b6252ba0f901e7751f6f1a06c9ca93fc_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

b6252ba0f901e7751f6f1a06c9ca93fc_JaffaCakes118
Size

27KB
MD5

b6252ba0f901e7751f6f1a06c9ca93fc
SHA1

2cf7c290a3af9edaa4769e7e6517d84c5f438d43
SHA256

3235cf93fc3993a503af6f38a0a7009f87c29e987ec079d26fd0696892b4ac1c
SHA512

40647884a6d92cc6c54873b12a530097a35597de975f577e137f51b3c0cde42203bb223079053950a311a6346509f2c3ae2f33bdf2365f133c9abd199504f2fc
SSDEEP

768:nFP8O36MVBXdtx1U5uKGP8EMV+lYK3FJIBRdC8:nB8O36MVzcuN7X1JITp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b6252ba0f901e7751f6f1a06c9ca93fc_JaffaCakes118

Files

b6252ba0f901e7751f6f1a06c9ca93fc_JaffaCakes118
.exe windows:5 windows x86 arch:x86

1331d499e4f1437ddfb8d20b64550783

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

sqlwoa

_CreateWindowEx@48
_FormatMessage@28
_CharUpper@4
_CreateDialogIndirectParam@20
_tsystem
_GetTextExtentPoint@16
_CommDlg_OpenSave_GetSpec@12
_trename
_LoadMenu@8
_GetTextExtentPoint32@16
_GetOpenFileName@4
_DrawText@20
_MessageBox@16
_GetDiskFreeSpaceEx@16
_LoadIcon@8
newMultiByteFromWideChar
_TextOut@20
_SetDlgItemText@12
_GetComputerName@8
_GetFileTitle@12
_RemoveProp@8
_GetDlgItemText@16
_GetUserName@8
_CharLower@4
_CreateFile@28
_SendMessage@16
_CommDlg_OpenSave_GetFolderPath@12
_DeleteFile@4
newMultiByteFromWideCharEx
_GetClassInfo@12
_CallWindowProc@20
_FindResource@12

ntdll

ZwAddBootEntry
NtLockProductActivationKeys
RtlEnlargedUnsignedDivide
NtReplyWaitReceivePortEx
RtlSetControlSecurityDescriptor
RtlInitializeRXact
NtOpenSection
NtCreateEventPair
ZwFlushInstructionCache
LdrUnloadDll
ZwSetEventBoostPriority
NtCallbackReturn
ZwRestoreKey
LdrGetProcedureAddress
RtlInitCodePageTable
ZwQueryMultipleValueKey
NtPrivilegeCheck
__toascii
RtlIsActivationContextActive
ZwQueryInformationJobObject
_stricmp
RtlQueryEnvironmentVariable_U
NtSystemDebugControl
RtlAppendStringToString
ZwWaitForDebugEvent
NtReadFileScatter
RtlSetThreadIsCritical
NtCreateMutant

opengl32

glDeleteLists
glClear
glCallList
glSelectBuffer
glColor4f
glRecti
glGetMaterialiv
glLightModeli
wglDeleteContext
glColor4bv
glNormal3b
glTranslatef
glTexCoord1f
glEdgeFlagPointer
GlmfEndGlsBlock
glBindTexture
glTexCoord2d
glTexCoord2sv
glGetPointerv
wglDescribePixelFormat
glColor4ui
glVertex2iv
glTexCoord1s
glGetTexLevelParameterfv
wglUseFontBitmapsW
glShadeModel
glColor4ub
glPolygonStipple
glColor4ubv
wglCreateLayerContext
glColor3bv
glColor3ub
glCopyTexSubImage2D
glColorMaterial
glGetPolygonStipple
glRasterPos4d

