8ae2faf7dba9c107fd6bf02350476753_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

8ae2faf7dba9c107fd6bf02350476753_JaffaCakes118
Size

58KB
MD5

8ae2faf7dba9c107fd6bf02350476753
SHA1

846ea2b751ed6e5943aa1ea5e74c3e18351e5f58
SHA256

d6bf400b7e0de47ca6963c5cec28422d2de1bcdf2640e56ad8da157c7ca90d1e
SHA512

7d64f275bfa00203b7dd8eb198404d6acef055e8d0189c415a3733c8583db363c9c6c192839a299377426326a11c7e3ef3b9eae5d503fdddd868c76fdc089afb
SSDEEP

768:++OibBbxbjjdF1maP01jFH3jTpSd9WSJDRD1oMqBWtVDVtbE5/juOL0YgCtXTsvl:1OibbjAfjFHTtCWItg+ha0gqBBN0+T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8ae2faf7dba9c107fd6bf02350476753_JaffaCakes118

Files

8ae2faf7dba9c107fd6bf02350476753_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5fb539b12a60642e227bb564619168b6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalFindAtomA
GetEnvironmentStringsA
OpenWaitableTimerA
LoadLibraryA
BuildCommDCBW
GetLogicalDriveStringsA
RtlZeroMemory
NlsGetCacheUpdateCount
InterlockedExchangeAdd
IsBadStringPtrA
Beep
WriteTapemark
SetCommConfig
OpenJobObjectW
LoadLibraryExA
HeapSetInformation
SetCalendarInfoA
VirtualAlloc
GetTimeFormatA
IsValidLocale
GetPrivateProfileStringW
GetConsoleAliasExesW
EnumerateLocalComputerNamesA
SetClientTimeZoneInformation
LocalFlags
lstrcmpi
GetVolumeInformationW
FindActCtxSectionGuid

mapistub

UNKOBJ_ScCOAllocate@12
ScCreateConversationIndex@16
ScDupPropset@16
BMAPISendMail
ScCopyProps@16
UNKOBJ_FreeRows@8
FtMulDw@12
MNLS_MultiByteToWideChar@24
IsBadBoundedStringPtr@8
SwapPword@8
LpValFindProp@12
MAPIAllocateMore
HrAddColumns@16
SzFindLastCh@8
ScCountProps@12
HrComposeMsgID@24
HrThisThreadAdviseSink@8
HrSetOneProp@8
ScRelocNotifications@20
DeregisterIdleRoutine@4
MNLS_lstrcmpW@8
LAUNCHWIZARD
SzFindSz@8

ntdll

wcscmp
RtlQueryDepthSList
NtWaitLowEventPair
ZwSetSecurityObject
ZwMakeTemporaryObject
NtOpenDirectoryObject
NtSetSystemInformation
ZwPlugPlayControl
RtlInitAnsiString
RtlExtendedIntegerMultiply
RtlTraceDatabaseAdd
NtPrivilegeCheck
ZwTestAlert
RtlLockHeap
RtlValidateUnicodeString
RtlInitializeBitMap
ZwReadRequestData
NtOpenSymbolicLinkObject
RtlDeregisterWait
strstr
ZwCreateWaitablePort
RtlAcquirePebLock

