6fd35b566d34740febaa0ceb97f83491_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

6fd35b566d34740febaa0ceb97f83491_JaffaCakes118
Size

862KB
MD5

6fd35b566d34740febaa0ceb97f83491
SHA1

0a4138a8f9c44cf5ad51960deade713a2e1fc31c
SHA256

2a858d831b9bdbddd0c920b940758470cb842d7a06d9552a600ee6393139b380
SHA512

9de1c00a4730bf75d7093c776fc5c2fcac11ec1c9381b35820739895556ae9c2531c30c07031279e02dd9b9fe39150acffd0637ef690545468636736b1e0178d
SSDEEP

24576:5vhvccrFzLD6O0Jm537V4d+HzPxLY3N5AxTc:51trt36OlV7VQaKITc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6fd35b566d34740febaa0ceb97f83491_JaffaCakes118

Files

6fd35b566d34740febaa0ceb97f83491_JaffaCakes118
.exe windows:5 windows x86 arch:x86

dcfc2e9ff26d24557d6936e0762edcc6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

difftime
_scwprintf
_wcstoi64
_cwprintf
_chdir
_mbsrchr
_findnexti64
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_CxxThrowException
_ftol
getwc
_wutime64
fwscanf
__crtGetLocaleInfoW
_CIacos
strspn
putwchar
_getmaxstdio
_Getdays
_pgmptr
_strdup
_wspawnvp
_logb
_jn
putwc
_wunlink
putc
_wctime64
_wfsopen
strncpy
log10
_adj_fdivr_m16i
isleadbyte
_strtoi64

user32

SendNotifyMessageA
WCSToMBEx
DrawStateW
CharUpperBuffA
SetWindowLongW
DdeConnect
ChangeDisplaySettingsW
RegisterUserApiHook
DdePostAdvise
GetWindowTextW
EnumDisplaySettingsW
AttachThreadInput
GetTopWindow
RegisterClassExW
IsCharUpperW
CliImmSetHotKey
SetUserObjectInformationW
SetMessageExtraInfo
SetWindowsHookExA
DdeQueryNextServer
EnumThreadWindows
ShowStartGlass
RealChildWindowFromPoint
GetPropA
CalcMenuBar
BroadcastSystemMessageW
TabbedTextOutA

kernel32

Module32FirstW
EnumSystemLanguageGroupsW
VerifyConsoleIoHandle
GlobalFree
SleepEx
GetModuleHandleExA
BaseCleanupAppcompatCacheSupport
WritePrivateProfileStructW
GetProcessWorkingSetSize
GetCalendarInfoW
FindFirstVolumeMountPointW
GetTapePosition
GetProcAddress
CreateJobObjectW
GlobalAlloc
CreateNamedPipeA
GetEnvironmentStringsA
GetCommTimeouts
GetFileAttributesW
CreateIoCompletionPort
GetProcessVersion
GetThreadTimes
GetDiskFreeSpaceW
GetProfileSectionW
GetCurrentThreadId
RemoveVectoredExceptionHandler
GetComputerNameA
GetProfileIntA
FileTimeToLocalFileTime
GetConsoleAliasExesLengthW
HeapCreate
BaseDumpAppcompatCache
GetStringTypeW
GetWindowsDirectoryW
GetVolumePathNameW
OpenWaitableTimerW
GlobalFlags
ConvertDefaultLocale
EnumTimeFormatsW
FindClose
PostQueuedCompletionStatus
lstrcatW
RegisterWowExec
FindResourceW
SetConsoleCtrlHandler
GetFileAttributesExW
BackupWrite
_llseek
BaseCheckAppcompatCache
InterlockedIncrement
DnsHostnameToComputerNameA
LoadModule
EnumSystemCodePagesW
FoldStringA
LockFile
LoadLibraryA
SetConsoleNumberOfCommandsW
GetConsoleKeyboardLayoutNameW
LocalLock
GetMailslotInfo
FindFirstChangeNotificationW
TerminateThread
SetTimerQueueTimer
VirtualAlloc
DebugBreak
GetCurrentThread
WaitForMultipleObjectsEx
EraseTape
GetCurrentConsoleFont
HeapCompact
LocalUnlock

