ad03e18083ee58e028f983a4ebdc2490_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

ad03e18083ee58e028f983a4ebdc2490_JaffaCakes118
Size

507KB
MD5

ad03e18083ee58e028f983a4ebdc2490
SHA1

6c53a5a967bebf8d41e1b22f9ea8d7944cfb38dd
SHA256

2eea535a709749fa3416288add6b911c72a2768c2d9fcf7f24682fd0aefe7543
SHA512

4607a4523f0aa05e62e5149f779834b6881170d6e1268e496c7330ff78f93db422cfa70132fe8441cf55f017d1fd4f8a24ad58fd824cf711e2593f69d6b14eac
SSDEEP

12288:KxrEMhTP1oqN3OWy3onNCGgLXGHnxXi9sS:KxrNhThglCi9H

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad03e18083ee58e028f983a4ebdc2490_JaffaCakes118

Files

ad03e18083ee58e028f983a4ebdc2490_JaffaCakes118
.exe windows:5 windows x86 arch:x86

cd625d88e2a9fd41b5adb57b2239d04c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHBindToParent
SHGetDesktopFolder

advapi32

LsaFreeMemory
LsaClose
RegEnumValueW
ReportEventW
RegisterServiceCtrlHandlerExW
RegSetValueExW
QueryServiceConfigW
AddAccessAllowedAce
ChangeServiceConfigW
RegEnumKeyExW
RegDeleteKeyW
GetUserNameW
SetServiceStatus
SetFileSecurityW
StartServiceW
ImpersonateNamedPipeClient
FreeSid
LsaOpenPolicy
CloseServiceHandle
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyW
LogonUserW
SetSecurityDescriptorSacl
LsaRetrievePrivateData
QueryServiceStatus
SetSecurityDescriptorOwner
RegConnectRegistryW
GetLengthSid
LsaOpenSecret
InitializeAcl
AccessCheck
GetNamedSecurityInfoW
SetSecurityDescriptorDacl
AddAce
SetNamedSecurityInfoW
AllocateAndInitializeSid
RegCloseKey
RegDeleteValueW
LsaNtStatusToWinError
RegisterEventSourceW
CopySid
RegOpenKeyExW
RevertToSelf
ImpersonateLoggedOnUser
SetSecurityDescriptorGroup
RegEnumKeyW
InitializeSecurityDescriptor
RegOpenKeyA
ControlService
LsaSetSecret
GetSecurityDescriptorLength
RegQueryInfoKeyW
OpenServiceW
LsaCreateSecret
DeregisterEventSource
OpenThreadToken
OpenSCManagerW

ole32

StgPropertyLengthAsVariant
CoFileTimeNow
PropVariantClear
GetClassFile
CoUninitialize
PropVariantCopy
FreePropVariantArray
StgOpenStorage
StringFromGUID2
CoTaskMemAlloc
StgConvertVariantToProperty
PropSysAllocString
CoGetClassObject
CoInitializeEx
CoFreeUnusedLibraries
CreateBindCtx
CLSIDFromString
CoSetProxyBlanket
CoCreateInstance
CreateStreamOnHGlobal
PropSysFreeString
CoTaskMemFree
StgConvertPropertyToVariant

kernel32

LCMapStringW
SetFilePointer
CompareFileTime
GetFileAttributesExW
CloseHandle
GlobalFree
ResetEvent
ReadProcessMemory
GetDiskFreeSpaceExW
PeekNamedPipe
DeleteCriticalSection
CompareStringW
FreeLibrary
SleepEx
RemoveDirectoryW
GlobalUnlock
InitializeCriticalSectionAndSpinCount
GetSystemTime
HeapFree
GetUserDefaultLCID
GetCPInfo
OpenEventW
OpenFileMappingW
SetLastError
QueueUserAPC
FindFirstFileW
DuplicateHandle
GetSystemInfo
WaitNamedPipeW
SetEndOfFile
WideCharToMultiByte
GetThreadLocale
SetPriorityClass
InterlockedExchange
SwitchToThread
ReadFileEx
GetSystemPowerStatus
VirtualFree
GetLocaleInfoW
lstrlenA
SetFileAttributesW
GetTickCount
WriteFileEx
GetThreadPriority
FileTimeToSystemTime
FlushFileBuffers
OpenProcess
ResumeThread
InterlockedIncrement
LocalFree
GetLongPathNameW
SetProcessWorkingSetSize
SetErrorMode
IsDBCSLeadByteEx
FlushViewOfFile
ReleaseMutex
FoldStringW
GetACP
GetDiskFreeSpaceW
WaitForMultipleObjects
GetCurrentProcess
EnterCriticalSection
IsBadWritePtr
ConnectNamedPipe
CancelIo
DeviceIoControl
TryEnterCriticalSection
GetModuleFileNameW
GetProcAddress
GetLocalTime
GetThreadTimes
GetCurrentDirectoryW
GetSystemDefaultLCID
HeapDestroy
SetThreadPriority
HeapAlloc
CreateNamedPipeW
CreateThread
CreateMutexW
LoadLibraryA
GetExitCodeProcess
GetSystemTimeAsFileTime
FormatMessageW
ExpandEnvironmentStringsW
TransactNamedPipe
GetStringTypeW
FindClose
CreateFileMappingW
SystemTimeToFileTime
IsValidLocale
GetDriveTypeW
VirtualUnlock
SearchPathW
CreateFileW
SetThreadLocale
GetCalendarInfoW
GetLastError
MapViewOfFile
WaitForMultipleObjectsEx
FindNextFileW
GetSystemDirectoryW
GetComputerNameW
GetVersionExW
GetCurrentThread
LoadLibraryExW
GetCurrentProcessId
GetFileSize
WriteFile
WaitForSingleObject
MultiByteToWideChar
LeaveCriticalSection
DisconnectNamedPipe
GetLogicalDrives
ReadFile
SetCurrentDirectoryW
LocalFileTimeToFileTime
CreateDirectoryW
WaitForSingleObjectEx
GetVolumeInformationW
LocalAlloc
HeapCreate
QueryPerformanceCounter
DeleteFileW
GlobalLock
CreateEventW
QueryDosDeviceW
GetFileAttributesW
GetOverlappedResult
UnmapViewOfFile
SetEvent
HeapSize
InterlockedDecrement
SetNamedPipeHandleState
GlobalAlloc
SetUnhandledExceptionFilter

