2_32

WSACleanup
WSAStartup
getnameinfo
freeaddrinfo
getaddrinfo

iphlpapi

GetAdaptersAddresses

gdi32

CreateBitmap

user32

CreateDialogParamA

cfgmgr32

CM_Set_HW_Prof_FlagsW
CM_Get_Device_Interface_ListW
CM_Get_Child
CM_Add_ID_ExW
CM_Get_Device_Interface_ListA
CM_Uninstall_DevNode
CM_Unregister_Device_Interface_ExA
CM_Free_Res_Des_Ex
CM_Delete_DevNode_Key
CMP_UnregisterNotification
CM_Get_Class_NameW
CM_Get_Device_Interface_List_ExW
CM_Add_Empty_Log_Conf
CM_Get_Hardware_Profile_InfoW
CM_Connect_MachineW
CM_Register_Device_Driver
CM_Create_DevNodeA

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SQAJKx
Size: 3KB - Virtual size: 41KB

IMAGE_SCN_MEM_READ

.rsrc
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c26b4a03e224e1d8172b9f5936fad20b

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

ole32

oleaut32

crypt32

netapi32

rpcrt4

userenv

ws2_32

iphlpapi

gdi32

user32

cfgmgr32

Sections

.text Size: 16KB - Virtual size: 16KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 9KB - Virtual size: 268KB

.SQAJKx Size: 3KB - Virtual size: 41KB

.rsrc Size: 106KB - Virtual size: 106KB

.text
Size: 16KB - Virtual size: 16KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 9KB - Virtual size: 268KB

.SQAJKx
Size: 3KB - Virtual size: 41KB

.rsrc
Size: 106KB - Virtual size: 106KB