ab579a7c8315c72d5fa8c2f44330ed1a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ab579a7c8315c72d5fa8c2f44330ed1a_JaffaCakes118
Size

179KB
MD5

ab579a7c8315c72d5fa8c2f44330ed1a
SHA1

301fbeee98012507d42eb3c7453608791cbe4d41
SHA256

203ec3578ec92cdbce2c831d463ac85831c5f427d7bf9c8e955b9a8d0c4b4091
SHA512

c61b85c5181e75f3a4270f2c6c9acbf4b25f1bb7ac39a65e4613e7ac8bad7852c827042080fc50ec3d389ab6c0cc59b68d8d54c1d7df16d26e6d24df513524e1
SSDEEP

3072:F713M6+BMb6btEBv1SoQMnj+Bd3b62FI6gT71yel8YRVGcqClOiWb:F718MObizSHtXO2cT71BNG6Oi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab579a7c8315c72d5fa8c2f44330ed1a_JaffaCakes118

Files

ab579a7c8315c72d5fa8c2f44330ed1a_JaffaCakes118
.exe windows:5 windows x86 arch:x86

bafb5af5f46e5790f0f95a22e7b57ab0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedPopEntrySList
lstrlen
FindResourceExA
LoadLibraryA
GetConsoleAliasesLengthA
TlsGetValue
LZSeek
WriteProfileStringA
WriteConsoleOutputCharacterW
GetExitCodeProcess
FindNextVolumeA
GetSystemWow64DirectoryA
VerifyConsoleIoHandle
RtlFillMemory
WriteConsoleOutputW
EnumResourceNamesA
QueryPerformanceFrequency
SetThreadUILanguage
SetPriorityClass
OpenJobObjectA
MultiByteToWideChar
GetConsoleCursorInfo
GlobalUnlock
SignalObjectAndWait
GetProfileIntW
WaitForSingleObjectEx
QueryInformationJobObject
SetFileValidData
MapUserPhysicalPages
GetFileAttributesA
GetExitCodeThread
IsProcessInJob
WriteConsoleInputW
OpenJobObjectW
GetTapeParameters
OpenEventW
GetThreadPriority
GetConsoleCommandHistoryA
GlobalUnWire
GetFileSize
SetCalendarInfoA
DeleteTimerQueueEx
BackupWrite
GetCompressedFileSizeW
WriteConsoleInputVDMA
BaseFlushAppcompatCache
GetFileSizeEx
LoadModule
LZInit
SetConsoleOS2OemFormat
lstrcpyW
HeapDestroy
AddRefActCtx
FindNextVolumeMountPointA
GlobalUnfix
RtlUnwind
WideCharToMultiByte
CreateJobObjectW
QueryDosDeviceA
DeleteFileA
SetConsoleInputExeNameW
GetCurrentActCtx
GetUserDefaultLCID
GetLongPathNameA
LocalReAlloc
SizeofResource
AddAtomW
HeapLock
CreateHardLinkA
ExpungeConsoleCommandHistoryA
OpenSemaphoreW
GenerateConsoleCtrlEvent
MapUserPhysicalPagesScatter
GlobalGetAtomNameA
VDMConsoleOperation
DefineDosDeviceW
SetThreadExecutionState
SetConsoleScreenBufferSize
WaitForMultipleObjects
FindNextChangeNotification
TlsAlloc
MoveFileWithProgressW
FillConsoleOutputCharacterW
SetSystemTimeAdjustment
SetConsoleMenuClose
VirtualUnlock
FreeEnvironmentStringsA
FlushFileBuffers
ReleaseSemaphore
EnumSystemCodePagesA
RequestDeviceWakeup
RegisterWowExec
CopyFileExA
FreeEnvironmentStringsW
CopyLZFile
GetVolumeInformationA
SetVolumeLabelW
SetFileShortNameW
FatalAppExitA
GetHandleInformation
VirtualProtectEx
TermsrvAppInstallMode
IsBadHugeReadPtr
GetTempFileNameA
GetTimeZoneInformation
FindClose
FreeLibrary
GetProcessIoCounters
SetProcessWorkingSetSize
LocalHandle
SetConsoleMaximumWindowSize
GetHandleContext
CmdBatNotification
ReadConsoleOutputCharacterW
GetOverlappedResult
VirtualAlloc
GetTempPathA
FindResourceExW
LoadLibraryExW
GetCurrentThread
_llseek
EnumResourceLanguagesA
AddConsoleAliasW
Module32Next
DosPathToSessionPathA
SetConsoleActiveScreenBuffer
CommConfigDialogA
WriteConsoleInputA
ResetWriteWatch
OpenFileMappingW
ReadConsoleInputExA
GetUserDefaultLangID
CreateDirectoryExW
CreateTapePartition
CallNamedPipeW
SwitchToThread
GetConsoleInputExeNameA
QueueUserAPC
EnumSystemLanguageGroupsW
ResetEvent
DeleteAtom
GetLocaleInfoW
DeleteTimerQueueTimer
EnumResourceLanguagesW
GetNumaHighestNodeNumber
SearchPathA
SetMailslotInfo
GetNativeSystemInfo
GetDiskFreeSpaceW
GetSystemDefaultUILanguage
DuplicateConsoleHandle
FormatMessageA
CreateDirectoryExA
DebugBreak
FindActCtxSectionStringW
LockFile
GetLocalTime
CreatePipe
GetModuleHandleA
RegisterWaitForSingleObjectEx
LocalAlloc
FindFirstVolumeA
GetAtomNameW
CreateMemoryResourceNotification
SystemTimeToFileTime
GlobalGetAtomNameW
SetFirmwareEnvironmentVariableA
TerminateJobObject
lstrcatA
GetEnvironmentStrings
CompareStringA
HeapFree
lstrcmpA
IsBadCodePtr
GetConsoleAliasA
WriteProfileSectionW
GetDevicePowerState
ScrollConsoleScreenBufferW
EnumDateFormatsExW
DuplicateHandle
SetThreadPriorityBoost
RegisterConsoleVDM
IsValidCodePage
UpdateResourceW
DeleteFileW
VirtualFree
FindNextFileA
GetPrivateProfileStringA
GetCompressedFileSizeA
EraseTape
Module32NextW
CreateEventA
GetLocaleInfoA
SetUnhandledExceptionFilter
GetQueuedCompletionStatus
GetSystemDirectoryA
SetFileShortNameA

