cf19946390c30dae17f8a4958bd5a325_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

cf19946390c30dae17f8a4958bd5a325_JaffaCakes118
Size

81KB
MD5

cf19946390c30dae17f8a4958bd5a325
SHA1

6499276ef366a353d6b3479c9240b13d8c71ea05
SHA256

1c8b1365a07d25e47ad6ccd3186d08b8f9f742a9dc92a6ed8d6c8a33e410bf4c
SHA512

62527f8380fd128a07818db3db631ac847aa4858a0564f7635c7a03472112d7fff29b16e530715e8072f6f6353cf2ab0867a66d3677c3a92a18065df84569323
SSDEEP

1536:l5fnGXYxKTUtmPe3cGsI+1bFZTpKnekq02WkpAufWIruoNjt7di7Z/5RFfFNkNV:l2BIsbFR6Hq02WkDjFL2Z/5RFfzkD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf19946390c30dae17f8a4958bd5a325_JaffaCakes118

Files

cf19946390c30dae17f8a4958bd5a325_JaffaCakes118
.exe windows:6 windows x86 arch:x86

9dcbf6851631fcc0d50034d7282c766b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

wermgr.pdb

Imports

msvcrt

_acmdln
_cexit
_exit
_XcptFilter
_ismbblead
wcsncmp
_vsnprintf
_vscwprintf
_wcsnicmp
_wcsicmp
exit
__getmainargs
_initterm
_amsg_exit
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler3
_wtoi64
_wtoi
memset
_vsnwprintf
_onexit
_lock
__dllonexit
_unlock
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type

advapi32

RevertToSelf
IsValidSid
GetLengthSid
CopySid
RegGetValueW
OpenProcessToken
DuplicateToken
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
CreateProcessAsUserW
ImpersonateLoggedOnUser
ConvertSidToStringSidW
RegQueryValueExW
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW

kernel32

ReadProcessMemory
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
UnmapViewOfFile
CloseHandle
CreateProcessW
SetEvent
GetLastError
MapViewOfFile
Wow64RevertWow64FsRedirection
GetSystemDirectoryW
Wow64DisableWow64FsRedirection
IsWow64Process
GlobalFree
GetCommandLineW
HeapSetInformation
DeleteFileW
OpenProcess
GetSystemDefaultLCID
InterlockedIncrement
lstrlenW
InterlockedDecrement
CreateEventW
LocalFree
OutputDebugStringA
GetProcAddress
OpenMutexW
HeapFree
OpenPrivateNamespaceW
HeapAlloc
GetProcessHeap
WaitForSingleObject
GetModuleHandleW
OpenFileMappingW
ClosePrivateNamespace
CreateFileMappingW
GetApplicationRecoveryCallback

ole32

StringFromGUID2
CoInitialize
CoCreateInstance
CoCreateGuid
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject
CoUninitialize

oleaut32

SysAllocString
LoadRegTypeLi
SysFreeString
SysAllocStringLen
LoadTypeLibEx

shell32

CommandLineToArgvW
ShellExecuteExW

wer

WerpAddRegisteredDataToReport
WerpSetCallBack
WerReportSubmit
WerReportCloseHandle
WerReportAddDump
WerpEnumerateStoreStart
WerpEnumerateStoreNext
WerpOpenMachineQueue
WerpSubmitReportFromStore
WerpOpenUserQueue
WerpCloseStore
WerpShowNXNotification
WerpIsTransportAvailable
WerpSetReportInformation
WerpGetReportInformation
WerpGetReportType
WerpLoadReport

user32

CloseWindowStation
GetUserObjectInformationW
GetThreadDesktop
GetProcessWindowStation
CloseDesktop

ntdll

RtlAllocateAndInitializeSid
RtlCreateBoundaryDescriptor
RtlCreateServiceSid
RtlAddSIDToBoundaryDescriptor
RtlDeleteBoundaryDescriptor
NtQueryInformationProcess
RtlInitUnicodeString
NtQueryInformationToken
NtClose
RtlFreeSid
NtAlpcSendWaitReceivePort
NtAlpcConnectPort

Sections

.text
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9dcbf6851631fcc0d50034d7282c766b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

ole32

oleaut32

shell32

wer

user32

ntdll

Sections

.text Size: 45KB - Virtual size: 45KB

.data Size: 512B - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 32KB - Virtual size: 34KB

.text
Size: 45KB - Virtual size: 45KB

.data
Size: 512B - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 32KB - Virtual size: 34KB