88260dd01eb36ee9e5b8768793d6a75f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

88260dd01eb36ee9e5b8768793d6a75f_JaffaCakes118
Size

276KB
MD5

88260dd01eb36ee9e5b8768793d6a75f
SHA1

3d752f795935d3f6502996100bf9502dd186740d
SHA256

fa633971b1002a4cf132c603c08c4f2c64b90be0c55f3bbc554b2a693a431d82
SHA512

c808a862f0c68391f97405d42ad97ca53fc1d94572bac0f4ed67dd97bb7379920684b657e3f4d6ad235848cfc3ad68d43eebb222e7dbc586221c5a5531b54d6e
SSDEEP

6144:B9Osl6iemkRsbmm4PoK6HOwQlIZZMN6HW+KLLn74SlIQHKghutsN3ot5:B/kKbmme6HOwwIi7LLnEoHHKghue3ot5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
88260dd01eb36ee9e5b8768793d6a75f_JaffaCakes118

Files

88260dd01eb36ee9e5b8768793d6a75f_JaffaCakes118
.exe windows:6 windows x86 arch:x86

6199b3f7b851154bc163fe8a178b52cd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

wsqmcons.pdb

Imports

advapi32

TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegCloseKey
RegDeleteValueW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
UpdateTraceW
ControlTraceW
StopTraceW
EnableTraceEx
StartTraceW
RegQueryValueExW
QueryTraceW
IsValidSid
CloseTrace
ProcessTrace
OpenTraceW
ConvertSidToStringSidW
RegSetValueExW
RegCreateKeyExW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
CopySid
GetLengthSid
GetTokenInformation
CloseServiceHandle
QueryServiceStatus
OpenServiceW
OpenSCManagerW
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetNamedSecurityInfoW
GetSecurityDescriptorOwner
GetSecurityDescriptorDacl
RevertToSelf
ImpersonateLoggedOnUser
RegGetValueW
TraceEvent

kernel32

GetTickCount
SetThreadPriority
GetCurrentThread
CreateMutexW
GetCommandLineW
HeapSetInformation
GetLogicalProcessorInformationEx
LocalFree
FreeLibrary
GetProcAddress
LoadLibraryW
GetUserGeoID
GetSystemDefaultLCID
GetSystemDefaultUILanguage
GlobalMemoryStatusEx
GetSystemInfo
GetActiveProcessorCount
GetProductInfo
CompareFileTime
GetLastError
OpenMutexW
ReleaseMutex
LoadLibraryExW
FindResourceW
SizeofResource
LoadResource
LockResource
FreeResource
GetModuleHandleW
FileTimeToSystemTime
FileTimeToDosDateTime
GetTempFileNameW
GlobalFree
WaitForMultipleObjects
GetTempPathW
GetLongPathNameW
SetLastError
WideCharToMultiByte
CreateDirectoryW
GetFileAttributesW
GetFileSizeEx
SetFilePointerEx
InterlockedDecrement
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
VirtualAlloc
UnmapViewOfFile
VirtualFree
InterlockedIncrement
ResetEvent
CreateThread
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeLibraryAndExitThread
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventW
GetFileSize
ReadFile
DuplicateHandle
SetEvent
EnterCriticalSection
LeaveCriticalSection
RaiseException
GetSystemDirectoryW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
lstrlenW
SystemTimeToFileTime
GetModuleFileNameW
LocalAlloc
GetLocalTime
CreateFileW
SetFileAttributesW
WriteFile
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
CloseHandle
DeleteFileW
GetFileAttributesExW
FindNextFileW
FindFirstFileW
FindClose
MoveFileExW
GetVersionExW
GetSystemTime
GetThreadPriority

user32

LoadStringW
PeekMessageW
MsgWaitForMultipleObjects
DispatchMessageW
TranslateMessage
GetSystemMetrics

msvcrt

_initterm
wcstoul
_controlfp
_except_handler4_common
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
wcstok_s
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
free
_callnewh
malloc
wcschr
memset
__CxxFrameHandler3
towupper
_vsnwprintf
wcsstr
wcsrchr
memcpy
_vsnprintf
memmove
_wcsicmp
realloc
_wcsnicmp
ceil
_ftol2
_purecall

shlwapi

PathRemoveExtensionW
PathFindFileNameW
PathCombineW
StrStrIW
StrToIntExW
PathFileExistsW
ord437
PathAppendW

tdh

TdhGetProperty
TdhGetPropertySize

ole32

CoCreateGuid
StringFromGUID2

shell32

CommandLineToArgvW
SHGetFolderPathW
SHGetFolderPathAndSubDirW

winhttp

WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpSetOption
WinHttpOpen
WinHttpGetDefaultProxyConfiguration
WinHttpWriteData
WinHttpCrackUrl
WinHttpSetTimeouts
WinHttpSetCredentials
WinHttpTimeFromSystemTime
WinHttpCloseHandle
WinHttpReadData
WinHttpSetStatusCallback
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpReceiveResponse
WinHttpConnect
WinHttpSendRequest

wevtapi

EvtClose
EvtNext
EvtQuery
EvtRender
EvtCreateRenderContext

powrprof

PowerDeterminePlatformRole

ntdll

NtQuerySystemTime
RtlFreeHeap
RtlAllocateHeap

oleaut32

SysFreeString
SysAllocString

Sections

.text
Size: 205KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

yggwrvo
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6199b3f7b851154bc163fe8a178b52cd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

shlwapi

tdh

ole32

shell32

winhttp

wevtapi

powrprof

ntdll

oleaut32

Sections

.text Size: 205KB - Virtual size: 204KB

.data Size: 512B - Virtual size: 5KB

.rsrc Size: 29KB - Virtual size: 28KB

.reloc Size: 40KB - Virtual size: 41KB

yggwrvo Size: - Virtual size: 4KB

.text
Size: 205KB - Virtual size: 204KB

.data
Size: 512B - Virtual size: 5KB

.rsrc
Size: 29KB - Virtual size: 28KB

.reloc
Size: 40KB - Virtual size: 41KB

yggwrvo
Size: - Virtual size: 4KB