b8a90b1123c9133516f97cdda46cf6b2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b8a90b1123c9133516f97cdda46cf6b2_JaffaCakes118
Size

389KB
MD5

b8a90b1123c9133516f97cdda46cf6b2
SHA1

74312dd6d111667093e90bb7d159b6457e681881
SHA256

590ca8ae8a65d851810b3ee34bd3a34d68a672147f00bb40ec95f0f477f1f7c0
SHA512

a8b98e85d36ef1afb433e59e8a32ca11194a02596ea9c38cc9a644367fa92e0b888d1ad0440bfdd265a10f48831cba429c252ee1f63aef4e144d3f566cbb2c64
SSDEEP

12288:iKt8kaYGO+H0ftAjEbDqpQ2hLS/zS5M0D9lcG1iA:iwtl8E44zS5M0D9lH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b8a90b1123c9133516f97cdda46cf6b2_JaffaCakes118

Files

b8a90b1123c9133516f97cdda46cf6b2_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b9f9902c2d23d5c1bc5982d29c37582a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsBadReadPtr
GetConsoleKeyboardLayoutNameW
FindCloseChangeNotification
LoadLibraryA
WritePrivateProfileStructA
CallNamedPipeA
GlobalFindAtomA
EnumResourceNamesA
SetConsoleMenuClose
SwitchToFiber
GetQueuedCompletionStatus
GetPriorityClass
DeleteTimerQueue
SetProcessAffinityMask
GetStartupInfoA
RtlMoveMemory
SetLocalPrimaryComputerNameA
GetPrivateProfileSectionNamesW
GetLogicalDriveStringsA
GetNamedPipeHandleStateA
CreateEventA
BuildCommDCBW
SetConsoleHardwareState
GlobalUnfix
CreateHardLinkW
InitializeCriticalSection
LZOpenFileA
SetHandleContext
LeaveCriticalSection
IsProcessInJob
FindActCtxSectionStringW
SetFileApisToANSI
UnregisterWait
VirtualAlloc
GetConsoleNlsMode
FatalAppExitA
DefineDosDeviceW
RegisterWaitForSingleObject
UnregisterConsoleIME
GetExitCodeProcess
FindResourceExW
GetCurrentDirectoryW
IsValidCodePage
RemoveDirectoryW
GetThreadTimes
InterlockedPushEntrySList
Heap32ListNext
GetConsoleAliasesLengthA
GlobalMemoryStatusEx

secur32

SecpTranslateName
AddCredentialsW
ExportSecurityContext
GetSecurityUserInfo
QuerySecurityContextToken
AddSecurityPackageW
QueryCredentialsAttributesW
SecpFreeMemory
QuerySecurityPackageInfoA
GetUserNameExW
EncryptMessage
GetComputerObjectNameA
SaslIdentifyPackageW
AcquireCredentialsHandleA
ApplyControlToken
TranslateNameA
GetUserNameExA
SetContextAttributesW
SaslIdentifyPackageA
SaslEnumerateProfilesW
ImportSecurityContextA
SaslGetProfilePackageA
FreeContextBuffer
SaslEnumerateProfilesA
LsaConnectUntrusted
UnsealMessage
InitSecurityInterfaceA

opengl32

glRasterPos3sv
glTexCoord4fv
glVertex4s
wglMakeCurrent
glNormal3b
glTexParameterfv
glEvalPoint2
glTexGenf
glIndexd
glDeleteTextures
glIsList
wglUseFontBitmapsA
glEvalPoint1
glDisableClientState
glTexCoord3iv
glGetTexParameterfv
glFinish
glClear
wglSwapMultipleBuffers
glVertex4d
glPolygonMode
glTexCoord3sv
glPushMatrix
glFogi
glTranslated
glScaled
glVertex2f
glRectd
glColor3uiv
glBegin
glGetTexGendv
glIndexi
glMap2d
glIndexPointer
wglGetCurrentContext
glTexCoord4dv
glTexGeniv
glLightfv
glColor3ub
glColor4bv
glRasterPos4dv

mpr

WNetGetSearchDialog
WNetGetResourceInformationW
WNetGetResourceParentA
WNetCancelConnectionW
WNetGetConnection2W
WNetGetNetworkInformationA
WNetDisconnectDialog1A
WNetEnumResourceA
WNetCancelConnection2A
WNetGetProviderNameW
WNetAddConnection2A
WNetConnectionDialog2
WNetPropertyDialogA
WNetGetUniversalNameW
WNetGetConnection2A
WNetGetProviderTypeW
WNetCancelConnection2W
WNetUseConnectionW
WNetConnectionDialog
WNetGetHomeDirectoryW
WNetGetProviderTypeA
WNetGetLastErrorW
MultinetGetConnectionPerformanceW
MultinetGetConnectionPerformanceA
WNetFormatNetworkNameA
WNetGetPropertyTextA
WNetGetProviderNameA
WNetGetUserW
WNetOpenEnumA
WNetAddConnectionA
WNetGetResourceParentW
WNetOpenEnumW
WNetPasswordChangeNotify
WNetConnectionDialog1A
WNetGetResourceInformationA
WNetEnumResourceW