msdart

?IsReadLocked@CSpinLock@@QBE_NXZ
MPInitializeCriticalSection
?ConvertSharedToExclusive@CCritSec@@QAEXXZ
?_Clear@CLKRLinearHashTable@@AAEX_N@Z
?_H0@CLKRLinearHashTable@@ABEKK@Z
?_EqualKeys@CLKRLinearHashTable@@ABE_NKK@Z
?TryWriteLock@CFakeLock@@QAE_NXZ
?_TryWriteLock@CReaderWriterLock2@@AAE_NJ@Z
?SetDefaultSpinAdjustmentFactor@CReaderWriterLock@@SGXN@Z
?ReadLock@CLKRHashTable@@QBEXXZ
?ConvertSharedToExclusive@CLKRHashTable@@QBEXXZ
FXMemAttach
?_TryLock@CSmallSpinLock@@AAE_NXZ
MpHeapReAlloc
??0CReaderWriterLock3@@QAE@XZ
?IsWin95@CMdVersionInfo@@SAHXZ
??4CCritSec@@QAEAAV0@ABV0@@Z
?IsWriteUnlocked@CSmallSpinLock@@QBE_NXZ
mpCalloc
?SetSpinCount@CReaderWriterLock3@@QAE_NG@Z
?_LockSpin@CReaderWriterLock@@AAEX_N@Z
?ConvertExclusiveToShared@CReaderWriterLock2@@QAEXXZ
?InsertHead@CLockedDoubleList@@QAEXQAVCListEntry@@@Z
?_H0@CLKRLinearHashTable@@CGKKK@Z
?ReadLock@CSpinLock@@QAEXXZ
?Unlock@CLockedSingleList@@QAEXXZ
?IsWin2k@CMdVersionInfo@@SAHXZ
?GetDefaultSpinAdjustmentFactor@CSmallSpinLock@@SGNXZ
?GetDefaultSpinCount@CSmallSpinLock@@SGGXZ
?Unlock@CLockedDoubleList@@QAEXXZ
?SetTableLockSpinCount@CLKRLinearHashTable@@QAEXG@Z
?_SegIndex@CLKRLinearHashTable@@ABEKK@Z
?DeleteKey@CLKRLinearHashTable@@QAE?AW4LK_RETCODE@@K@Z
?_ExtractKey@CLKRHashTable@@ABE?BKPBX@Z
?_LockSpin@CReaderWriterLock3@@AAEXW4SPIN_TYPE@1@@Z
?WriteLock@CCritSec@@QAEXXZ
MpHeapFree
??4CLKRHashTableStats@@QAEAAV0@ABV0@@Z
?TryWriteLock@CReaderWriterLock2@@QAE_NXZ
?IsUnlocked@CLockedDoubleList@@QBE_NXZ
?IsReadUnlocked@CCritSec@@QBE_NXZ

mprapi

MprDomainQueryRasServer
MprInfoRemoveAll
MprAdminUserOpen
MprDomainRegisterRasServer
MprGetUsrParams
MprInfoDuplicate
MprAdminConnectionEnum
MprConfigInterfaceTransportSetInfo
MprAdminPortReset
MprConfigInterfaceTransportGetHandle
MprConfigInterfaceTransportAdd
MprConfigInterfaceTransportEnum
MprAdminRegisterConnectionNotification
MprAdminInterfaceDelete
MprAdminMIBEntryGetNext
MprAdminUserClose
MprAdminServerGetCredentials
MprAdminMIBBufferFree
MprAdminDeregisterConnectionNotification
MprAdminGetPDCServer
MprConfigInterfaceSetInfo
MprAdminInterfaceEnum
MprAdminMIBEntrySet
MprAdminInterfaceSetInfo
MprAdminUserWriteProfFlags
MprAdminInterfaceDisconnect
MprAdminInterfaceTransportGetInfo
MprAdminInterfaceCreate
MprAdminMIBServerConnect
MprConfigGetGuidName
MprConfigServerConnect
MprConfigInterfaceCreate
MprConfigGetFriendlyName
MprConfigInterfaceGetHandle
MprConfigInterfaceTransportGetInfo
MprAdminMIBEntryGetFirst
MprAdminInterfaceDeviceSetInfo
MprAdminUserRead
MprInfoCreate
MprAdminInterfaceDeviceGetInfo
MprAdminIsServiceRunning
MprAdminMIBEntryDelete
MprAdminUserSetInfo
MprAdminMIBEntryGet
MprPortSetUsage

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 91KB - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bafb5af5f46e5790f0f95a22e7b57ab0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msdart

mprapi

Sections

.text Size: 52KB - Virtual size: 51KB

.rdata Size: 31KB - Virtual size: 31KB

.data Size: 91KB - Virtual size: 274KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 1024B - Virtual size: 888B

.text
Size: 52KB - Virtual size: 51KB

.rdata
Size: 31KB - Virtual size: 31KB

.data
Size: 91KB - Virtual size: 274KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1024B - Virtual size: 888B