b9a77c87f0fa50be9298526e0d5e74a4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b9a77c87f0fa50be9298526e0d5e74a4_JaffaCakes118
Size

870KB
MD5

b9a77c87f0fa50be9298526e0d5e74a4
SHA1

6cf166fdb64398131e58c2ac76a4523f73385bc2
SHA256

20fe93615bc67ab7df28e10cf3e2a7c5a3526ca40ed8a917e33cedf37674d72a
SHA512

848fd6d67ee58f16947c271e527e3ef7fe9eeaa477b4f97ce595ca29e8a3b109e58a297510bbbe68882b2c074adcc93fa828c3d71b22346e6f0508a5d519d2f7
SSDEEP

24576:A8gyxoK7rtNil+DSpwcJRAmYLDAbDG2ve:H5NilCSTJRA9V2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b9a77c87f0fa50be9298526e0d5e74a4_JaffaCakes118

Files

b9a77c87f0fa50be9298526e0d5e74a4_JaffaCakes118
.exe windows:5 windows x86 arch:x86

bef64e04ae2eaf2055ae114239b1b431

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

esent

JetRestore2
JetCreateIndex
JetOpenTempTable
JetCreateInstance
JetIndexRecordCount
JetFreeBuffer
JetGetCursorInfo
JetDeleteTable
JetEscrowUpdate
JetDeleteColumn
JetMove
JetRenameColumn
JetGetVersion
JetGetDatabaseInfo
JetGotoPosition
JetCompact
JetSeek
JetSetSessionContext
JetStopService
JetCreateDatabaseWithStreaming
JetEndSession@8
JetUpdate@20
JetGotoBookmark
JetBeginTransaction
JetBackupInstance
JetConvertDDL
JetOSSnapshotThaw
JetOpenDatabase
JetTruncateLog
JetCloseFile
JetPrepareUpdate@12
JetGetLock
JetRetrieveTaggedColumnList
JetRetrieveKey
JetSetDatabaseSize
JetSnapshotStop
JetGetLogInfo
JetGetSystemParameter
ese
JetGetTableInfo
JetAttachDatabaseWithStreaming
JetGetObjectInfo
JetSetCurrentIndex4
JetDeleteColumn2
JetOpenTempTable3

msvcirt

?unlockc@ios@@KAXXZ
?underflow@strstreambuf@@UAEHXZ
?x_statebuf@ios@@0PAJA
?read@istream@@QAEAAV1@PACH@Z
??0fstream@@QAE@XZ
?put@ostream@@QAEAAV1@D@Z
?overflow@strstreambuf@@UAEHH@Z
??0ostream_withassign@@QAE@XZ
?close@ofstream@@QAEXXZ
?flush@@YAAAVostream@@AAV1@@Z
??6ostream@@QAEAAV0@PBX@Z
??6ostream@@QAEAAV0@M@Z
??4stdiobuf@@QAEAAV0@ABV0@@Z
?openprot@filebuf@@2HB
??0ifstream@@QAE@H@Z
??4strstream@@QAEAAV0@AAV0@@Z
?lockptr@ios@@IAEPAU_CRT_CRITICAL_SECTION@@XZ
?get@istream@@QAEAAV1@PADHD@Z
?attach@ofstream@@QAEXH@Z
??_Estdiostream@@UAEPAXI@Z
??0strstream@@QAE@XZ
?pbase@streambuf@@IBEPADXZ
??4ostream@@IAEAAV0@ABV0@@Z
?pbackfail@stdiobuf@@UAEHH@Z
??4istream_withassign@@QAEAAVistream@@PAVstreambuf@@@Z
??_Eostream_withassign@@UAEPAXI@Z
??4Iostream_init@@QAEAAV0@ABV0@@Z
??_7istrstream@@6B@
?rdbuf@ofstream@@QBEPAVfilebuf@@XZ
??1ofstream@@UAE@XZ
?getint@istream@@AAEHPAD@Z
??5istream@@QAEAAV0@AAF@Z
??_8ifstream@@7B@
?opfx@ostream@@QAEHXZ