pdh

PdhVbAddCounter
PdhBrowseCountersHW
PdhVbGetCounterPathFromList
PdhEnumLogSetNamesA
PdhAdd009CounterA
PdhRemoveCounter
PdhLookupPerfNameByIndexA
PdhGetDefaultPerfObjectHA
PdhRelogW
PdhLookupPerfNameByIndexW
PdhIsRealTimeQuery
PdhSetCounterScaleFactor
PdhBindInputDataSourceW
PdhVerifySQLDBW
PdhGetDataSourceTimeRangeH
PdhRelogA
PdhGetCounterInfoA
PdhSetDefaultRealTimeDataSource
PdhExpandCounterPathA
PdhCollectQueryData
PdhGetLogSetGUID
PdhCreateSQLTablesA
PdhListLogFileHeaderA
PdhConnectMachineW
PdhVbGetCounterPathElements
PdhVbGetOneCounterPath
PdhVbOpenLog
PdhConnectMachineA
PdhCloseQuery
PdhVbGetLogFileSize
PdhEnumObjectItemsW
PdhBrowseCountersW
PdhGetRawCounterArrayA
PdhGetCounterTimeBase
PdhExpandWildCardPathHW
PdhTranslate009CounterW
PdhOpenLogW
PdhCalculateCounterFromRawValue
PdhEnumMachinesW
PdhAdd009CounterW
PdhGetRawCounterArrayW
PdhTranslate009CounterA
PdhVbOpenQuery

ufat

??1ROOTDIR@@UAE@XZ
?AllocChain@FAT@@QAEKKPAK@Z
?QueryNthCluster@FAT@@QBEKKK@Z
??0FILEDIR@@QAE@XZ
??0EA_HEADER@@QAE@XZ
?QueryName@FAT_DIRENT@@QBEEPAVWSTRING@@@Z
?Initialize@CLUSTER_CHAIN@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@PAVFAT_SA@@PBVFAT@@KK@Z
?Set12@FAT@@AAEXKK@Z
Chkdsk
?Initialize@ROOTDIR@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@KJ@Z
?InitFATChkDirty@REAL_FAT_SA@@QAEEPAVLOG_IO_DP_DRIVE@@PAVMESSAGE@@@Z
?GetEa@EA_SET@@QAEPAU_EA@@KPAJPAE@Z
?Read@CLUSTER_CHAIN@@UAEEXZ
?QueryEaSetClusterNumber@EA_HEADER@@QBEGG@Z
?QueryLongName@FATDIR@@QAEEJPAVWSTRING@@@Z
?Read@EA_SET@@UAEEXZ
?QueryAllocatedClusters@FAT@@QBEKXZ
?QueryLastAccessTime@FAT_DIRENT@@QBEEPAT_LARGE_INTEGER@@@Z
?QueryLengthOfChain@FAT@@QBEKKPAK@Z
?Initialize@EA_SET@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@PAVFAT_SA@@PBVFAT@@KK@Z
?SearchForDirEntry@FATDIR@@QAEPAXPBVWSTRING@@@Z
?FreeChain@FAT@@QAEXK@Z
?QueryCensusAndRelocate@FAT_SA@@QAEEPAU_CENSUS_REPORT@@PAVINTSTACK@@PAE@Z
??1REAL_FAT_SA@@UAE@XZ
??0CLUSTER_CHAIN@@QAE@XZ
ChkdskEx
??1FAT_SA@@UAE@XZ
?Write@CLUSTER_CHAIN@@UAEEXZ
?QueryFreeSectors@REAL_FAT_SA@@QBEKXZ
??1EA_SET@@UAE@XZ
Format
?QueryLastWriteTime@FAT_DIRENT@@QBEEPAT_LARGE_INTEGER@@@Z
?Initialize@EA_HEADER@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@PAVFAT_SA@@PBVFAT@@KK@Z
?Read@REAL_FAT_SA@@UAEEPAVMESSAGE@@@Z
?Initialize@REAL_FAT_SA@@UAEEPAVLOG_IO_DP_DRIVE@@PAVMESSAGE@@E@Z
?IsValidCreationTime@FAT_DIRENT@@QBEEXZ
??0FAT_SA@@QAE@XZ
??1FAT_DIRENT@@UAE@XZ
?IsValidLastAccessTime@FAT_DIRENT@@QBEEXZ
?Index12@FAT@@ABEKK@Z
FormatEx
??0EA_SET@@QAE@XZ

Sections

.text
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 195KB - Virtual size: 656KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b9f9902c2d23d5c1bc5982d29c37582a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

secur32

opengl32

mpr

pdh

ufat

Sections

.text Size: 98KB - Virtual size: 98KB

.rdata Size: 76KB - Virtual size: 76KB

.data Size: 195KB - Virtual size: 656KB

.rsrc Size: 17KB - Virtual size: 17KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 98KB - Virtual size: 98KB

.rdata
Size: 76KB - Virtual size: 76KB

.data
Size: 195KB - Virtual size: 656KB

.rsrc
Size: 17KB - Virtual size: 17KB

.reloc
Size: 1024B - Virtual size: 1024B