kernel32

ExpungeConsoleCommandHistoryW
GlobalFix
SetThreadLocale
lstrlenW
CloseHandle
CreateFileMappingW
MoveFileA
GetVersion
GetThreadPriorityBoost
IsBadWritePtr
GetProcessTimes
FindFirstChangeNotificationA
Beep
TlsAlloc
CreateIoCompletionPort
EnterCriticalSection
FileTimeToDosDateTime
RtlMoveMemory
VirtualUnlock
PostQueuedCompletionStatus
WritePrivateProfileStructA
QueueUserWorkItem
VirtualAlloc
CopyFileW
Sleep
CreateMemoryResourceNotification
Module32NextW
SetLocaleInfoW
QueryActCtxW
SetVolumeLabelW
CommConfigDialogW

msrating

ChangeSupervisorPassword
RatingCustomAddRatingSystem
RatingCustomInit
RatingCustomDeleteCrackedData
RatingEnabledQuery
RatingAccessDeniedDialog2
ClickedOnRAT
RatingEnable
DllCanUnloadNow
VerifySupervisorPassword
RatingInit
RatingCheckUserAccess
RatingObtainCancel
RatingCustomSetUserOptions
RatingCustomSetDefaultBureau
RatingSetupUI
ClickedOnPRF
RatingCustomRemoveRatingHelper
RatingAddPropertyPages
RatingCustomCrackData
RatingFreeDetails
RatingAccessDeniedDialog
DllGetClassObject

gdi32

GdiRealizationInfo
PolyPatBlt
GdiSetLastError
EngQueryEMFInfo
PolyPolyline
UpdateICMRegKeyA
GdiGetPageHandle
GdiFullscreenControl
ExtCreateRegion
GetDeviceCaps
GetEnhMetaFileDescriptionA
CreateCompatibleBitmap
PATHOBJ_vEnumStart
GetBitmapDimensionEx
ExtTextOutA
SetBitmapDimensionEx
GetGraphicsMode
EngAcquireSemaphore
PolyTextOutA
GdiReleaseDC
GdiConvertEnhMetaFile
CreateEllipticRgnIndirect
EnumFontFamiliesA
AnimatePalette
EnumEnhMetaFile
RemoveFontMemResourceEx
AddFontMemResourceEx
FillRgn
DdEntry55
EngStretchBltROP
GetBkMode
SetEnhMetaFileBits
GetBrushAttributes
EngAlphaBlend
EngDeletePath
GdiEntry3
SetSystemPaletteUse
GdiGetLocalFont
EngPlgBlt
FONTOBJ_pifi

adsldpc

BuildADsParentPath
LdapGetValuesLen
??1CLexer@@QAE@XZ
LdapCloseObject
ADSISetSearchPreference
LdapcKeepHandleAround
FindEntryInSearchTable
LdapGetSyntaxIdOfAttribute
LdapGetDn
?SetAtDisabler@CLexer@@QAEXH@Z
ADSIOpenDSObject
FindSearchTableIndex
ADSISetObjectAttributes
BuildADsPathFromLDAPPath2
ADsFreeColumn
BuildADsPathFromParent
SchemaGetObjectCount
ADSICloseDSObject
LdapTypeCopyConstruct
AdsTypeToLdapTypeCopyDNWithString
LdapSearchInitPage
ADSICloseSearchHandle
LdapNextEntry
ADSIExecuteSearch
ADSIFreeColumn
LdapSearchExtS
ADSIAbandonSearch
GetDomainDNSNameForDomain
ADsGetNextRow
AdsTypeToLdapTypeCopyTime
BuildLDAPPathFromADsPath
ADsGetLastError
AdsTypeToLdapTypeCopyConstruct
ADSIGetNextRow
MapADSTypeToLDAPType
LdapReadAttributeFast
ConvertSidToU2Trustee
LdapTypeToAdsTypeDNWithString
ADsGetColumn