kernel32

GetDiskFreeSpaceExA
lstrcpynA
GetVolumePathNameW
RaiseException
OpenConsoleW
InterlockedExchange
CreateMemoryResourceNotification
SetThreadPriorityBoost
VirtualAlloc
HeapQueryInformation
CreateMailslotA
LoadLibraryA
GetCommConfig
EnumCalendarInfoW
SetConsoleTextAttribute
GetCPInfoExA
SetHandleCount
SetCommConfig
CreateConsoleScreenBuffer
GetCurrentThread
BuildCommDCBW
SetLocaleInfoW
SetConsoleScreenBufferSize
LocalAlloc
FlushConsoleInputBuffer
WaitNamedPipeW
QueryDosDeviceW
BackupSeek
GetLastError
CreateEventA
WaitForSingleObject
CreateIoCompletionPort
RegisterConsoleOS2
WritePrivateProfileStringW
TlsFree
SetSystemTime
Heap32ListFirst
EnumerateLocalComputerNamesW
FoldStringA
GetNextVDMCommand
GetTapeStatus
UTUnRegister
SetProcessShutdownParameters
Module32First
GetFullPathNameA
FindActCtxSectionStringW
GetPrivateProfileSectionNamesW
MulDiv
AllocateUserPhysicalPages
ChangeTimerQueueTimer
GetSystemPowerStatus
GetConsoleKeyboardLayoutNameW
SetCriticalSectionSpinCount
SetConsoleNumberOfCommandsW
GetCurrentProcess
BaseFlushAppcompatCache
EnumResourceTypesW
GetLongPathNameW
OutputDebugStringW
SetCommState
DeleteFiber
RtlUnwind
UpdateResourceW
WaitForDebugEvent
SetupComm
VirtualFree
GetEnvironmentStringsW
EnumSystemLocalesW
QueryPerformanceCounter
EnumSystemGeoID
IsSystemResumeAutomatic
BuildCommDCBAndTimeoutsW

opengl32

glArrayElement
glRasterPos3d
glColor4b
glGetError
glLineStipple
glTexCoord4sv
glTexCoord2fv
glFeedbackBuffer
glColor4us
glLighti
glCallLists
GlmfCloseMetaFile
glFogiv
glTexParameteri
glBlendFunc
glShadeModel
glMultMatrixf
glColor4i
glRasterPos4dv
GlmfEndPlayback
glPopClientAttrib
glRasterPos2d
glCopyPixels
glClear
glMaterialfv
glTexCoordPointer
wglDescribePixelFormat
glDrawBuffer
glMaterialf
glColor3b
glFogf
glColor3ubv
glTexCoord1dv

olecli32

OleQueryReleaseMethod
DibSaveToStream
ErrSetHostNames
OleRevertClientDoc
GenQueryBounds
OleQueryBounds
LeSetBounds
MfQueryBounds
PbCreateLinkFromClip
BmRelease
OleLoadFromStream
LeShow
LeClone
OleCreateFromClip
ErrSetBounds
OleDelete
SrvrWndProc
OleRevokeClientDoc
ErrExecute
LeUpdate
MfCopy
LeGetUpdateOptions
BmSaveToStream
ObjQuerySize
PbDraw
OleSetBounds
OleActivate
ErrClose
LeActivate
BmEnumFormat
OleQueryClientVersion
LeQueryOpen
DibCopy
OleSetLinkUpdateOptions
PbCreate

msvcrt40

malloc
?pcount@ostrstream@@QBEHXZ
system
_mbspbrk
_mtunlock
??4strstreambuf@@QAEAAV0@ABV0@@Z
?floatfield@ios@@2JB
_wfdopen
_ismbbkprint
??0strstream@@QAE@PADHH@Z
_adj_fpatan
wctomb
??0ifstream@@QAE@H@Z
_mbsnset
??0ifstream@@QAE@PBDHH@Z
cos
??_Elogic_error@@UAEPAXI@Z
_strdate
?ipfx@istream@@QAEHH@Z
fwprintf
fclose
?seekp@ostream@@QAEAAV1@J@Z
_pclose
_cprintf
fsetpos
??0filebuf@@QAE@XZ
??1strstreambuf@@UAE@XZ
isleadbyte
_memicmp
tmpfile
?rdbuf@istrstream@@QBEPAVstrstreambuf@@XZ
_yn
??1bad_cast@@UAE@XZ
?what@exception@@UBEPBDXZ
_EH_prolog
_aexit_rtn
?sh_write@filebuf@@2HB
??_Distream_withassign@@QAEXXZ
_mbscmp
_ismbcsymbol
_filelength
_safe_fdivr
?str@istrstream@@QAEPADXZ
div
_spawnve

Sections

.text
Size: 159KB - Virtual size: 159KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 319KB - Virtual size: 319KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 388KB - Virtual size: 388KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bef64e04ae2eaf2055ae114239b1b431

Headers

DLL Characteristics

File Characteristics

Imports

esent

msvcirt

kernel32

opengl32

olecli32

msvcrt40

Sections

.text Size: 159KB - Virtual size: 159KB

.rdata Size: 319KB - Virtual size: 319KB

.data Size: 1KB - Virtual size: 1.8MB

.rsrc Size: 388KB - Virtual size: 388KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 159KB - Virtual size: 159KB

.rdata
Size: 319KB - Virtual size: 319KB

.data
Size: 1KB - Virtual size: 1.8MB

.rsrc
Size: 388KB - Virtual size: 388KB

.reloc
Size: 1024B - Virtual size: 1024B