bbbb41506a12b96d9c9e06cff6d1e9ae_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

bbbb41506a12b96d9c9e06cff6d1e9ae_JaffaCakes118
Size

822KB
MD5

bbbb41506a12b96d9c9e06cff6d1e9ae
SHA1

86ea47a3bb1740b867e9f1f8088c3ce28d0bc36e
SHA256

fe4a17f61d96ba35c4bbd23b442975e31a1d761fd64bcdcf165ed76a727c97ca
SHA512

70b1a87f656a0a7b3d7b228620007d1ab09a02b00459bb4a0e505714b9e43dfbf4c320aa2603a6caf11ec6948a3cd1ad6eb893632d71ec0234140b2959eb0e08
SSDEEP

12288:mgyMqlDUvlxpat2voooMo4yHllMZZvYxjjGbvMoozrPuX6gpiR+pEPd5mnYKCOia:mFMqxSlxToMyMzv2jjWv6PuX6gfU3mn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bbbb41506a12b96d9c9e06cff6d1e9ae_JaffaCakes118

Files

bbbb41506a12b96d9c9e06cff6d1e9ae_JaffaCakes118
.exe windows:5 windows x86 arch:x86

1585a440dd5a495862431f697ea97ac3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

DestroyIcon
VkKeyScanA
InitializeLpkHooks
FreeDDElParam
ActivateKeyboardLayout
GetProgmanWindow
GetMenuCheckMarkDimensions
SetSysColors
GetWindowThreadProcessId
wvsprintfA
ChildWindowFromPointEx
CharUpperA
MenuWindowProcA
GetOpenClipboardWindow
GetMenuDefaultItem
EqualRect
LoadStringA
ReasonCodeNeedsBugID
VkKeyScanExA
AllowForegroundActivation
ScrollWindow
DispatchMessageW
CreatePopupMenu
DdeQueryConvInfo
wsprintfW
SetWindowTextW
EnumDesktopWindows
SetActiveWindow
DdeKeepStringHandle
EnumThreadWindows
OemToCharA
GetLayeredWindowAttributes
EnumWindowStationsA
IMPGetIMEA

kernel32

LoadLibraryA
GetStartupInfoA
AddAtomA
SetConsoleWindowInfo
GetStringTypeW
GetConsoleAliasExesLengthA
Heap32ListFirst
ReadConsoleOutputAttribute
WriteConsoleInputVDMA
TerminateThread
MapViewOfFile
CreateFileMappingW
MoveFileWithProgressA
CreateMailslotA
AllocateUserPhysicalPages
LeaveCriticalSection
SetCurrentDirectoryW
SetCommConfig
CreateSemaphoreA
WritePrivateProfileStringA
_lclose
EnumSystemLocalesW
GetAtomNameW
FoldStringA
GetLocaleInfoW
FindActCtxSectionGuid
SetCalendarInfoW
VirtualAlloc
ConvertDefaultLocale
FindActCtxSectionStringA
EnumResourceLanguagesW
SetHandleContext

mapi32

BMAPIReadMail
DllCanUnloadNow
MAPIFreeBuffer@4
FBadRglpNameID@8
MAPIFindNext
DllGetClassObject
FBadRow@4
MNLS_lstrcmpW@8
cmc_send
MAPIInitialize@4
LAUNCHWIZARD
MAPIInitialize
MNLS_IsBadStringPtrW@8
ScCopyProps@16
MAPISaveMail
cmc_act_on
UNKOBJ_ScCOReallocate@12
GetAttribIMsgOnIStg@12
HrSetOmiProvidersFlagsInvalid@4
RTFSync@12
OpenTnefStream
BuildDisplayTable@40
cmc_free
GetOutlookVersion
MAPIDeleteMail
FEqualNames@8
FBadProp@4
LPropCompareProp@8
MNLS_MultiByteToWideChar@24
HrAllocAdviseSink@12

regapi

RegWdEnumerateA
WaitForTSConnectionsPolicyChanges
RegWinStationQueryA
RegCloseServer
RegCdEnumerateA
RegWinStationQueryEx
RegGetMachinePolicyEx
RegUserConfigRename
RegCdQueryW
RegGetMachinePolicy
RegWinStationEnumerateA
RegDenyTSConnectionsPolicy
RegMergeUserConfigWithUserParameters
RegQueryUtilityCommandList
RegIsTServer
RegCdEnumerateW
RegOpenServerA
RegPdEnumerateA
RegWdCreateW
RegUserConfigDelete
RegWinStationQuerySecurityA
RegConsoleShadowQueryW
RegWinStationQuerySecurityW
RegWdEnumerateW
RegWinStationCreateA
RegQueryOEMId
RegIsMachinePolicyAllowHelp

