84429e4aea5a299127bd5accce0ab3bf_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

84429e4aea5a299127bd5accce0ab3bf_JaffaCakes118
Size

60KB
MD5

84429e4aea5a299127bd5accce0ab3bf
SHA1

79a3b8189208454690b266cd148d663263541e53
SHA256

8b335c5fdf1b6f66c90b4f946b3297006af262aacbad801288de5fe875f1a19c
SHA512

3cdf6585b8a224e29dff9a61493eec5e24e9901e7effd11895c8d0ea126dfb48c8eebb24fb1d7463d1095a7c645424392a7a9a3fcacf2167d30445934028f84e
SSDEEP

1536:5uS7cl1nfc9SnVM4HHD8LqoguVQivcYaXd8y+P0KV:/7Afc9SnVHDkQuVQik3HE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
84429e4aea5a299127bd5accce0ab3bf_JaffaCakes118

Files

84429e4aea5a299127bd5accce0ab3bf_JaffaCakes118
.exe windows:5 windows x86 arch:x86

159bb725e3aa8c2bb7d5357e880fbe2e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

GdiEntry3
EngDeleteSemaphore
GetWorldTransform
EnumFontsW
CreateFontIndirectA
SetBkMode
EngGetCurrentCodePage
OffsetClipRgn
SelectPalette
SetStretchBltMode
CreateRectRgnIndirect
LineDDA
PlayEnhMetaFileRecord
SetROP2
DdEntry52
CreateSolidBrush
SetMetaFileBitsEx
SetViewportOrgEx
GetMetaRgn
GdiFixUpHandle

kernel32

LoadLibraryA
CreateJobObjectW
RegisterWaitForSingleObjectEx
EnumResourceNamesW
GetFileSizeEx
VirtualAlloc
UnmapViewOfFile
GetCurrentProcessId
CompareFileTime
QueryPerformanceCounter
SetFileShortNameW
SetFirmwareEnvironmentVariableW
SetComputerNameW
AllocConsole
GetCurrentThreadId
FindFirstFileA
GetCommProperties
GetOEMCP
GetStartupInfoW
GetUserDefaultUILanguage
InterlockedExchangeAdd
SetUserGeoID
SetConsoleTextAttribute
HeapFree
GetWindowsDirectoryA
BuildCommDCBW
CopyLZFile
DebugBreak
GlobalUnlock
GetTickCount
UnlockFile

cfgmgr32

CM_Add_ID_ExA
CM_Get_Class_Key_NameA
CM_Move_DevNode_Ex
CM_Query_Arbitrator_Free_Size_Ex
CM_Connect_MachineW
CM_Locate_DevNode_ExA
CM_Get_Device_ID_List_Size_ExA
CM_Add_IDA
CMP_WaitServicesAvailable
CM_Register_Device_Driver_Ex
CM_Setup_DevNode_Ex
CM_Get_Device_ID_ExA
CM_Open_Class_Key_ExA
CM_Create_DevNode_ExW
CM_Add_IDW
CM_Enumerate_Classes_Ex
CM_Get_Hardware_Profile_InfoA
CM_Open_Class_Key_ExW
CM_Query_And_Remove_SubTreeA
CM_Open_DevNode_Key_Ex
CM_Set_DevNode_Problem_Ex

netapi32

NetGroupGetInfo
NetUseAdd
RxNetAccessEnum
I_NetGetDCList
NetGetAnyDCName
DsRoleServerSaveStateForUpgrade
DsRoleGetDatabaseFacts
NetpAddTlnFtinfoEntry
NetLocalGroupGetInfo
DsGetDcCloseW
NetShareSetInfo
NetAuditRead
RxNetAccessGetInfo
NetUserEnum
NetpCleanFtinfoContext
NetUserModalsGet
I_BrowserDebugCall
I_NetAccountDeltas
NetServiceEnum
NetWkstaGetInfo
DsGetDcOpenA

wldap32

ldap_memfreeW
ldap_search_ext_s
ldap_search_abandon_page
ldap_next_attributeA
ldap_modify_ext_sA
ldap_set_option
ldap_get_dn
ldap_escape_filter_elementA
ldap_delete_extW
ldap_sslinitW
ldap_search_init_pageA
ldap_get_values
ber_bvecfree
ldap_modify_s
ldap_escape_filter_element
ldap_modify_extW
ldap_encode_sort_controlW
ldap_compare_s
ldap_modrdn_s
ldap_extended_operation_sA
ldap_modrdn_sW
ldap_encode_sort_controlA

msvcp60

?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
??_F?$ctype@D@std@@QAEXXZ
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?_Nanv@?$_Ctr@O@std@@SAOO@Z
??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
??_D?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
?sqrt@std@@YA?AV?$complex@M@1@ABV21@@Z
??_0?$_Complex_base@O@std@@QAEAAV01@ABO@Z
??4logic_error@std@@QAEAAV01@ABV01@@Z
??0?$_Mpunct@G@std@@QAE@ABV_Locinfo@1@I_N@Z
_FNan
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@N@Z
??Kstd@@YA?AV?$complex@O@0@ABV10@0@Z
?toupper@?$ctype@D@std@@QBEDD@Z
??_7?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?frac_digits@?$_Mpunct@D@std@@QBEHXZ
?_Cosh@?$_Ctr@M@std@@SAMMM@Z
??4?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?neg_format@?$_Mpunct@G@std@@QBE?AUpattern@money_base@2@XZ
?sin@std@@YA?AV?$complex@N@1@ABV21@@Z
?length@?$char_traits@G@std@@SAIPBG@Z

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

159bb725e3aa8c2bb7d5357e880fbe2e

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

kernel32

cfgmgr32

netapi32

wldap32

msvcp60

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 22KB - Virtual size: 91KB

.rsrc Size: 20KB - Virtual size: 20KB

.reloc Size: 512B - Virtual size: 280B

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 22KB - Virtual size: 91KB

.rsrc
Size: 20KB - Virtual size: 20KB

.reloc
Size: 512B - Virtual size: 280B