973d002e84f056ae606c120ecb694d97_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

973d002e84f056ae606c120ecb694d97_JaffaCakes118
Size

857KB
MD5

973d002e84f056ae606c120ecb694d97
SHA1

e70d74f02fb506218b2935b5445a80df14661898
SHA256

c3ef9c44211297a6a2474d15a2ffb27a8db62116b4648e1480d3bfb4b7791bc4
SHA512

05e2f91e282919a4c0fd2d98d3c675cfd1debb403e091d5877983c893074aee2f68fef893f77c1537aa8c13655d7de9b3f7f6fe55678918a31ef80a35897a613
SSDEEP

24576:siJIZB1so4Gk3c6owYXHKI96EhNU6mm2IGim:siJIZko4GLXTPNIIGim

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
973d002e84f056ae606c120ecb694d97_JaffaCakes118

Files

973d002e84f056ae606c120ecb694d97_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a1d6e44b862ea8d5a1e5766296bd9a7b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsGetValue
GetModuleHandleExA
GetBinaryType
GetUserDefaultLCID
GetTapeStatus
NlsGetCacheUpdateCount
Thread32Next
GetConsoleCommandHistoryW
BaseDumpAppcompatCache
GlobalAddAtomA
GetOEMCP
SetSystemTime
VerLanguageNameW
LZRead
VirtualAlloc
TransactNamedPipe
GetPrivateProfileStructA
GetConsoleProcessList
CreateNamedPipeW
CancelDeviceWakeupRequest
EnumerateLocalComputerNamesW
GetPrivateProfileSectionNamesW
DebugSetProcessKillOnExit
WriteConsoleInputVDMW
SetConsoleNumberOfCommandsA
WaitForSingleObjectEx
VerSetConditionMask
GetProfileIntW
GetCurrencyFormatW
FindFirstChangeNotificationW
LoadLibraryA
GetFileAttributesA
SetEvent
QueryPerformanceCounter
GetNumberOfConsoleFonts
FindFirstFileA
FindNextVolumeMountPointA
SetConsoleInputExeNameW
GetConsoleCursorInfo
FindNextChangeNotification
FindFirstFileExA
Thread32First

advapi32

RegOpenUserClassesRoot
DeleteService
WmiQueryAllDataA
LookupAccountNameA
LsaEnumerateAccountRights
SaferiCompareTokenLevels
WmiExecuteMethodA
BackupEventLogA
SystemFunction023
RegisterIdleTask
AllocateLocallyUniqueId
RegDeleteValueW
GetNumberOfEventLogRecords
ReportEventA
QueryServiceLockStatusA
AccessCheckByType
GetSecurityDescriptorControl
AllocateAndInitializeSid
SystemFunction001
GetUserNameA
CredWriteDomainCredentialsA
QueryServiceStatusEx
QueryServiceConfig2W
GetInheritanceSourceA
PrivilegedServiceAuditAlarmW
SetPrivateObjectSecurityEx
WmiDevInstToInstanceNameA
WmiDevInstToInstanceNameW
LsaSetTrustedDomainInformation
AddAccessAllowedAce
RegQueryMultipleValuesA

netapi32

NetReplExportDirUnlock
NetServerSetInfo
NetUseDel
I_NetDatabaseSync
NetpMergeFtinfo
NetServerTransportAddEx
NetLogonSetServiceBits
NetShareDel
NetAlertRaiseEx
NetpAddTlnFtinfoEntry
NetApiBufferSize
NetDfsAdd
NetServerDiskEnum
I_BrowserQueryOtherDomains
NetpSetFileSecurity
NetUserChangePassword
DsAddressToSiteNamesExA
NetServiceEnum
I_NetServerTrustPasswordsGet
NetGroupGetInfo
NetGetJoinableOUs
NetShareDelSticky
I_NetServerSetServiceBits
RxNetUserPasswordSet
I_BrowserQueryEmulatedDomains
NetFileGetInfo
NetReplExportDirLock
NetDfsAddStdRoot
DsAddressToSiteNamesExW
NetApiBufferFree
I_NetLogonUasLogoff
NetLocalGroupAddMember
NetSetPrimaryComputerName
I_BrowserQueryStatistics
NetpwNameCompare
NetWkstaTransportAdd
I_NetServerGetTrustInfo
NetRemoteTOD
NetLocalGroupAdd
NetDfsRemoveFtRoot
NetSessionEnum
I_NetServerAuthenticate

hlink

HlinkCreateShortcutFromString
HlinkCreateFromData
HlinkNavigateToStringReference
HlinkGetValueFromParams
HlinkResolveShortcutToString
HlinkResolveStringForData
HlinkGetSpecialReference
HlinkCreateShortcut
HlinkCreateFromString
HlinkParseDisplayName
HlinkCreateExtensionServices
HlinkClone
HlinkResolveShortcut
HlinkCreateFromMoniker
DllGetClassObject
HlinkTranslateURL
HlinkSetSpecialReference
HlinkIsShortcut
HlinkResolveMonikerForData
HlinkResolveShortcutToMoniker
HlinkOnNavigate
HlinkNavigate
HlinkCreateBrowseContext
HlinkCreateShortcutFromMoniker
HlinkUpdateStackItem
HlinkQueryCreateFromData
HlinkOnRenameDocument
OleSaveToStreamEx
HlinkPreprocessMoniker

ntdll

iscntrl
RtlpNtOpenKey
NtSetVolumeInformationFile
RtlNumberOfSetBits
RtlCreateRegistryKey
ZwOpenSymbolicLinkObject
ZwQueryTimer
RtlQueryInformationActivationContext
RtlDeleteTimer
RtlLocalTimeToSystemTime
ZwAccessCheck
ZwAcceptConnectPort
RtlAnsiCharToUnicodeChar
RtlConvertSharedToExclusive
PfxInsertPrefix
swprintf
RtlGetCallersAddress
NtCompareTokens
RtlUpcaseUnicodeStringToOemString
RtlUnicodeToMultiByteSize
RtlIntegerToChar
RtlFillMemory
_ltoa
ZwCreateJobSet
NtProtectVirtualMemory
RtlInt64ToUnicodeString
ZwQueryMultipleValueKey
RtlpNtEnumerateSubKey
NtOpenMutant
NtPrivilegeCheck
NtQueryDirectoryFile
NtTranslateFilePath
_wcsnicmp
RtlNewSecurityGrantedAccess
RtlxAnsiStringToUnicodeSize
ZwReleaseSemaphore
RtlCharToInteger
RtlFormatCurrentUserKeyPath
NtSaveKeyEx

crtdll

_strnicmp
asin
_ftime
_ctype
_execve
_eof
_fputchar
_ismbbkalnum
_dup
_mbsset
atan2
_snprintf
vfprintf
_spawnv
bsearch
mbtowc
_cprintf
_heapchk
_scalb
iswalnum
_CItan
_CIpow
_statusfp
_mbsncpy
_spawnlpe
_mbscspn
_ismbcspace
_baseversion_dll
iswspace
_initterm
_heapset
memcpy
_setsystime
strcmp
_tempnam
tolower
_strerror
_execvp
_beep

setupapi

SetupDiGetDriverInfoDetailW
CM_Request_Eject_PC
CM_Create_Range_List
SetupGetLineCountW
SetupQueueDefaultCopyA
CM_Get_Parent_Ex
CM_Request_Eject_PC_Ex
CM_Get_Class_Key_Name_ExW
SetupRenameErrorA
SetupDiGetActualSectionToInstallExW
SetupUninstallOEMInfA
CM_Remove_SubTree_Ex
CM_Get_Sibling
SetupGetIntField
pSetupIsGuidNull
CM_Get_DevNode_Custom_PropertyW
SetupDiClassGuidsFromNameW
CM_Enable_DevNode
InstallHinfSection
CM_Get_Depth
CM_Set_DevNode_Problem
SetupGetFieldCount
SetupDiCreateDeviceInfoListExA
pSetupInstallCatalog
CM_Query_And_Remove_SubTree_ExW

Sections

.text
Size: 352KB - Virtual size: 352KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 370KB - Virtual size: 370KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 132KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a1d6e44b862ea8d5a1e5766296bd9a7b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

netapi32

hlink

ntdll

crtdll

setupapi

Sections

.text Size: 352KB - Virtual size: 352KB

.rdata Size: 370KB - Virtual size: 370KB

.data Size: 132KB - Virtual size: 1.5MB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 352KB - Virtual size: 352KB

.rdata
Size: 370KB - Virtual size: 370KB

.data
Size: 132KB - Virtual size: 1.5MB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 1024B - Virtual size: 1024B