vssapi

?GetCurrentLevel@CVssWriter@@IBG?AW4_VSS_APPLICATION_LEVEL@@XZ
?OnPreRestoreBegin@CVssJetWriter@@UAG_NPAVIVssWriterComponents@@@Z
?OnAbortBegin@CVssJetWriter@@UAGXXZ
?IsPartialFileSupportEnabled@CVssWriter@@IBG_NXZ
??0CVssWriter@@QAE@XZ
?OnPrepareSnapshotBegin@CVssJetWriter@@UAG_NXZ
?GetCurrentVolumeArray@CVssWriter@@IBGPAPBGXZ
?OnVSSApplicationStartup@CVssWriter@@UAG_NXZ
?OnFreezeBegin@CVssJetWriter@@UAG_NXZ
?Subscribe@CVssWriter@@QAGJK@Z
?OnPrepareSnapshotEnd@CVssJetWriter@@UAG_N_N@Z
?OnBackupComplete@CVssWriter@@UAG_NPAVIVssWriterComponents@@@Z
?InstallAlternateWriter@CVssWriter@@QAGJU_GUID@@0@Z
?OnAbortEnd@CVssJetWriter@@UAGXXZ
?OnPrepareBackupBegin@CVssJetWriter@@UAG_NPAVIVssWriterComponents@@@Z
?CreateVssSnapshotSetDescription@@YGJU_GUID@@JPAPAVIVssSnapshotSetDescription@@@Z
?OnVSSShutdown@CVssWriter@@UAG_NXZ
?OnFreezeEnd@CVssJetWriter@@UAG_N_N@Z
?AreComponentsSelected@CVssWriter@@IBG_NXZ
IsVolumeSnapshotted
?Uninitialize@CVssJetWriter@@QAGXXZ

msdart

?ReadLock@CReaderWriterLock@@QAEXXZ
?TryWriteLock@CSpinLock@@QAE_NXZ
?sm_wDefaultSpinCount@CReaderWriterLock2@@1GA
?SetDefaultSpinAdjustmentFactor@CFakeLock@@SGXN@Z
?_DeleteKey@CLKRLinearHashTable@@AAE?AW4LK_RETCODE@@KK@Z
?ValidSignature@CLKRHashTable@@QBE_NXZ
?IsWriteUnlocked@CSpinLock@@QBE_NXZ
??1CLKRLinearHashTable@@QAE@XZ
?Apply@CLKRLinearHashTable@@QAEKP6G?AW4LK_ACTION@@PBXPAX@Z1W4LK_LOCKTYPE@@@Z
?IsWriteLocked@CReaderWriterLock2@@QBE_NXZ
?_CurrentThreadId@CSmallSpinLock@@CGJXZ
?InsertTail@CDoubleList@@QAEXQAVCListEntry@@@Z
?TryReadLock@CReaderWriterLock3@@QAE_NXZ
?TryWriteLock@CCritSec@@QAE_NXZ
?_LockSpin@CReaderWriterLock3@@AAEXW4SPIN_TYPE@1@@Z
?IsReadUnlocked@CReaderWriterLock3@@QBE_NXZ
?_CmpExch@CReaderWriterLock3@@AAE_NJJ@Z
?_PredTrue@CLKRLinearHashTable@@CG?AW4LK_PREDICATE@@PBXPAX@Z
?IsWriteUnlocked@CReaderWriterLock3@@QBE_NXZ
?IsUnlocked@CLockedDoubleList@@QBE_NXZ
?ConvertSharedToExclusive@CReaderWriterLock3@@QAEXXZ

polstore

IPSecFreeMulFilterData
IPSecCopyNFAData
IPSecFreeMulISAKMPData
IPSecCopyPolicyData
IPSecEnumISAKMPData
IPSecAllocPolMem
IPSecCreatePolicyData
IPSecFreePolStr
IPSecFreeNFAData
IPSecExportPolicies
IPSecImportPolicies
IPSecDeleteNegPolData
IPSecOpenPolicyStore
IPSecGetFilterData
IPSecClosePolicyStore
IPSecCopyNegPolData
IPSecCreateNegPolData

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.xdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 19KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5fb539b12a60642e227bb564619168b6

Headers

File Characteristics

Imports

kernel32

mapistub

ntdll

vssapi

msdart

polstore

Sections

.text Size: 20KB - Virtual size: 20KB

.xdata Size: 16KB - Virtual size: 16KB

.idata Size: 19KB - Virtual size: 76KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 20KB - Virtual size: 20KB

.xdata
Size: 16KB - Virtual size: 16KB

.idata
Size: 19KB - Virtual size: 76KB

.rsrc
Size: 1KB - Virtual size: 1KB