d3d8thk

OsThunkDdGetBltStatus
OsThunkDdGetDxHandle
OsThunkDdGetFlipStatus
OsThunkDdDeleteDirectDrawObject
OsThunkDdDestroyD3DBuffer
OsThunkDdReleaseDC
OsThunkDdCanCreateSurface
OsThunkDdRenderMoComp
OsThunkDdGetMoCompFormats
OsThunkDdBeginMoCompFrame
OsThunkDdCreateSurface
OsThunkDdColorControl
OsThunkDdGetDriverState
OsThunkDdCreateD3DBuffer
OsThunkD3dDrawPrimitives2
OsThunkD3dContextDestroy
OsThunkDdUnattachSurface
OsThunkDdFlipToGDISurface
OsThunkDdAlphaBlt
OsThunkDdGetDriverInfo
OsThunkDdReenableDirectDrawObject
OsThunkDdLock
OsThunkDdUnlock
OsThunkDdGetDC
OsThunkDdCreateSurfaceEx
OsThunkDdAddAttachedSurface
OsThunkDdSetGammaRamp
OsThunkDdCreateSurfaceObject
OsThunkD3dValidateTextureStageState

msvcrt40

_filbuf
gets
_setmaxstdio
_dup2
iswalpha
_spawnlp
_msize
__lconv_init
__p___argc
_mbsnicoll
wcscat
?overflow@strstreambuf@@UAEHH@Z
_waccess
?ipfx@istream@@QAEHH@Z
??_8ifstream@@7B@
__CxxLongjmpUnwind
??4ostrstream@@QAEAAV0@ABV0@@Z
??0stdiostream@@QAE@PAU_iobuf@@@Z
??1type_info@@UAE@XZ
_errno
??6ostream@@QAEAAV0@G@Z
?underflow@filebuf@@UAEHXZ
_getdllprocaddr
_CIcosh
strtok
fputwc
_safe_fdivr
_nextafter
_wexecle
_exit
?unlock@ios@@QAAXXZ
__p___wargv
??4bad_cast@@QAEAAV0@ABV0@@Z
_amsg_exit
?fd@filebuf@@QBEHXZ
?rdbuf@ostrstream@@QBEPAVstrstreambuf@@XZ

msi

MsiDecomposeDescriptorA
MsiConfigureProductA
MsiRecordReadStream
MsiEnumRelatedProductsW
MsiGetFeatureUsageW
MsiQueryProductStateW
MsiGetUserInfoA
MsiReinstallFeatureFromDescriptorW
MsiSetComponentStateA
MsiInstallMissingComponentA
MsiOpenPackageA
MsiInstallProductW
MsiQueryFeatureStateA
MsiEnumPatchesA
MsiSummaryInfoSetPropertyW
MsiViewModify
MsiInstallMissingComponentW
MsiSetTargetPathW
MsiSetComponentStateW
MsiSequenceW
MsiGetFileVersionW
MsiRecordGetStringA
MsiSourceListAddSourceW
MsiProcessMessage
MsiGetFeatureStateA
MsiEnumRelatedProductsA
MsiDatabaseApplyTransformW
MsiViewGetErrorW
MsiSourceListClearAllW
MsiEnableLogW
MsiGetMode

Sections

.text
Size: 184KB - Virtual size: 188KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 558KB - Virtual size: 560KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 115KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dcfc2e9ff26d24557d6936e0762edcc6

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

user32

kernel32

d3d8thk

msvcrt40

msi

Sections

.text Size: 184KB - Virtual size: 188KB

.rdata Size: 558KB - Virtual size: 560KB

.data Size: 115KB - Virtual size: 1.5MB

.rsrc Size: 1KB - Virtual size: 4KB

.reloc Size: 1KB - Virtual size: 4KB

.text
Size: 184KB - Virtual size: 188KB

.rdata
Size: 558KB - Virtual size: 560KB

.data
Size: 115KB - Virtual size: 1.5MB

.rsrc
Size: 1KB - Virtual size: 4KB

.reloc
Size: 1KB - Virtual size: 4KB