c0a948e7e8ebb886a7a03b42e136d9c3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c0a948e7e8ebb886a7a03b42e136d9c3_JaffaCakes118
Size

147KB
MD5

c0a948e7e8ebb886a7a03b42e136d9c3
SHA1

09c1be87f6d37197dceadee6d5462036c56abd14
SHA256

1022ded3987d18c4ba3a9f9049f7e31acbe0e61d8f81683f8cca3b556c4d0dc6
SHA512

99e0e126de517334c7fcea0ea9fd2586d02b45463eca2847be024a7a8ae914e02c4c939fb4f09174bc0025d4f5f4a880fe06cc6f1d31da1c9a5ee16a0f3f2758
SSDEEP

3072:SRyhSeoAwzznccBRJ9Ne1vEru/QOP8eAnRTxOcXupjaRZ:SRyhQAwzjv7J9Ai6FEOc+daRZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0a948e7e8ebb886a7a03b42e136d9c3_JaffaCakes118

Files

c0a948e7e8ebb886a7a03b42e136d9c3_JaffaCakes118
.exe windows:2 windows x86 arch:x86

1ee73fe1e3f52517989de00ef14c58b2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegQueryValueExA
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetFileSecurityW
RegQueryValueExW
OpenProcessToken
OpenThreadToken
DestroyPrivateObjectSecurity
GetSecurityDescriptorSacl
SetNamedSecurityInfoW
GetNamedSecurityInfoW
CreatePrivateObjectSecurityEx
GetSecurityDescriptorDacl
RegDeleteValueW
RegOpenKeyExA
RegCreateKeyExW

kernel32

ExpandEnvironmentStringsW
GetWindowsDirectoryW
FreeLibrary
GetCurrentThread
GetDateFormatA
GetTimeFormatA
InterlockedDecrement
InterlockedIncrement
FlushFileBuffers
GetFileSize
SetEndOfFile
UnlockFileEx
LockFileEx
SetFilePointer
ReadFile
GetSystemTime
SystemTimeToFileTime
CopyFileW
CreateFileW
GetFileAttributesW
SetFileAttributesW
LocalFree
RemoveDirectoryW
FindNextFileW
FindFirstFileW
CreateDirectoryW
UnmapViewOfFile
LocalAlloc
MapViewOfFile
GetTickCount
GetModuleHandleW
CloseHandle
SetLastError
GetVersion
InitializeCriticalSectionAndSpinCount
VirtualFree
ExitProcess
DeleteFileW
HeapAlloc
GetProcessHeap
HeapFree
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetLastError
GetVersionExA
GetVersionExW
InterlockedExchange
Sleep
InterlockedCompareExchange
OutputDebugStringA
GetModuleHandleA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
CreateFileMappingW
VirtualAllocEx
FindFirstFileA

msvcrt

fprintf
fflush
fclose
fread
_wfopen
_errno
_purecall
iswctype
_onexit
_lock
__dllonexit
_unlock
_controlfp
memmove
memcpy
memset
__set_app_type
__setusermatherr
_amsg_exit
_initterm
__initenv
exit
_XcptFilter
_exit
_cexit
__getmainargs

ole32

StringFromIID
CoInitialize
CoCreateInstance
StgOpenStorage
StgOpenStorageEx
PropVariantClear
CoTaskMemFree
CoUninitialize

oleaut32

SysStringLen
SysAllocStringLen
SysAllocStringByteLen
SysAllocString
SysFreeString
SysStringByteLen

ntdll

wcsrchr
_wcsnicmp
_ltow
_vsnprintf
towlower
atol
_vsnwprintf
wcsncmp
RtlUnwind
_wcsicmp

rpcrt4

UuidCreate

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

mscat32

CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseContext
CryptCATCatalogInfoFromContext
CryptCATAdminAcquireContext

user32

IsCharLowerW

msi

MsiSourceListAddSourceW
MsiGetTargetPathA
MsiGetProductInfoFromScriptA
MsiEnumProductsExW
MsiEnumProductsExA
MsiApplyMultiplePatchesW
MsiSetTargetPathA
MsiSourceListClearSourceW
MsiDatabaseOpenViewW
MsiEnumProductsA
MsiSummaryInfoPersist
MsiDatabaseGetPrimaryKeysW
MsiSourceListClearAllW
MsiOpenPackageA
MsiConfigureFeatureW
MsiSourceListForceResolutionW
MsiSetInternalUI
MsiDatabaseExportW
MsiQueryFeatureStateA
MsiGetProductCodeFromPackageCodeW
MsiRecordSetStreamW
MsiNotifySidChangeA
MsiSourceListAddSourceExA
MsiPreviewDialogA
MsiEnableUIPreview
MsiUseFeatureExW
MsiPreviewBillboardA
MsiSourceListAddMediaDiskW
MsiDatabaseIsTablePersistentW
MsiDatabaseCommit
MsiViewModify
MsiSetMode

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1ee73fe1e3f52517989de00ef14c58b2

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

ole32

oleaut32

ntdll

rpcrt4

version

mscat32

user32

msi

Sections

.text Size: 17KB - Virtual size: 17KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 9KB - Virtual size: 215KB

.rsrc Size: 113KB - Virtual size: 112KB

.text
Size: 17KB - Virtual size: 17KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 9KB - Virtual size: 215KB

.rsrc
Size: 113KB - Virtual size: 112KB