rpcrt4

long_from_ndr_temp
RpcServerUseProtseqEpExA
NdrContextHandleInitialize
CStdStubBuffer_Disconnect
NdrNonConformantStringMemorySize
NdrByteCountPointerFree
NdrServerInitializeMarshall
NdrRangeUnmarshall
UuidToStringW
RpcMgmtSetComTimeout
RpcErrorClearInformation
RpcErrorGetNumberOfRecords
DceErrorInqTextA
RpcServerUnregisterIfEx
RpcServerUseAllProtseqsEx
NdrProxyErrorHandler
CStdStubBuffer_Invoke
NdrGetSimpleTypeMemorySize
NdrEncapsulatedUnionMarshall
RpcEpResolveBinding
I_RpcServerRegisterForwardFunction
NdrTypeFlags
NDRCContextBinding
NdrSimpleStructMarshall
UuidCreateSequential
NdrpCreateProxy
RpcNsBindingInqEntryNameA
I_RpcGetBuffer
RpcSmSetClientAllocFree
NdrMesProcEncodeDecode
long_array_from_ndr
RpcBindingToStringBindingA
NdrSimpleStructFree
NdrConformantStringUnmarshall
NdrGetSimpleTypeBufferAlignment
RpcSsDontSerializeContext
NdrNsSendReceive
RpcImpersonateClient

iaspolcy

DllUnregisterServer
DllCanUnloadNow
DllGetClassObject
DllRegisterServer

msvcrt20

_read
??_Gfstream@@UAEPAXI@Z
??4strstreambuf@@QAEAAV0@ABV0@@Z
__doserrno
_chdrive
fwprintf
?width@ios@@QBEHXZ
_mbsninc
fgets
div
vsprintf
?delbuf@ios@@QAEXH@Z
setlocale
wcsncpy
??4istream_withassign@@QAEAAVistream@@PAVstreambuf@@@Z
_splitpath
??_8stdiostream@@7Bistream@@@
_mbsnextc
_spawnvpe
_close
_c_exit
_mbsdec
_open
_ismbcl2
_tcsset
?dec@@YAAAVios@@AAV1@@Z
?ends@@YAAAVostream@@AAV1@@Z
fputws
_cputs
_ismbblead
?seekpos@streambuf@@UAEJJH@Z
?attach@fstream@@QAEXH@Z
?init@ios@@IAEXPAVstreambuf@@@Z
?rdbuf@ofstream@@QBEPAVfilebuf@@XZ
wcscspn
??_8istrstream@@7B@
_heapmin

ntdll

ZwAllocateVirtualMemory
ZwSetDefaultHardErrorPort
NtSetLowWaitHighEventPair
ZwAlertThread
RtlDeleteSecurityObject
NtTerminateThread
RtlLogStackBackTrace
RtlUnicodeToOemN
isalpha
DbgUiContinue
ZwQueryIoCompletion
NtSetQuotaInformationFile
NtUnlockFile
RtlImageNtHeader
ZwQueryBootOptions
NtQueryInstallUILanguage
RtlIpv4AddressToStringW
NtQueryPerformanceCounter
ZwAdjustGroupsToken
LdrInitializeThunk
NtTranslateFilePath
RtlLargeIntegerNegate
RtlRaiseException
_memicmp
ZwReplaceKey
ZwSystemDebugControl
RtlAddAce
RtlSetGroupSecurityDescriptor
RtlPopFrame
DbgUserBreakPoint
ZwQueryPortInformationProcess
atoi
NtRegisterThreadTerminatePort
memcpy
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle
RtlNewSecurityObjectEx
RtlGetLengthWithoutTrailingPathSeperators
RtlInitializeHandleTable
RtlUnhandledExceptionFilter
ZwOpenIoCompletion
ZwQueryInstallUILanguage
NtSetInformationDebugObject
ZwSetBootOptions
NtCancelIoFile

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 187KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 604KB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1585a440dd5a495862431f697ea97ac3

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

mapi32

regapi

rpcrt4

iaspolcy

msvcrt20

ntdll

Sections

.text Size: 20KB - Virtual size: 20KB

.rdata Size: 187KB - Virtual size: 186KB

.data Size: 604KB - Virtual size: 1.9MB

.tls Size: 512B - Virtual size: 4B

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 512B - Virtual size: 296B

.text
Size: 20KB - Virtual size: 20KB

.rdata
Size: 187KB - Virtual size: 186KB

.data
Size: 604KB - Virtual size: 1.9MB

.tls
Size: 512B - Virtual size: 4B

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 512B - Virtual size: 296B