be05153531472996b0927625e4ae3b1a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

be05153531472996b0927625e4ae3b1a_JaffaCakes118
Size

389KB
MD5

be05153531472996b0927625e4ae3b1a
SHA1

52b9bba8dd532dd116947db907497ff9cfde15b4
SHA256

b07f4650ea02518e8017c01daa947d6dec0afb2c2098ec1fff527d312b6a3f07
SHA512

d282164ce3174749db01dc6b99ccf66a629cd15a97909b3bf38dedb0f6b0292b3800835e4b599290277eaaaa7bbc247947cf30b27f6f45a392e23a2eca01e7c1
SSDEEP

12288:lKt8kaYGO+H0ftAjEbDqpQ2hLS/zS5M0D9lcG1iv:lwtl8E44zS5M0D9lY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be05153531472996b0927625e4ae3b1a_JaffaCakes118

Files

be05153531472996b0927625e4ae3b1a_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b9f9902c2d23d5c1bc5982d29c37582a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsBadReadPtr
GetConsoleKeyboardLayoutNameW
FindCloseChangeNotification
LoadLibraryA
WritePrivateProfileStructA
CallNamedPipeA
GlobalFindAtomA
EnumResourceNamesA
SetConsoleMenuClose
SwitchToFiber
GetQueuedCompletionStatus
GetPriorityClass
DeleteTimerQueue
SetProcessAffinityMask
GetStartupInfoA
RtlMoveMemory
SetLocalPrimaryComputerNameA
GetPrivateProfileSectionNamesW
GetLogicalDriveStringsA
GetNamedPipeHandleStateA
CreateEventA
BuildCommDCBW
SetConsoleHardwareState
GlobalUnfix
CreateHardLinkW
InitializeCriticalSection
LZOpenFileA
SetHandleContext
LeaveCriticalSection
IsProcessInJob
FindActCtxSectionStringW
SetFileApisToANSI
UnregisterWait
VirtualAlloc
GetConsoleNlsMode
FatalAppExitA
DefineDosDeviceW
RegisterWaitForSingleObject
UnregisterConsoleIME
GetExitCodeProcess
FindResourceExW
GetCurrentDirectoryW
IsValidCodePage
RemoveDirectoryW
GetThreadTimes
InterlockedPushEntrySList
Heap32ListNext
GetConsoleAliasesLengthA
GlobalMemoryStatusEx

secur32

SecpTranslateName
AddCredentialsW
ExportSecurityContext
GetSecurityUserInfo
QuerySecurityContextToken
AddSecurityPackageW
QueryCredentialsAttributesW
SecpFreeMemory
QuerySecurityPackageInfoA
GetUserNameExW
EncryptMessage
GetComputerObjectNameA
SaslIdentifyPackageW
AcquireCredentialsHandleA
ApplyControlToken
TranslateNameA
GetUserNameExA
SetContextAttributesW
SaslIdentifyPackageA
SaslEnumerateProfilesW
ImportSecurityContextA
SaslGetProfilePackageA
FreeContextBuffer
SaslEnumerateProfilesA
LsaConnectUntrusted
UnsealMessage
InitSecurityInterfaceA

opengl32

glRasterPos3sv
glTexCoord4fv
glVertex4s
wglMakeCurrent
glNormal3b
glTexParameterfv
glEvalPoint2
glTexGenf
glIndexd
glDeleteTextures
glIsList
wglUseFontBitmapsA
glEvalPoint1
glDisableClientState
glTexCoord3iv
glGetTexParameterfv
glFinish
glClear
wglSwapMultipleBuffers
glVertex4d
glPolygonMode
glTexCoord3sv
glPushMatrix
glFogi
glTranslated
glScaled
glVertex2f
glRectd
glColor3uiv
glBegin
glGetTexGendv
glIndexi
glMap2d
glIndexPointer
wglGetCurrentContext
glTexCoord4dv
glTexGeniv
glLightfv
glColor3ub
glColor4bv
glRasterPos4dv

mpr

WNetGetSearchDialog
WNetGetResourceInformationW
WNetGetResourceParentA
WNetCancelConnectionW
WNetGetConnection2W
WNetGetNetworkInformationA
WNetDisconnectDialog1A
WNetEnumResourceA
WNetCancelConnection2A
WNetGetProviderNameW
WNetAddConnection2A
WNetConnectionDialog2
WNetPropertyDialogA
WNetGetUniversalNameW
WNetGetConnection2A
WNetGetProviderTypeW
WNetCancelConnection2W
WNetUseConnectionW
WNetConnectionDialog
WNetGetHomeDirectoryW
WNetGetProviderTypeA
WNetGetLastErrorW
MultinetGetConnectionPerformanceW
MultinetGetConnectionPerformanceA
WNetFormatNetworkNameA
WNetGetPropertyTextA
WNetGetProviderNameA
WNetGetUserW
WNetOpenEnumA
WNetAddConnectionA
WNetGetResourceParentW
WNetOpenEnumW
WNetPasswordChangeNotify
WNetConnectionDialog1A
WNetGetResourceInformationA
WNetEnumResourceW

