712c43ea8c70443e46d1b55f9dc7f532_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

712c43ea8c70443e46d1b55f9dc7f532_JaffaCakes118
Size

65KB
MD5

712c43ea8c70443e46d1b55f9dc7f532
SHA1

0f022f056f4dedaa2fc462d3259e17dce7ca4a85
SHA256

1ca5e64cb026a36084e3c576b00a2aa6a05ca597e8b6390c63e87144ac0e6312
SHA512

815895ab98dcaf82dd4757400550b6594de4df55d4c0223c50df1d2f991eb7ba317cee6611221451bc8a36fe14d6cee4079c3f6b878da32dc7b54bbac205f006
SSDEEP

1536:p5wMxlh5Vm9A4/zDCC+OKGHqdee/Sd268:pLlh5ES4hNG/S58

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
712c43ea8c70443e46d1b55f9dc7f532_JaffaCakes118

Files

712c43ea8c70443e46d1b55f9dc7f532_JaffaCakes118
.exe windows:5 windows x86 arch:x86

bfc2fb0834f4c10a76833a72cf859045

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcirt

??1ostream_withassign@@UAE@XZ
??4istream_withassign@@QAEAAVistream@@PAVstreambuf@@@Z
??4ostream_withassign@@QAEAAVostream@@PAVstreambuf@@@Z
??_Estrstream@@UAEPAXI@Z
?bad@ios@@QBEHXZ
?pptr@streambuf@@IBEPADXZ
?basefield@ios@@2JB
??0filebuf@@QAE@XZ
?read@istream@@QAEAAV1@PADH@Z
??_Eostream_withassign@@UAEPAXI@Z
?open@ifstream@@QAEXPBDHH@Z
??_Distrstream@@QAEXXZ
?setp@streambuf@@IAEXPAD0@Z
??0ostream@@IAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
??_8strstream@@7Bistream@@@
??4stdiobuf@@QAEAAV0@ABV0@@Z
??4ios@@IAEAAV0@ABV0@@Z
?width@ios@@QAEHH@Z
??Bios@@QBEPAXXZ
?ipfx@istream@@QAEHH@Z
??4ostrstream@@QAEAAV0@ABV0@@Z
??0filebuf@@QAE@H@Z
??4ostream@@IAEAAV0@PAVstreambuf@@@Z
??1ostrstream@@UAE@XZ
?open@fstream@@QAEXPBDHH@Z

kernel32

InterlockedDecrement
CreateEventA
BuildCommDCBAndTimeoutsW
ActivateActCtx
WriteProfileStringW
OutputDebugStringA
PurgeComm
_lopen
ReplaceFileW
GetHandleInformation
ReadConsoleOutputCharacterW
ReplaceFile
UnregisterConsoleIME
LoadLibraryA
GetPrivateProfileSectionNamesW
SuspendThread
GetSystemDefaultLCID
WriteConsoleInputA
IsValidCodePage
GetUserDefaultLCID
WriteFileEx
DeleteTimerQueue
GetLongPathNameW
GetSystemPowerStatus
EnterCriticalSection
EnumResourceNamesA
SetComputerNameExA
GetConsoleCP
FindFirstVolumeA
SetProcessWorkingSetSize
FatalExit
IsDebuggerPresent
EscapeCommFunction
GetVolumeNameForVolumeMountPointA
LeaveCriticalSection
VirtualAlloc
GetSystemDefaultLangID
IsValidLocale
LockResource
LocalHandle
LCMapStringA
GetModuleHandleA
EnumSystemCodePagesW
WritePrivateProfileSectionA
GetProfileSectionA
SetDefaultCommConfigA
FindFirstVolumeMountPointA
BeginUpdateResourceW
GetConsoleCommandHistoryLengthW
RegisterConsoleIME
CreateHardLinkW

lz32

LZSeek
LZClose
LZDone
LZCloseFile
GetExpandedNameA
LZRead
LZInit
LZOpenFileA
GetExpandedNameW
CopyLZFile
LZCopy
LZOpenFileW
LZCreateFileW
LZStart

