83aad7e93955f96bda325c219e6d6d6d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

83aad7e93955f96bda325c219e6d6d6d_JaffaCakes118
Size

321KB
MD5

83aad7e93955f96bda325c219e6d6d6d
SHA1

4f3175894ff5334199a4ef999b612af0668fbaa4
SHA256

09b006fa485c2a9aa7d58424e581d58de9463986cb394e1f717a851113bdc153
SHA512

ccb3510c078575eff5b6cea5c4d5f7745ebf1f676f6626f734f03ce9259fd53d196b3fd04e8a2bbf5d30e4fd22a41957a31e7130d8a5b9e4f7612cdf585d24bf
SSDEEP

6144:yLaW804Pp3tNZtjX73I4/DjE2tpYux5093d/BdVUnnfdJYi:YaA4PtZVLY4LjE2nYux5u3dpHUnFJj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
83aad7e93955f96bda325c219e6d6d6d_JaffaCakes118

Files

83aad7e93955f96bda325c219e6d6d6d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

3688a3ec171f54457e785b04c0637743

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

upnpui.pdb

Imports

msvcrt

sprintf
wcslen
sscanf
strstr
wcsrchr
wcscpy
_snprintf
wcscmp
_except_handler3

advapi32

RegCreateKeyW
RegSetValueExA
RegDeleteValueA
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegOpenKeyW
RegEnumValueA
RegSetValueExW
RegDeleteValueW
RegCreateKeyExA
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
OpenSCManagerW
OpenServiceW
ControlService
CloseServiceHandle
RegQueryValueExA
RegQueryValueA

kernel32

GetFileType
CreateFileA
WideCharToMultiByte
lstrlenW
lstrcpynW
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LoadLibraryA
PurgeComm
SetCommMask
GetTempPathA
SetCommTimeouts
GetVersionExA
FormatMessageW
GetModuleHandleW
GetModuleFileNameW
GetWindowsDirectoryW
WriteFile
CreateMutexW
SetLastError
CreateEventW
EscapeCommFunction
ClearCommError
GetTempFileNameA
MultiByteToWideChar
SetupComm
DeleteFileA
GetFileInformationByHandle
SetFilePointer
SetEndOfFile
GetSystemDirectoryA
FlushFileBuffers
GetLocalTime
GetDateFormatW
GetTimeFormatW
ReleaseMutex
WaitForSingleObject
LocalSize
lstrcmpiW
IsBadStringPtrW
InterlockedExchange
LocalAlloc
LocalFree
IsBadWritePtr
UnmapViewOfFile
CloseHandle
GetCurrentProcessId
GetLastError
CreateFileMappingA
MapViewOfFileEx
ReadFile
lstrcmpiA
GetProcAddress
FreeLibrary
IsBadCodePtr
DisableThreadLibraryCalls
InitializeCriticalSectionAndSpinCount
GetCommandLineA
lstrcpynA
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
lstrlenA
GetModuleHandleA
CreateProcessA
CreateFileW
IsBadReadPtr

user32

wsprintfA
CharNextA
wvsprintfW
CharNextW
SendMessageTimeoutW
wsprintfW
SetCursor
LoadCursorA

ole32

CoUninitialize
FreePropVariantArray
CLSIDFromString
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
HWND_UserSize
HWND_UserMarshal
HWND_UserUnmarshal
HWND_UserFree
STGMEDIUM_UserSize
STGMEDIUM_UserMarshal
STGMEDIUM_UserUnmarshal
STGMEDIUM_UserFree
CoInitialize

rpcrt4

CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
NdrClientCall2
RpcBindingFromStringBindingW
RpcStringBindingComposeW
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrDllRegisterProxy
RpcBindingFree
CStdStubBuffer_IsIIDSupported
RpcBindingSetAuthInfoExW
RpcStringFreeW
CStdStubBuffer_DebugServerRelease
NdrDllUnregisterProxy

cfgmgr32

CM_Reenumerate_DevNode
CM_Get_DevNode_Status
CM_Get_Parent

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiOpenDeviceInterfaceRegKey
SetupDiOpenDevRegKey
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList

Sections

.text
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 237KB - Virtual size: 246KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3688a3ec171f54457e785b04c0637743

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

user32

ole32

rpcrt4

cfgmgr32

setupapi

Sections

.text Size: 64KB - Virtual size: 60KB

.data Size: 237KB - Virtual size: 246KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 64KB - Virtual size: 60KB

.data
Size: 237KB - Virtual size: 246KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 10KB - Virtual size: 10KB