7659696f334080f732223042d75c203e_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

7659696f334080f732223042d75c203e_JaffaCakes118
Size

57KB
MD5

7659696f334080f732223042d75c203e
SHA1

76f1258fe170052f0c1374eb59a798bccc2febdb
SHA256

b10bd3c4ca31c52db699e4c077d38fc39a02d8848210e117e2e337f52e20b04f
SHA512

d3bb915358bfda3f1f0642a2d9498d8943044ff76b6fec6611b5a9201c533314622114397d1687fdfe1057e803db02efba16ad483a2c3414386122ab15e57b9a
SSDEEP

1536:PFrsutb/kF2dhM0LXVBoRM2/mKGXi3WH9m0AfUe2iilhO:Pxseu2djXvovmKwi3WH7Nz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7659696f334080f732223042d75c203e_JaffaCakes118

Files

7659696f334080f732223042d75c203e_JaffaCakes118
.exe windows:6 windows x86 arch:x86

227d81c5224c7437ae46e793d9114b4d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

unsecapp.pdb

Imports

msvcrt

_vsnwprintf
printf
_controlfp
_except_handler4_common
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
wcsstr
_amsg_exit
_purecall
_initterm
exit
_XcptFilter
_exit
_cexit
__getmainargs
malloc
_callnewh
free
??0exception@@QAE@XZ
_CxxThrowException
??0exception@@QAE@ABV0@@Z
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
memmove_s
memcpy_s
__CxxFrameHandler3
__setusermatherr

wbemcomn

??0CCritSec@@QAE@XZ
??1CCritSec@@QAE@XZ
?_ThrowMemoryException_@@YGXXZ
?ErrorTrace@@YAHDPBDZZ
??0CNtSid@@QAE@W4SidType@0@@Z
??1Registry@@QAE@XZ
??8CNtSid@@QAEHAAV0@@Z
?GetTextSid@CNtSid@@QAEHPAGPAK@Z
??1CInCritSec@@QAE@XZ
?GetDWORDStr@Registry@@QAEHPBGPAK@Z
??0Registry@@QAE@PBGK@Z
??0CNtSid@@QAE@PAX@Z
?InternalQueryInterface@CUnkInternal@@QAEJABU_GUID@@PAPAX@Z
?InternalRelease@CUnkInternal@@QAEKXZ
?Write@CMemoryLog@@QAEXJ@Z
?GetMemLogObject@@YGPAVCMemoryLog@@XZ
??0CInCritSec@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z
??0CNtSid@@QAE@ABV0@@Z
??4CNtSid@@QAEAAV0@ABV0@@Z
?Initialize@CUnk@@UAEHXZ
?OnInitialize@CUnk@@UAEHXZ
?Release@CUnk@@UAGKXZ
?AddRef@CUnk@@UAGKXZ
?QueryInterface@CUnk@@UAGJABU_GUID@@PAPAX@Z
??0CUnk@@QAE@PAVCLifeControl@@PAUIUnknown@@@Z
??1CUnk@@UAE@XZ
?Release@CUnkInternal@@UAGKXZ
?AddRef@CUnkInternal@@UAGKXZ
?QueryInterface@CUnkInternal@@UAGJABU_GUID@@PAPAX@Z
??0CUnkInternal@@QAE@PAVCLifeControl@@@Z
??_7CUnkInternal@@6B@
??1CUnkInternal@@UAE@XZ
??1CNtSid@@QAE@XZ

ntdll

EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceLoggerHandle
EtwGetTraceEnableFlags
EtwTraceMessage
EtwGetTraceEnableLevel

api-ms-win-service-core-l1-1-0

SetServiceStatus
StartServiceCtrlDispatcherW

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

api-ms-win-service-management-l1-1-0

OpenSCManagerW
CreateServiceW
OpenServiceW
DeleteService

kernel32

InterlockedIncrement
Sleep
InterlockedCompareExchange
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
LeaveCriticalSection
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
DebugBreak
LCMapStringW
EnterCriticalSection
ExitProcess
SetEvent
LoadLibraryExW
GetLastError
CreateEventW
GetModuleFileNameW
lstrlenW
GetCommandLineW
DeleteCriticalSection
InterlockedDecrement
GetCurrentProcessId
GetProcAddress
InterlockedExchange

ole32

CoImpersonateClient
CoRegisterClassObject
CoRevokeClassObject
StringFromGUID2
CoRevertToSelf
CoInitialize
CoInitializeSecurity

api-ms-win-security-base-l1-1-0

EqualSid
GetLengthSid
IsValidSid

user32

DispatchMessageW
TranslateMessage
GetMessageW
PostQuitMessage
SetTimer
PostThreadMessageW

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

227d81c5224c7437ae46e793d9114b4d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

wbemcomn

ntdll

api-ms-win-service-core-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-management-l1-1-0

kernel32

ole32

api-ms-win-security-base-l1-1-0

user32

Sections

.text Size: 31KB - Virtual size: 30KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 23KB - Virtual size: 23KB

.text
Size: 31KB - Virtual size: 30KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 23KB - Virtual size: 23KB