msvcrt

_wcsupr
isxdigit
_ultow
wcscmp
swscanf
towupper
??1type_info@@UAE@XZ
_CxxThrowException
?terminate@@YAXXZ
_itow
wcsstr
_ftol
fgets
wcsncmp
__dllonexit
memmove
__CxxFrameHandler
wcstol
strtoul
toupper
swprintf
wcstod
_wfopen
strchr
_except_handler3
strcspn
realloc
wcsrchr
wcschr
_wcsicmp
wcscpy
_initterm
sprintf
_stricmp
wcstoul
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
wcsncpy
_errno
_wsplitpath
wcslen
_strnicmp
malloc
towlower
wcscat
_wcsnicmp
fclose
_adjust_fdiv
strncpy
wcstombs
_onexit
qsort
iswalpha
mbstowcs
isdigit
_wcslwr
isalpha
bsearch
free
wcsspn
??3@YAXPAX@Z
wcscspn
iswdigit
iswspace

ntdll

NtFsControlFile
NtOpenThreadToken
NtCreateFile
NtWaitForSingleObject
NtQueryVolumeInformationFile
RtlNtStatusToDosError
NtDeviceIoControlFile
NtNotifyChangeKey
NtQuerySystemTime
RtlUpcaseUnicodeChar
NtOpenProcessToken
NtOpenKey
NtOpenFile
RtlFreeHeap
NtCancelIoFile
NtNotifyChangeDirectoryFile
RtlDosPathNameToNtPathName_U
RtlUnicodeStringToOemString
RtlInitAnsiString
RtlInitUnicodeString
NtCreateEvent
NtQueryDirectoryFile
RtlQueryRegistryValues
NtQueryInformationProcess
NtDuplicateToken
NtQuerySystemInformation
RtlCaptureStackBackTrace
RtlOemStringToUnicodeString
NtClose
NtQueryInformationToken
NtSetInformationFile
NtQuerySecurityObject
NtQueryInformationFile

rpcrt4

CStdStubBuffer_AddRef
IUnknown_Release_Proxy
NdrCStdStubBuffer_Release
IUnknown_AddRef_Proxy
NdrDllGetClassObject
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_DebugServerRelease
NdrDllRegisterProxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_Connect
IUnknown_QueryInterface_Proxy
NdrOleAllocate
NdrDllUnregisterProxy
NdrOleFree
UuidFromStringW
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Disconnect

user32

TranslateMessage
RegisterDeviceNotificationW
UnregisterDeviceNotification
PeekMessageW
GetLastInputInfo
MsgWaitForMultipleObjects
DispatchMessageW
wsprintfW

Sections

.9618ds
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.B^br5
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.@#RFER
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.N^UHQt
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.h46asrg
Size: 176KB - Virtual size: 175KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.64h4aer
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cd625d88e2a9fd41b5adb57b2239d04c

Headers

File Characteristics

Imports

shell32

advapi32

ole32

kernel32

msvcrt

ntdll

rpcrt4

user32

Sections

.9618ds Size: 2KB - Virtual size: 1KB

.B^br5 Size: 512B - Virtual size: 2B

.@#RFER Size: 171KB - Virtual size: 170KB

.N^UHQt Size: 58KB - Virtual size: 57KB

.h46asrg Size: 176KB - Virtual size: 175KB

.64h4aer Size: 97KB - Virtual size: 97KB

.9618ds
Size: 2KB - Virtual size: 1KB

.B^br5
Size: 512B - Virtual size: 2B

.@#RFER
Size: 171KB - Virtual size: 170KB

.N^UHQt
Size: 58KB - Virtual size: 57KB

.h46asrg
Size: 176KB - Virtual size: 175KB

.64h4aer
Size: 97KB - Virtual size: 97KB