c1b8184e16fd87244a46d421639ace8d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c1b8184e16fd87244a46d421639ace8d_JaffaCakes118
Size

147KB
MD5

c1b8184e16fd87244a46d421639ace8d
SHA1

3404b8228fea1f85ae9d00b9a764fbce04ffce18
SHA256

d4fa56b3c0d0b6487000e89eacfa860d081cd0fb5bca851d692581332f6067f6
SHA512

33aaec1c06f1e432ea8fb6a83dcf191c75e4bde589512fec2f8cc65ab99293dc108e5a5d57417705e18d343837a5bbc1d9b355478840ab352cc3cfbe53bcddbf
SSDEEP

3072:SRyhSeoAwzznccBRJ9Ne1vEru/QOP8eAnRTxOcXupjaRW:SRyhQAwzjv7J9Ai6FEOc+daRW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c1b8184e16fd87244a46d421639ace8d_JaffaCakes118

Files

c1b8184e16fd87244a46d421639ace8d_JaffaCakes118
.exe windows:2 windows x86 arch:x86

1ee73fe1e3f52517989de00ef14c58b2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegQueryValueExA
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetFileSecurityW
RegQueryValueExW
OpenProcessToken
OpenThreadToken
DestroyPrivateObjectSecurity
GetSecurityDescriptorSacl
SetNamedSecurityInfoW
GetNamedSecurityInfoW
CreatePrivateObjectSecurityEx
GetSecurityDescriptorDacl
RegDeleteValueW
RegOpenKeyExA
RegCreateKeyExW

kernel32

ExpandEnvironmentStringsW
GetWindowsDirectoryW
FreeLibrary
GetCurrentThread
GetDateFormatA
GetTimeFormatA
InterlockedDecrement
InterlockedIncrement
FlushFileBuffers
GetFileSize
SetEndOfFile
UnlockFileEx
LockFileEx
SetFilePointer
ReadFile
GetSystemTime
SystemTimeToFileTime
CopyFileW
CreateFileW
GetFileAttributesW
SetFileAttributesW
LocalFree
RemoveDirectoryW
FindNextFileW
FindFirstFileW
CreateDirectoryW
UnmapViewOfFile
LocalAlloc
MapViewOfFile
GetTickCount
GetModuleHandleW
CloseHandle
SetLastError
GetVersion
InitializeCriticalSectionAndSpinCount
VirtualFree
ExitProcess
DeleteFileW
HeapAlloc
GetProcessHeap
HeapFree
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetLastError
GetVersionExA
GetVersionExW
InterlockedExchange
Sleep
InterlockedCompareExchange
OutputDebugStringA
GetModuleHandleA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
CreateFileMappingW
VirtualAllocEx
FindFirstFileA

msvcrt

fprintf
fflush
fclose
fread
_wfopen
_errno
_purecall
iswctype
_onexit
_lock
__dllonexit
_unlock
_controlfp
memmove
memcpy
memset
__set_app_type
__setusermatherr
_amsg_exit
_initterm
__initenv
exit
_XcptFilter
_exit
_cexit
__getmainargs

ole32

StringFromIID
CoInitialize
CoCreateInstance
StgOpenStorage
StgOpenStorageEx
PropVariantClear
CoTaskMemFree
CoUninitialize

oleaut32

SysStringLen
SysAllocStringLen
SysAllocStringByteLen
SysAllocString
SysFreeString
SysStringByteLen

ntdll

wcsrchr
_wcsnicmp
_ltow
_vsnprintf
towlower
atol
_vsnwprintf
wcsncmp
RtlUnwind
_wcsicmp

rpcrt4

UuidCreate

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

mscat32

CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseContext
CryptCATCatalogInfoFromContext
CryptCATAdminAcquireContext

user32

IsCharLowerW

msi

MsiSourceListAddSourceW
MsiGetTargetPathA
MsiGetProductInfoFromScriptA
MsiEnumProductsExW
MsiEnumProductsExA
MsiApplyMultiplePatchesW
MsiSetTargetPathA
MsiSourceListClearSourceW
MsiDatabaseOpenViewW
MsiEnumProductsA
MsiSummaryInfoPersist
MsiDatabaseGetPrimaryKeysW
MsiSourceListClearAllW
MsiOpenPackageA
MsiConfigureFeatureW
MsiSourceListForceResolutionW
MsiSetInternalUI
MsiDatabaseExportW
MsiQueryFeatureStateA
MsiGetProductCodeFromPackageCodeW
MsiRecordSetStreamW
MsiNotifySidChangeA
MsiSourceListAddSourceExA
MsiPreviewDialogA
MsiEnableUIPreview
MsiUseFeatureExW
MsiPreviewBillboardA
MsiSourceListAddMediaDiskW
MsiDatabaseIsTablePersistentW
MsiDatabaseCommit
MsiViewModify
MsiSetMode

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1ee73fe1e3f52517989de00ef14c58b2

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

ole32

oleaut32

ntdll

rpcrt4

version

mscat32

user32

msi

Sections

.text Size: 17KB - Virtual size: 17KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 9KB - Virtual size: 215KB

.rsrc Size: 113KB - Virtual size: 112KB

.text
Size: 17KB - Virtual size: 17KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 9KB - Virtual size: 215KB

.rsrc
Size: 113KB - Virtual size: 112KB