93cd5a2190618ac503a98bd0a2e1f8fe_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

93cd5a2190618ac503a98bd0a2e1f8fe_JaffaCakes118
Size

362KB
MD5

93cd5a2190618ac503a98bd0a2e1f8fe
SHA1

719a76e774f849af9db7b11b9da83aac6e483949
SHA256

f675c622ef03c3b8656f347d6f257980ce713ba1c7af3ddc5a2d0a7f277dfb4a
SHA512

a9fc586f99d9c6642e7184473752aa6a3925da74ae9949ffb259e6d11667e92ad9bbc5f877d3496379884f871d9fc488dcf4cfc4f5c68e0bae9e756ee98e089d
SSDEEP

6144:YAPIE1Ng4BBw8h1EDVdQc4R3YudEaVzASej+cjPgWbTR3nYVFTo5hfkfnbNJY5fa:YAPIM28hCJyc4RFEaI+YphYV1o5tkfnV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
93cd5a2190618ac503a98bd0a2e1f8fe_JaffaCakes118

Files

93cd5a2190618ac503a98bd0a2e1f8fe_JaffaCakes118
.exe windows:5 windows x86 arch:x86

fc4ec909a46ebc097df1978842d37443

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlEnlargedUnsignedMultiply
CsrIdentifyAlertableThread
DbgSetDebugFilterState
ZwFlushBuffersFile
RtlLookupElementGenericTableAvl
isupper
DbgPrintReturnControlC
RtlImageDirectoryEntryToData
vDbgPrintEx
RtlFirstEntrySList
RtlValidAcl
RtlValidateProcessHeaps
memset
NtResumeProcess
NtSetInformationDebugObject
_wcsicmp
ZwSetSystemEnvironmentValueEx
RtlAddAccessDeniedObjectAce
RtlDestroyAtomTable
RtlUnlockBootStatusData
ZwSetVolumeInformationFile
NtMakeTemporaryObject
NlsAnsiCodePage
RtlCompressBuffer
NtQueryInstallUILanguage
ZwQuerySymbolicLinkObject
NtRequestWaitReplyPort
RtlOemStringToUnicodeString
ZwAdjustGroupsToken
RtlpNtMakeTemporaryKey
ZwSetLowEventPair
RtlFormatCurrentUserKeyPath
NtLockProductActivationKeys
RtlDeregisterWaitEx
RtlGetCurrentPeb
ZwCreatePort
ZwStopProfile
NtFilterToken
ZwQueryPortInformationProcess
_ui64tow
isalnum
NtQueryMultipleValueKey
RtlSetIoCompletionCallback
NtQueryDefaultUILanguage
CsrGetProcessId

advapi32

TreeResetNamedSecurityInfoW
OpenBackupEventLogW
PrivilegeCheck
SetAclInformation
SetNamedSecurityInfoExA
RegEnumKeyW
MakeAbsoluteSD
GetTokenInformation
EqualDomainSid
CryptDecrypt
GetSecurityDescriptorGroup
LsaICLookupSidsWithCreds
LsaGetRemoteUserName
ControlTraceA
SystemFunction026
CredUnmarshalCredentialW
ControlService
RegGetKeySecurity
WmiQuerySingleInstanceMultipleW
CredpEncodeCredential
ElfBackupEventLogFileA
EnumerateTraceGuids
SystemFunction017
ImpersonateAnonymousToken
LsaGetUserName
CryptCreateHash
IsTokenRestricted
ObjectCloseAuditAlarmW
CryptEnumProviderTypesW
RegEnumKeyA

