cf611f55f04c6fb7b5c11cff7b44969e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

cf611f55f04c6fb7b5c11cff7b44969e_JaffaCakes118
Size

404KB
MD5

cf611f55f04c6fb7b5c11cff7b44969e
SHA1

dff2491c70b294e6846aaaeec01548693ef1cf86
SHA256

e029753a855abdc749d9e7a4976f3897ad16815b56178d5f2705e7fd93f1ec7f
SHA512

450cbb05385ef8abeea13af521b85ba5bd4ef399b3f7ab67b71aaf33250fac83f8c627e5e52b94de3dde36e127dba8377f1e1493f3e0fa3a6bbc31540d05bf9b
SSDEEP

6144:yLQ8Ka9FLNvdZH4ngLugRzBY4OdHvWGFwG8NRPY/rW0g1pZX:+n7NFqga2u4c+Gy3bg56X

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf611f55f04c6fb7b5c11cff7b44969e_JaffaCakes118

Files

cf611f55f04c6fb7b5c11cff7b44969e_JaffaCakes118
.exe windows:5 windows x86 arch:x86

3169beefbf0b1c2f114f5db7959b731a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

winmm

midiOutGetID
midiOutOpen
timeGetSystemTime
OpenDriver
waveInMessage
midiStreamClose
joySetCapture
mciFreeCommandResource
mciGetErrorStringW
auxOutMessage
joyConfigChanged
mmioStringToFOURCCA
wid32Message
mmioOpenA
mmTaskBlock
mmTaskYield
GetDriverModuleHandle
mciSetYieldProc
waveOutGetErrorTextA
mciSendStringA
waveOutMessage
mixerGetLineInfoW
midiOutClose
mmioClose
mmioGetInfo
mixerOpen
waveOutGetPlaybackRate
auxGetDevCapsW

mfcsubs

??0CString@@QAE@PBGH@Z
??O@YG_NABVCString@@0@Z
?Lookup@CMapStringToPtr@@QBEHPBGAAPAX@Z
?Create@CPlex@@SGPAU1@AAPAU1@II@Z
?GetBuffer@CString@@QAEPAGH@Z
?MakeLower@CString@@QAEXXZ
?AfxW2AHelper@@YGPADPADPBGH@Z
?SetSize@CStringArray@@QAEXHH@Z
??0CString@@QAE@PBE@Z
??O@YG_NPBGABVCString@@@Z
?FormatMessageW@CString@@QAAXPBGZZ
?SpanExcluding@CString@@QBE?AV1@PBG@Z
?LockBuffer@CString@@QAEPAGXZ
??YCString@@QAEABV0@ABV0@@Z
??8@YG_NABVCString@@0@Z
??P@YG_NABVCString@@0@Z
??0CString@@QAE@XZ
??N@YG_NPBGABVCString@@@Z
??4CString@@QAEABV0@PBG@Z
?Find@CString@@QBEHG@Z
?InsertAt@CStringArray@@QAEXHPBGH@Z
?AllocBuffer@CString@@IAEXH@Z
??9@YG_NABVCString@@0@Z
??1CString@@QAE@XZ
?MakeReverse@CString@@QAEXXZ
?AfxGetEmptyString@@YGABVCString@@XZ
?IsEmpty@CString@@QBEHXZ
?FreeExtra@CStringArray@@QAEXXZ

kernel32

GetTimeZoneInformation
EnumCalendarInfoExW
RtlZeroMemory
lstrlenA
GetConsoleAliasExesA
AddConsoleAliasW
GetCommandLineA
HeapCreate
InitializeSListHead
GetDiskFreeSpaceExA
GetSystemTimeAdjustment
GetProcAddress
SetProcessAffinityMask
GetConsoleProcessList
GetConsoleWindow
GetVolumeNameForVolumeMountPointA
GetProcessAffinityMask
GetProcessHeap
ReadFileScatter
GetThreadContext
lstrlenW
WriteConsoleInputVDMW
GetModuleHandleW
LoadLibraryA
GetConsoleFontInfo
SetFilePointerEx
FreeConsole
UTUnRegister
WriteProfileStringW
EnumLanguageGroupLocalesA
lstrcpynA
GetStartupInfoA
ConsoleMenuControl
VirtualAlloc
GetLogicalDriveStringsA
LockFileEx