pdh

PdhVbAddCounter
PdhBrowseCountersHW
PdhVbGetCounterPathFromList
PdhEnumLogSetNamesA
PdhAdd009CounterA
PdhRemoveCounter
PdhLookupPerfNameByIndexA
PdhGetDefaultPerfObjectHA
PdhRelogW
PdhLookupPerfNameByIndexW
PdhIsRealTimeQuery
PdhSetCounterScaleFactor
PdhBindInputDataSourceW
PdhVerifySQLDBW
PdhGetDataSourceTimeRangeH
PdhRelogA
PdhGetCounterInfoA
PdhSetDefaultRealTimeDataSource
PdhExpandCounterPathA
PdhCollectQueryData
PdhGetLogSetGUID
PdhCreateSQLTablesA
PdhListLogFileHeaderA
PdhConnectMachineW
PdhVbGetCounterPathElements
PdhVbGetOneCounterPath
PdhVbOpenLog
PdhConnectMachineA
PdhCloseQuery
PdhVbGetLogFileSize
PdhEnumObjectItemsW
PdhBrowseCountersW
PdhGetRawCounterArrayA
PdhGetCounterTimeBase
PdhExpandWildCardPathHW
PdhTranslate009CounterW
PdhOpenLogW
PdhCalculateCounterFromRawValue
PdhEnumMachinesW
PdhAdd009CounterW
PdhGetRawCounterArrayW
PdhTranslate009CounterA
PdhVbOpenQuery

ufat

??1ROOTDIR@@UAE@XZ
?AllocChain@FAT@@QAEKKPAK@Z
?QueryNthCluster@FAT@@QBEKKK@Z
??0FILEDIR@@QAE@XZ
??0EA_HEADER@@QAE@XZ
?QueryName@FAT_DIRENT@@QBEEPAVWSTRING@@@Z
?Initialize@CLUSTER_CHAIN@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@PAVFAT_SA@@PBVFAT@@KK@Z
?Set12@FAT@@AAEXKK@Z
Chkdsk
?Initialize@ROOTDIR@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@KJ@Z
?InitFATChkDirty@REAL_FAT_SA@@QAEEPAVLOG_IO_DP_DRIVE@@PAVMESSAGE@@@Z
?GetEa@EA_SET@@QAEPAU_EA@@KPAJPAE@Z
?Read@CLUSTER_CHAIN@@UAEEXZ
?QueryEaSetClusterNumber@EA_HEADER@@QBEGG@Z
?QueryLongName@FATDIR@@QAEEJPAVWSTRING@@@Z
?Read@EA_SET@@UAEEXZ
?QueryAllocatedClusters@FAT@@QBEKXZ
?QueryLastAccessTime@FAT_DIRENT@@QBEEPAT_LARGE_INTEGER@@@Z
?QueryLengthOfChain@FAT@@QBEKKPAK@Z
?Initialize@EA_SET@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@PAVFAT_SA@@PBVFAT@@KK@Z
?SearchForDirEntry@FATDIR@@QAEPAXPBVWSTRING@@@Z
?FreeChain@FAT@@QAEXK@Z
?QueryCensusAndRelocate@FAT_SA@@QAEEPAU_CENSUS_REPORT@@PAVINTSTACK@@PAE@Z
??1REAL_FAT_SA@@UAE@XZ
??0CLUSTER_CHAIN@@QAE@XZ
ChkdskEx
??1FAT_SA@@UAE@XZ
?Write@CLUSTER_CHAIN@@UAEEXZ
?QueryFreeSectors@REAL_FAT_SA@@QBEKXZ
??1EA_SET@@UAE@XZ
Format
?QueryLastWriteTime@FAT_DIRENT@@QBEEPAT_LARGE_INTEGER@@@Z
?Initialize@EA_HEADER@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@PAVFAT_SA@@PBVFAT@@KK@Z
?Read@REAL_FAT_SA@@UAEEPAVMESSAGE@@@Z
?Initialize@REAL_FAT_SA@@UAEEPAVLOG_IO_DP_DRIVE@@PAVMESSAGE@@E@Z
?IsValidCreationTime@FAT_DIRENT@@QBEEXZ
??0FAT_SA@@QAE@XZ
??1FAT_DIRENT@@UAE@XZ
?IsValidLastAccessTime@FAT_DIRENT@@QBEEXZ
?Index12@FAT@@ABEKK@Z
FormatEx
??0EA_SET@@QAE@XZ

Sections

.text
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 195KB - Virtual size: 656KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b9f9902c2d23d5c1bc5982d29c37582a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

secur32

opengl32

mpr

pdh

ufat

Sections

.text Size: 98KB - Virtual size: 98KB

.rdata Size: 76KB - Virtual size: 76KB

.data Size: 195KB - Virtual size: 656KB

.rsrc Size: 17KB - Virtual size: 17KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 98KB - Virtual size: 98KB

.rdata
Size: 76KB - Virtual size: 76KB

.data
Size: 195KB - Virtual size: 656KB

.rsrc
Size: 17KB - Virtual size: 17KB

.reloc
Size: 1024B - Virtual size: 1024B