aa035853f8e4ebfc4ea22176f1d247ca_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

aa035853f8e4ebfc4ea22176f1d247ca_JaffaCakes118
Size

332KB
MD5

aa035853f8e4ebfc4ea22176f1d247ca
SHA1

10151879f689d2e5d05e4a8b72fbc8690163e802
SHA256

fb84490ba8ddfe5519ad483535bd5f4b2d7e4c3c22953c0c9485133c3680b232
SHA512

c6889e878451a029633eb76c35ea149dd2dadc2ac09a762e4d3582c490a7a99dd6bd7e09a707bc3c70ee1e20f071e23beae785a9944dd52d6566e3c8c4b2aa22
SSDEEP

6144:/btjODpX9PTjbia0fc39IRzGCrz5gEYZBSBtzbPQsFdl92AVPkHJ/qQ/jVpU:/BjO7LZT2RzPyPZBI9bPQ4dvR8xVpU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa035853f8e4ebfc4ea22176f1d247ca_JaffaCakes118

Files

aa035853f8e4ebfc4ea22176f1d247ca_JaffaCakes118
.exe windows:4 windows x86 arch:x86

78c428cc5d26182bf19c99afe33ed7de

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOverlappedResult
GetProcAddress
GetShortPathNameW
GetSystemDefaultLangID
GetSystemDirectoryA
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathW
GetTickCount
GetTimeFormatW
GetUserDefaultLangID
GetVersion
GetVersionExA
GetVersionExW
GetVolumeInformationW
GetVolumePathNameW
GlobalMemoryStatus
InitializeCriticalSection
InterlockedCompareExchange
InterlockedExchange
IsBadReadPtr
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LocalFree
MapViewOfFile
MoveFileExW
MoveFileW
MultiByteToWideChar
GetLogicalDriveStringsW
OpenProcess
OpenSemaphoreW
OutputDebugStringA
OutputDebugStringW
QueryDosDeviceW
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
RemoveDirectoryW
ResetEvent
SetEndOfFile
SetEvent
SetFileAttributesW
SetFilePointer
SetFileTime
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TerminateThread
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualQuery
WaitForMultipleObjectsEx
WaitForSingleObject
WaitNamedPipeW
WideCharToMultiByte
WriteFile
lstrcmpiA
lstrlenA
GetLocalTime
GetLastError
GetHandleInformation
GetFullPathNameW
GetFileTime
GetFileInformationByHandle
GetFileAttributesW
GetFileAttributesExW
GetFileAttributesA
GetExitCodeProcess
GetEnvironmentStringsW
GetDriveTypeW
GetDriveTypeA
GetDiskFreeSpaceW
GetDiskFreeSpaceExW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetComputerNameExW
GetACP
FreeLibrary
FreeEnvironmentStringsW
FormatMessageW
FormatMessageA
FlushFileBuffers
FindNextFileW
FindNextChangeNotification
FindFirstFileW
FindFirstChangeNotificationW
FindCloseChangeNotification
FindClose
ExitThread
EnterCriticalSection
DuplicateHandle
DeviceIoControl
DeleteFileW
DeleteCriticalSection
CreateThread
CreateProcessW
CreatePipe
CreateFileW
CreateFileMappingA
CreateFileA
CreateEventA
CreateDirectoryW
CloseHandle
OpenEventW
CancelIo

user32

UnhookWindowsHookEx
SetWindowsHookExA
RegisterWindowMessageW
PostThreadMessageA
PeekMessageA
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MessageBoxW
GetSystemMetrics
DispatchMessageA
CallNextHookEx

advapi32

RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
OpenThreadToken
OpenProcessToken
MapGenericMask
LookupPrivilegeValueA
LookupAccountNameW
LogonUserW
InitializeSecurityDescriptor
InitializeAcl
ImpersonateSelf
ImpersonateLoggedOnUser
GetUserNameW
GetTokenInformation
GetSecurityDescriptorControl
GetNamedSecurityInfoW
GetLengthSid
GetFileSecurityW
GetExplicitEntriesFromAclW
FreeSid
EqualSid
DuplicateTokenEx
DuplicateToken
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
CryptAcquireContextA
CheckTokenMembership
AllocateAndInitializeSid
AdjustTokenPrivileges
AddAccessAllowedAce
AccessCheck
RegQueryValueExA
RegQueryValueExW
RegSetKeySecurity
RegSetValueExA
RegSetValueExW
RevertToSelf
SetEntriesInAclW
SetSecurityDescriptorControl
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
RegOpenKeyExA

ole32

CoCreateInstance
CoUninitialize
CoSetProxyBlanket
CoInitialize
CoInitializeEx
CoQueryProxyBlanket
CoInitializeSecurity
CoTaskMemFree

ws2_32

inet_ntoa
socket
WSACleanup
WSACreateEvent
WSADuplicateSocketA
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSASetLastError
WSASocketA
WSAStartup
accept
bind
closesocket
connect
gethostbyaddr
setsockopt
gethostname
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
gethostbyname
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
send

winmm

waveOutGetDevCapsW
waveOutGetNumDevs

crypt32

CertGetCertificateChain
CertGetNameStringW
CertFreeCertificateContext
CertFreeCertificateChain
CertCreateCertificateContext

winspool.drv

SetPrinterW
OpenPrinterW
GetPrinterW
EnumPrintersW
ClosePrinter

Exports

Exports

SqmAddToAverage
SqmAddToStream
SqmAddToStreamDWord
SqmAddToStreamString
SqmAddToStreamV
SqmCleanup
SqmClearFlags
SqmCreateNewId
SqmEndSession
SqmFlushSession
SqmGetEnabled
SqmGetFlags
SqmGetMachineId
SqmGetSession
SqmGetSessionStartTime
SqmGetUserId
SqmIncrement
SqmIsWindowsOptedIn
SqmReadSharedMachineId
SqmReadSharedUserId
SqmSet
SqmSetAppId
SqmSetAppVersion
SqmSetBits
SqmSetBool
SqmSetCurrentTimeAsUploadTime
SqmSetEnabled
SqmSetFlags
SqmSetIfMax
SqmSetIfMin
SqmSetMachineId
SqmSetString
SqmSetUserId
SqmStartSession
SqmStartUpload
SqmSysprepGeneralize
SqmSysprepSpecialize
SqmTimerAccumulate
SqmTimerAddToAverage
SqmTimerRecord
SqmTimerStart
SqmUnattendedSetup
SqmWaitForUploadComplete
SqmWriteSharedMachineId
SqmWriteSharedUserId

Sections

.text
Size: 232KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

78c428cc5d26182bf19c99afe33ed7de

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

ws2_32

winmm

crypt32

winspool.drv

Exports

Exports

Sections

.text Size: 232KB - Virtual size: 232KB

.rdata Size: 44KB - Virtual size: 44KB

.data Size: 20KB - Virtual size: 1.7MB

.idata Size: 8KB - Virtual size: 8KB

.rsrc Size: 24KB - Virtual size: 24KB

.text
Size: 232KB - Virtual size: 232KB

.rdata
Size: 44KB - Virtual size: 44KB

.data
Size: 20KB - Virtual size: 1.7MB

.idata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 24KB - Virtual size: 24KB