odbccu32

SQLGetInfo
SQLPrepare
SQLGetStmtAttr
SQLFetch
SQLParamData
SQLSetStmtAttr
SQLCloseCursor
SQLBindCol
SQLSetConnectOption
SQLGetData
SQLGetDescRec
SQLCancel
SQLPutData
SQLGetStmtOption
SQLMoreResults
ReleaseCLStmtResources
SQLSetScrollOptions
SQLTransact
SQLExtendedFetch
SQLSetPos

msvcrt20

??_Gistream@@UAEPAXI@Z
_sys_errlist
??_Eistrstream@@UAEPAXI@Z
??_8stdiostream@@7Bistream@@@
_wfsopen
__p__winmajor
?put@ostream@@QAEAAV1@C@Z
_mbsncpy
?epptr@streambuf@@IBEPADXZ
_chmod
_umask
_wpopen
_mbscmp
_spawnv
_cexit
_chgsign
?sgetc@streambuf@@QAEHXZ
_tcsnccnt
$I10_OUTPUT
iswprint

dbnmpntw

ConnectionTransact
ConnectionMode
ConnectionWrite
ConnectionWriteOOB
ConnectionVer
ConnectionStatus
ConnectionObjectSize
ConnectionCheckForData
ConnectionServerEnum
ConnectionServerEnumW
ConnectionOpenW
ConnectionError
ConnectionClose
ConnectionRead
ConnectionOpen
ConnectionErrorW

mmcbase

?GetFacility@SC@mmcerror@@ABE?AW4facility_type@12@XZ
??4?$CEventLock@UAppEvents@@@@QAEAAV0@ABV0@@Z
?IsLocked@CEventBuffer@@QAE_NXZ
?FormatErrorIds@@YGXIVSC@mmcerror@@IPAG@Z
?InternalAddRef@CMMCStrongReferences@@AAEKXZ
??4SC@mmcerror@@QAEAAV01@J@Z
?Unlock@CEventBuffer@@QAEXXZ
??0SC@mmcerror@@QAE@J@Z
?FromLastError@SC@mmcerror@@QAEAAV12@XZ
?FormatErrorShort@@YGXVSC@mmcerror@@IPAG@Z
?FormatErrorString@@YGXPBGVSC@mmcerror@@IPAGH@Z
?Throw@SC@mmcerror@@QAEXJ@Z
?GetMainThreadID@SC@mmcerror@@SGKXZ
?GetComObjectEventSource@@YGAAV?$CEventSource@VCComObjectObserver@@VCVoid@@V2@V2@V2@@@XZ
?GetSingletonObject@CMMCStrongReferences@@CGAAV1@XZ
?s_dwMainThreadID@SC@mmcerror@@0KA
?GetHelpID@SC@mmcerror@@QAEKXZ
?GetHelpFile@SC@mmcerror@@SGPBGXZ
?GetCode@SC@mmcerror@@QBEJXZ
?Throw@SC@mmcerror@@QAEXXZ
?ScEmitOrPostpone@CEventBuffer@@QAE?AVSC@mmcerror@@PAUIDispatch@@JPAVCComVariant@ATL@@H@Z
??9SC@mmcerror@@QBE_NJ@Z
?MMCErrorBox@@YGHPBGVSC@mmcerror@@I@Z
?s_hInst@SC@mmcerror@@0PAUHINSTANCE__@@A
??1CEventBuffer@@QAE@XZ
?Trace_@SC@mmcerror@@QBEXXZ
??_FSC@mmcerror@@QAEXXZ

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 150KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 144KB - Virtual size: 528KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 368B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3169beefbf0b1c2f114f5db7959b731a

Headers

File Characteristics

Imports

winmm

mfcsubs

kernel32

odbccu32

msvcrt20

dbnmpntw

mmcbase

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 150KB - Virtual size: 150KB

.data Size: 144KB - Virtual size: 528KB

.tls Size: 512B - Virtual size: 4B

.rsrc Size: 99KB - Virtual size: 99KB

.reloc Size: 512B - Virtual size: 368B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 150KB - Virtual size: 150KB

.data
Size: 144KB - Virtual size: 528KB

.tls
Size: 512B - Virtual size: 4B

.rsrc
Size: 99KB - Virtual size: 99KB

.reloc
Size: 512B - Virtual size: 368B