ole32

OleGetIconOfClass
OleConvertOLESTREAMToIStorageEx
PropSysAllocString
OleCreateMenuDescriptor
IIDFromString
CreateAntiMoniker
WriteClassStm
WdtpInterfacePointer_UserMarshal
CoFreeLibrary
CoFileTimeNow
CoFileTimeToDosDateTime
CoGetContextToken
MonikerCommonPrefixWith
HMETAFILEPICT_UserUnmarshal
IsValidPtrIn
CoIsOle1Class
StgCreatePropStg
WriteOleStg
SNB_UserFree
HGLOBAL_UserUnmarshal
ComPs_NdrDllCanUnloadNow
CoTestCancel
CoInitialize
DcomChannelSetHResult
StgCreatePropSetStg
HMETAFILEPICT_UserSize
ComPs_NdrDllGetClassObject
HICON_UserSize
OleRegEnumFormatEtc
CLSIDFromString
STGMEDIUM_UserUnmarshal
STGMEDIUM_UserFree
OleCreateLink

rpcrt4

I_RpcServerAllocateIpPort
NdrNonEncapsulatedUnionFree
NdrClearOutParameters
NdrFullPointerFree
NdrAsyncClientCall
NdrNonConformantStringUnmarshall
NdrComplexStructMarshall
RpcEpRegisterNoReplaceW
RpcServerUseProtseqExA
I_RpcGetCurrentCallHandle
NdrMesProcEncodeDecode
NdrGetTypeFlags
I_RpcTransConnectionFreePacket
RpcGetAuthorizationContextForClient
UuidCreate
TowerExplode
NdrConformantVaryingStructUnmarshall
enum_from_ndr
I_RpcConnectionSetSockBuffSize
CStdStubBuffer_Disconnect
RpcSsFree
NdrByteCountPointerMarshall
MesEncodeFixedBufferHandleCreate
NdrMesSimpleTypeEncode
NdrContextHandleSize
NdrFullPointerQueryRefId
NdrContextHandleInitialize
CStdStubBuffer_Invoke
NdrXmitOrRepAsBufferSize
NdrConformantArrayUnmarshall
NdrpCreateProxy
RpcBindingToStringBindingA
I_RpcAsyncAbortCall
NdrNonEncapsulatedUnionBufferSize
NdrOleFree
NdrDllCanUnloadNow
NdrMesSimpleTypeAlignSize
I_RpcPauseExecution
I_RpcNsBindingSetEntryNameW
NdrComplexStructBufferSize
RpcSmEnableAllocate
RpcServerUseProtseqEpA
char_from_ndr
NdrPartialIgnoreClientMarshall
CreateProxyFromTypeInfo

msvcrt40

tolower
?setmode@fstream@@QAEHH@Z
??_7stdiostream@@6B@
?eback@streambuf@@IBEPADXZ
??_8iostream@@7Bostream@@@
_mbsnbcpy
??0ifstream@@QAE@H@Z
_lsearch
_wspawnl
_wexeclpe
?setb@streambuf@@IAEXPAD0H@Z
_tolower
__doserrno
_write
_winmajor
??_Gbad_cast@@UAEPAXI@Z
??0ofstream@@QAE@ABV0@@Z
??9type_info@@QBEHABV0@@Z
__lconv_init
_wcsncoll
_CIcos
?gptr@streambuf@@IBEPADXZ
??_8istream_withassign@@7B@
??_Dofstream@@QAEXXZ
_mbsstr
_wcreat
?cout@@3Vostream_withassign@@A
??_7exception@@6B@
_ismbbalpha
?cerr@@3Vostream_withassign@@A
_adj_fptan
_wfdopen
sprintf
?width@ios@@QAEHH@Z

user32

SetFocus

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1331d499e4f1437ddfb8d20b64550783

Headers

DLL Characteristics

File Characteristics

Imports

sqlwoa

ntdll

opengl32

kernel32

msrating

gdi32

adsldpc

ole32

rpcrt4

msvcrt40

user32

Sections

.text Size: 12KB - Virtual size: 12KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 1KB - Virtual size: 4KB

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 1KB - Virtual size: 4KB