73beeda8b16927c35cb1a35d53c29922_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

73beeda8b16927c35cb1a35d53c29922_JaffaCakes118
Size

161KB
MD5

73beeda8b16927c35cb1a35d53c29922
SHA1

05f9c3839428b082a2b1bcf0e4b9140a2a263148
SHA256

af2ddc79457f91ddf0debd649c2b5eb9c75a319ec086d58ac008c5fc185eb1f2
SHA512

49afa3e59a80735d8c2fdb6bca2cd346d187b05fb7ac313507d1b51760c8cc8853b6c156c500bdb62368ea6ad6141175ed5c5cb45429810e90c38674b01f2ed5
SSDEEP

3072:Q9EFvCrYRVRnb038D40F2Cov7kMLdU85MtXF:Q9ovCrYhI38D87k8fI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
73beeda8b16927c35cb1a35d53c29922_JaffaCakes118

Files

73beeda8b16927c35cb1a35d53c29922_JaffaCakes118
.exe windows:5 windows x86 arch:x86

078a0f381f26c36fc8bb842a95742a13

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateThread
IsBadStringPtrW
SetFileShortNameA
ReplaceFileW
RegisterConsoleOS2
GetTapeStatus
IsValidCodePage
GetThreadLocale
IsDebuggerPresent
TryEnterCriticalSection
GetModuleHandleA
AddAtomA
SetHandleInformation
GetConsoleInputExeNameW
GetUserDefaultLCID
EnumDateFormatsExA
LocalFlags
SetComPlusPackageInstallStatus
GetSystemDirectoryW
GetSystemDefaultLCID
GlobalMemoryStatus
EnterCriticalSection
GetACP
LoadLibraryA
SetTapePosition
WriteConsoleOutputA
FillConsoleOutputCharacterW
RegisterConsoleVDM
IsValidLocale
GlobalGetAtomNameA
UnregisterWait
VirtualAlloc
OpenEventA
LeaveCriticalSection
BaseCheckAppcompatCache
CreateRemoteThread
CreateDirectoryExA
CreateActCtxA
FindCloseChangeNotification
WriteFileGather
GetBinaryTypeA

netapi32

I_NetServerPasswordSet
NetReplExportDirLock
I_BrowserSetNetlogonState
NetDfsSetInfo
I_NetServerAuthenticate3
I_NetLogonControl
RxNetAccessAdd
NetDfsAddStdRootForced
DsAddressToSiteNamesExW
NlBindingSetAuthInfo
DsAddressToSiteNamesA
NetWkstaTransportDel
NetpwNameCanonicalize
RxNetAccessGetInfo
NetpwPathCanonicalize
NetRemoteComputerSupports
NetpIsRemote
NetWkstaTransportAdd
DsRoleGetDcOperationProgress
NetServerEnum
NetpMergeFtinfo
I_NetServerGetTrustInfo
NetApiBufferFree
NetServerDiskEnum
NetUserModalsSet
NetReplImportDirEnum
NetGetJoinInformation
NetDfsGetInfo
NetDfsRemove
I_NetDfsIsThisADomainName
I_NetServerPasswordGet
DsGetDcSiteCoverageA
NetAuditClear
DsGetDcNameWithAccountA
RxNetAccessDel
DsGetDcCloseW
NetUseAdd

lz32

LZInit
LZClose
CopyLZFile
LZCloseFile
LZStart
LZCreateFileW
LZSeek
LZOpenFileW
LZCopy
GetExpandedNameA
LZDone
LZOpenFileA
LZRead

msvcp60

?_Init@?$numpunct@D@std@@IAEXABV_Locinfo@2@@Z
?copy@?$char_traits@G@std@@SAPAGPAGPBGI@Z
??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@PAF@Z
?close@?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXXZ
?osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
??_7length_error@std@@6B@
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_Nanv@?$_Ctr@M@std@@SAMM@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_iostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?exp@std@@YA?AV?$complex@O@1@ABV21@@Z
??Kstd@@YA?AV?$complex@M@0@ABMABV10@@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?pbackfail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGG@Z
??8std@@YA_NABV?$complex@N@0@0@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
??4?$basic_fstream@GU?$char_traits@G@std@@@std@@QAEAAV01@ABV01@@Z
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?_Makpat@?$_Mpunct@G@std@@AAEXAAUpattern@money_base@2@DDD@Z
_Stold
??4?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?grouping@?$numpunct@D@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?narrow@?$ctype@G@std@@QBEPBGPBG0DPAD@Z
?eof@?$char_traits@D@std@@SAHXZ
??Kstd@@YA?AV?$complex@M@0@ABV10@0@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1ostrstream@std@@UAE@XZ
?_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ
??Hstd@@YA?AV?$complex@O@0@ABOABV10@@Z

esent

JetRenameTable
JetGotoBookmark
JetResetSessionContext
JetSetCurrentIndex2
JetOpenTempTable2
JetAttachDatabaseWithStreaming
JetBackupInstance
JetUpgradeDatabase
JetEndSession
JetCreateIndex2
JetDBUtilities
JetGetInstanceInfo
JetSetLS
JetDupCursor
JetOSSnapshotThaw
JetIndexRecordCount
JetUnregisterCallback
JetRestore
JetGetLogInfoInstance
JetBeginTransaction
JetBeginExternalBackup
JetCloseFile
JetBeginExternalBackupInstance
JetGetSystemParameter
JetUpdate
JetCloseTable
JetGetLS
JetRetrieveColumn@32
JetIntersectIndexes
JetDeleteTable
JetRetrieveKey
JetCompact

msvcrt

__set_app_type
exit
__getmainargs
__p__commode

Sections

.text
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

078a0f381f26c36fc8bb842a95742a13

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

netapi32

lz32

msvcp60

esent

msvcrt

Sections

.text Size: 63KB - Virtual size: 63KB

.rdata Size: 35KB - Virtual size: 35KB

.data Size: 62KB - Virtual size: 240KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 63KB - Virtual size: 63KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 62KB - Virtual size: 240KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB