a624d3586fbdcb6f693a093fee0a72c7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a624d3586fbdcb6f693a093fee0a72c7_JaffaCakes118
Size

1.1MB
MD5

a624d3586fbdcb6f693a093fee0a72c7
SHA1

5b22b70b68a7a1e644ab6aa6665c9e8bf27bc567
SHA256

55965fa2e0416a66eb5b001af48e6058a25fb54387c6f0723eabddb6481ee1ce
SHA512

fae66484556af6c21bc275e4c794f628603bad48b481ebcaf338f00d5fff8348024fb79a1d09b0d167756622ce3bca93040944984a64a8111a8a7b69fa67493b
SSDEEP

12288:A7B9LeEWLh6erh+KVWtzsD9QLKWVXZNtq:AALVrh+KAtI+L1J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a624d3586fbdcb6f693a093fee0a72c7_JaffaCakes118

Files

a624d3586fbdcb6f693a093fee0a72c7_JaffaCakes118
.dll windows:6 windows x64 arch:x64

30d69b4d8f034900c660cc10ab56ae71

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetThreadPriorityBoost
GetTickCount
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
GetModuleHandleA
GetCurrentThread
LoadLibraryExW
GetProcessAffinityMask
CreateSemaphoreW
CreateFileMappingA
GetNamedPipeHandleStateA
EnumSystemCodePagesA
GetSystemTimeAsFileTime
CreateThread
GetCurrentProcess
Sleep
CreateMutexA
WaitForSingleObject
ReleaseMutex
ReleaseSemaphore
PostQueuedCompletionStatus
CreateIoCompletionPort
HeapSetInformation
SetNamedPipeHandleState
CreatePipe
GetLastError
CloseHandle
WriteFile
RemoveDirectoryA
ReadFile
GetFileSize
GetFileAttributesA
GetProcAddress
CreateFileW
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InitializeSListHead

advapi32

SaferSetLevelInformation
SaferGetLevelInformation
SaferCloseLevel
SaferCreateLevel
OpenServiceA
OpenSCManagerA
CloseServiceHandle
AccessCheckByTypeResultListAndAuditAlarmByHandleA
OpenEventLogA
CloseEventLog
SetSecurityDescriptorControl
RevertToSelf
PrivilegeCheck
ImpersonateLoggedOnUser
GetSecurityDescriptorControl
FreeSid
AllocateAndInitializeSid
AccessCheck
OpenProcessToken
CreateProcessAsUserW

shell32

ord231
ord232
SHChangeNotify
SHGetFolderPathW
SHGetFolderPathA
DragQueryPoint
DragFinish
DoEnvironmentSubstA
DoEnvironmentSubstW
Shell_NotifyIconA
SHGetDiskFreeSpaceExW
SHIsFileAvailableOffline
SHGetUnreadMailCountW
SHGetInstanceExplorer
ord176
SHSetUnreadMailCountW

shlwapi

StrCSpnIA
PathIsSystemFolderA
PathIsUNCServerA
ColorAdjustLuma
StrChrW
SHRegGetUSValueA
SHEnumValueW
UrlGetLocationW
UrlIsA
SHRegSetUSValueA
UrlCompareW
PathRemoveBlanksA

dbghelp

MiniDumpReadDumpStream
SymGetTypeInfo
SymFromName
SymInitialize
SymCleanup
GetTimestampForLoadedLibrary
ImagehlpApiVersionEx
ImagehlpApiVersion

winmm

mixerGetDevCapsA
mixerGetNumDevs
midiInGetID
midiInGetErrorTextA
midiInGetNumDevs
mmioOpenA
mciGetYieldProc
mciGetCreatorTask
mciGetDeviceIDW
mciGetDeviceIDA
mixerGetID
mmioClose
timeGetSystemTime

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

strchr
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__std_type_info_destroy_list
memchr
memcmp
memcpy
memmove
memset
__C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_initialize_narrow_environment
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_configure_narrow_argv

api-ms-win-crt-string-l1-1-0

isxdigit
isprint
strncpy
strncmp
strncat
_wcsnicmp
wcsncpy
wcsncat
isspace

api-ms-win-crt-utility-l1-1-0

srand
qsort
rand

api-ms-win-crt-convert-l1-1-0

strtoul
_itoa
_ultoa
_ultow
_ltoa
_itow

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
__stdio_common_vfprintf
fputc

api-ms-win-crt-math-l1-1-0

log
floor
sqrt
atan2
exp
pow

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free

Exports

Exports

DenormalizeC

Sections

.text
Size: 852KB - Virtual size: 851KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 98KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

30d69b4d8f034900c660cc10ab56ae71

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

shlwapi

dbghelp

winmm

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

Exports

Exports

Sections

.text Size: 852KB - Virtual size: 851KB

.rdata Size: 158KB - Virtual size: 157KB

.data Size: 98KB - Virtual size: 101KB

.pdata Size: 6KB - Virtual size: 5KB

.idata Size: 2KB - Virtual size: 2KB

.rsrc Size: 40KB - Virtual size: 39KB

.reloc Size: 512B - Virtual size: 428B

.text
Size: 852KB - Virtual size: 851KB

.rdata
Size: 158KB - Virtual size: 157KB

.data
Size: 98KB - Virtual size: 101KB

.pdata
Size: 6KB - Virtual size: 5KB

.idata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 40KB - Virtual size: 39KB

.reloc
Size: 512B - Virtual size: 428B