msdart

??0CSmallSpinLock@@QAE@XZ
?_BucketAddress@CLKRLinearHashTable@@ABEKK@Z
?GetDefaultSpinAdjustmentFactor@CSmallSpinLock@@SGNXZ
?RemoveTail@CLockedDoubleList@@QAEQAVCListEntry@@XZ
?ConvertSharedToExclusive@CReaderWriterLock@@QAEXXZ
?ConvertSharedToExclusive@CLKRHashTable@@QBEXXZ
?IsEmpty@CDoubleList@@QBE_NXZ
?GetSpinCount@CSpinLock@@QBEGXZ
?IsWriteUnlocked@CReaderWriterLock@@QBE_NXZ
??4CReaderWriterLock2@@QAEAAV0@ABV0@@Z
?sm_llGlobalList@CLKRLinearHashTable@@0VCLockedDoubleList@@A
?WriteLock@CLKRHashTable@@QAEXXZ
?FindRecord@CLKRLinearHashTable@@QBE?AW4LK_RETCODE@@PBX@Z
?RemoveHead@CDoubleList@@QAEQAVCListEntry@@XZ
??4CSmallSpinLock@@QAEAAV0@ABV0@@Z
?IsValid@CLKRLinearHashTable@@QBE_NXZ
?SetSpinCount@CCritSec@@SGKPAPAVCCriticalSection@@K@Z
??0CDoubleList@@QAE@XZ
?IsReadLocked@CSmallSpinLock@@QBE_NXZ
?IsReadLocked@CFakeLock@@QBE_NXZ
?GetDefaultSpinAdjustmentFactor@CReaderWriterLock2@@SGNXZ
?FindKey@CLKRLinearHashTable@@QBE?AW4LK_RETCODE@@KPAPBX@Z
??0CFakeLock@@QAE@XZ
?sm_pfnSetCriticalSectionSpinCount@CCriticalSection@@0P6GKPAU_RTL_CRITICAL_SECTION@@K@ZA
?ValidSignature@CLKRLinearHashTable@@QBE_NXZ
?SetSpinCount@CSpinLock@@QAE_NG@Z
?ReadLock@CSmallSpinLock@@QAEXXZ
?sm_dblDfltSpinAdjFctr@CReaderWriterLock3@@1NA
?ReadOrWriteUnlock@CSpinLock@@QAEX_N@Z

mscms

InternalGetPS2ColorSpaceArray
UnregisterCMMA
AssociateColorProfileWithDeviceA
SetColorProfileHeader
GetPS2ColorRenderingDictionary
GetPS2ColorRenderingIntent
IsColorProfileValid
UnregisterCMMW
InternalSetDeviceConfig
SpoolerCopyFileEvent
SetStandardColorSpaceProfileW
OpenColorProfileA
GetColorProfileFromHandle
GetStandardColorSpaceProfileA
SelectCMM
RegisterCMMA
RegisterCMMW
DisassociateColorProfileFromDeviceW
OpenColorProfileW
TranslateBitmapBits
EnumColorProfilesA
GetColorProfileElement
GenerateCopyFilePaths
CreateMultiProfileTransform
SetStandardColorSpaceProfileA
IsColorProfileTagPresent
AssociateColorProfileWithDeviceW
CheckBitmapBits
GetColorDirectoryA
InstallColorProfileA
InternalGetDeviceConfig
SetColorProfileElement
GetCMMInfo
DeleteColorTransform
GetCountColorProfileElements
InternalGetPS2CSAFromLCS
GetNamedProfileInfo
CreateColorTransformW
CreateDeviceLinkProfile
UninstallColorProfileW
InstallColorProfileW
InternalGetPS2PreviewCRD
InternalGetPS2ColorRenderingDictionary

kernel32

GetBinaryTypeA
LCMapStringA
QueryPerformanceFrequency
VDMOperationStarted
LocalHandle
HeapLock
SetThreadExecutionState
Process32Next
SetCommBreak
QueueUserAPC
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetShortPathNameW
IsWow64Process
RtlUnwind
OpenSemaphoreA
GetVersionExA
SetCriticalSectionSpinCount
MapUserPhysicalPagesScatter
SetNamedPipeHandleState
GetStartupInfoW
WaitNamedPipeW
IsValidLanguageGroup
lstrcpy
GetOverlappedResult
GetModuleHandleW
lstrcmp
UTRegister
CreateFileW
GetCommModemStatus
GlobalFindAtomA
GlobalFindAtomW
EnumSystemLanguageGroupsA
lstrcmpiA
RegisterWaitForSingleObject
MoveFileWithProgressW
QueryPerformanceCounter
IsDBCSLeadByte
RemoveLocalAlternateComputerNameW
VirtualAlloc
OutputDebugStringA