ntdll

ZwOpenIoCompletion
RtlMultiByteToUnicodeSize
NtAllocateVirtualMemory
_i64tow
ZwAccessCheckByTypeAndAuditAlarm
NtTranslateFilePath
ZwDeleteValueKey
RtlDebugPrintTimes
RtlAreBitsSet
RtlPinAtomInAtomTable
NtWriteFile
ZwResetWriteWatch
RtlLookupAtomInAtomTable
NtFsControlFile
_chkstk
RtlUpdateTimer
NtQueryObject
RtlCreateUnicodeString
NtImpersonateClientOfPort
RtlInterlockedPushListSList
RtlAddRefActivationContext
NtQueryDefaultUILanguage
RtlAreAnyAccessesGranted
RtlSetTimeZoneInformation
_CIlog
NtCompleteConnectPort
RtlImageRvaToVa
ZwCreateProfile
RtlSetDaclSecurityDescriptor
RtlTraceDatabaseValidate
RtlFindLeastSignificantBit
ZwWriteFileGather
wcsncpy
RtlpNtSetValueKey
ZwWaitForSingleObject
strcspn
RtlUpperChar
ZwInitializeRegistry

wintrust

CryptCATAdminPauseServiceForBackup
HTTPSCertificateTrust
CryptCATGetCatAttrInfo
CryptSIPGetRegWorkingFlags
WinVerifyTrust
WVTAsn1CatNameValueEncode
WintrustAddDefaultForUsage
WVTAsn1SpcSigInfoEncode
WintrustSetRegPolicyFlags
WVTAsn1SpcStatementTypeDecode
CryptCATGetMemberInfo
CryptCATAdminReleaseCatalogContext
WVTAsn1SpcPeImageDataEncode
DriverFinalPolicy
CryptCATVerifyMember
SoftpubDllRegisterServer
WVTAsn1SpcSpAgencyInfoEncode
DriverCleanupPolicy
WVTAsn1CatMemberInfoDecode
CatalogCompactHashDatabase
CryptCATCDFEnumMembersByCDFTag
WTHelperIsInRootStore
TrustIsCertificateSelfSigned
WinVerifyTrustEx
WTHelperProvDataFromStateData
CryptCATCDFEnumAttributesWithCDFTag
MsCatConstructHashTag
MsCatFreeHashTag
CryptCATPutAttrInfo
CryptCATAdminResolveCatalogPath
CryptSIPCreateIndirectData
CryptCATOpen
GenericChainCertificateTrust
WTHelperGetProvPrivateDataFromChain
SoftpubAuthenticode
mssip32DllRegisterServer
CryptSIPGetSignedDataMsg
CryptCATClose

msvcrt

__set_app_type
__getmainargs
exit
_memicmp
__RTCastToVoid
_lfind
_safe_fdivr
wcscmp
_outpd
_adj_fprem1
_winver
_stat64
_findnext64
_rmdir
_aligned_offset_realloc
_wfullpath
_pipe
wcslen
__p__commode
__CxxFrameHandler
__CxxQueryExceptionSize
_getwch
towupper
_tzname
_acmdln
_ismbbprint
wcstoul
_mbsdec

wmvcore

WMCreateWriterNetworkSink
WMCreateEditor
WMCreateWriterPriv
WMCreateIndexer
WMCreateReaderPriv
WMCreateBackupRestorerPrivate
WMCreateProfileManager
WMCreateWriterFileSink
WMValidateData
WMCheckURLExtension

kbduk

KbdLayerDescriptor

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 230KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bfc2fb0834f4c10a76833a72cf859045

Headers

DLL Characteristics

File Characteristics

Imports

msvcirt

kernel32

lz32

ntdll

wintrust

msvcrt

wmvcore

kbduk

Sections

.text Size: 52KB - Virtual size: 52KB

.rdata Size: 74KB - Virtual size: 74KB

.data Size: 33KB - Virtual size: 230KB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 52KB - Virtual size: 52KB

.rdata
Size: 74KB - Virtual size: 74KB

.data
Size: 33KB - Virtual size: 230KB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 1KB - Virtual size: 1KB