glu32

gluQuadricNormals
gluTessVertex
gluDeleteTess
gluBuild1DMipmaps
gluLoadSamplingMatrices
gluTessNormal
gluQuadricOrientation
gluNewTess
gluQuadricDrawStyle
gluDeleteNurbsRenderer
gluNextContour
gluProject
gluNurbsCurve
gluPwlCurve
gluPartialDisk
gluCylinder
gluTessBeginPolygon
gluBeginPolygon
gluPickMatrix
gluDisk
gluTessBeginContour
gluNurbsSurface
gluEndCurve
gluTessProperty
gluEndTrim
gluBeginSurface
gluNewQuadric
gluTessCallback
gluEndPolygon
gluErrorString
gluQuadricTexture
gluQuadricCallback
gluTessEndPolygon
gluUnProject
gluLookAt
gluDeleteQuadric
gluBuild2DMipmaps
gluNurbsCallback
gluPerspective
gluBeginCurve
gluNurbsProperty
gluOrtho2D
gluGetString
gluGetNurbsProperty

query

?Refresh@CCiRegParams@@QAEXPAUICiAdminParams@@H@Z
?GetSZParam@CMachineAdmin@@QAEHPBGPAGK@Z
?ChangeCurrentScope@CCatState@@QAEXPBG@Z
??1CImpersonateClient@@QAE@XZ
?Next@CEnumString@@UAGJKPAPAGPAK@Z
??1CCatalogEnum@@QAE@XZ
?GetPropType@CEmptyPropertyList@@SGGI@Z
?GetSectorSize@CDriveInfo@@QAEKXZ
??1CPropertyList@@UAE@XZ
?PauseCI@CMachineAdmin@@QAEHXZ
?UnMarshall@CDbContentVector@@QAEHAAVPDeSerStream@@@Z
??0CPropNameArray@@QAE@I@Z
?Marshall@CVectorRestriction@@QBEXAAVPSerStream@@@Z
?NotifyWriteRead@CRequestClient@@QAEHPAX0K0KAAK@Z
?GetDWORDParam@CMachineAdmin@@QAEHPBGAAK@Z
?Empty@CSdidLookupTable@@QAEXXZ
??0CTransaction@@QAE@XZ
?GetVPathAccess@CMetaDataMgr@@QAEKPBG@Z
??0CQueryScanner@@QAE@PBGHKH@Z
?GetCY@CAllocStorageVariant@@QBE?ATtagCY@@I@Z
?Write@CDynStream@@QAEXPAXK@Z
?GetPropInfo@CEmptyPropertyList@@QAEHABVCDbColId@@PAPBGPAGPAI@Z
??0CAllocStorageVariant@@QAE@PBGAAVPMemoryAllocator@@@Z
CITextToFullTreeEx
?ReadProperty@CPropertyStore@@QAEHKKAAUtagPROPVARIANT@@@Z

Sections

.text
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 147KB - Virtual size: 551KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fc4ec909a46ebc097df1978842d37443

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

advapi32

msdart

mscms

kernel32

glu32

query

Sections

.text Size: 89KB - Virtual size: 89KB

.rdata Size: 115KB - Virtual size: 115KB

.data Size: 147KB - Virtual size: 551KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 89KB - Virtual size: 89KB

.rdata
Size: 115KB - Virtual size: 115KB

.data
Size: 147KB - Virtual size: 551KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 1024B - Virtual size: 1024B