d40422af3146daa8f92f674fb66f0e7a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d40422af3146daa8f92f674fb66f0e7a_JaffaCakes118
Size

581KB
MD5

d40422af3146daa8f92f674fb66f0e7a
SHA1

b3b1a830af79030d870ca47ae90e3f417e2fca0d
SHA256

8df321b1f01101dc997ac2a1feb20f1c840d85213faa9c380d27069bb68f6578
SHA512

50627b9aeaf02b3c6ad2f2a31f7624c8506ff3c2dedb97e7b5533a83360be0292e0b6d444f38c4bb59d5d5d6e946d2a6761ab72d84a2855512df81486bd72c4c
SSDEEP

12288:e5uKKwWBohUnNGWDwJf1qEPz/HcfIITs4fKSALx7+h7qYNG:e5uiiDitb8fIIT3fKSALx+h7q7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d40422af3146daa8f92f674fb66f0e7a_JaffaCakes118

Files

d40422af3146daa8f92f674fb66f0e7a_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f56e176693e2c03eb9d5eede0d01b05b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

h:\UPDATER\windowsUpdater_2010_Q1_EU1\winupd\bin\Release\update.pdb

Imports

msvcr90

_configthreadlocale
__setusermatherr
__RTDynamicCast
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_invoke_watson
_controlfp_s
_initterm_e
wcscat_s
_getdrive
_chdrive
toupper
_beginthreadex
qsort
_strnicmp
atoi
strncpy_s
strcat_s
__iob_func
fwprintf
iswalnum
wcsncmp
iswdigit
wcscpy_s
strtok_s
wcstombs
_swprintf
_wcsupr
_vsnwprintf_s
_wsopen
strtoul
realloc
srand
rand
clock
swprintf_s
_wmakepath
_wcsdup
fopen
ftell
ferror
wcscat
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
_except_handler4_common
?terminate@@YAXXZ
wcsftime
_snwprintf
_wctime64_s
mbstowcs
strncpy
_wcsupr_s
_wfopen_s
fwrite
_wcsnicmp
fgets
_recalloc
calloc
strnlen
_errno
sscanf
strcmp
wcscpy
?_wopen@@YAHPB_WHH@Z
_lseek
_read
swscanf
strchr
strlen
memcpy
fseek
sprintf
strstr
mbstowcs_s
_wfsopen
fread
malloc
free
wcsncat_s
_wsplitpath_s
_ltow_s
_wfopen
feof
fgetws
fclose
wcsrchr
_time64
wcsncpy
swscanf_s
wcsncpy_s
??_U@YAPAXI@Z
??_V@YAXPAX@Z
wcschr
_wcslwr_s
_wsplitpath
wcsncat
?_wsopen@@YAHPB_WHHH@Z
_filelength
_close
wcscspn
wcsspn
_itow_s
_wtoi
_waccess
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
wcsnlen
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
wcslen
vswprintf_s
_vscwprintf
wcsstr
_wcsicmp
wcscmp
iswspace
memmove_s
_CxxThrowException
memcpy_s
memset
_snwprintf_s
__CxxFrameHandler3
_purecall
??3@YAXPAX@Z

scewxmlw

ord70
ord111
ord93
ord103
ord104

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

ws2_32

WSACleanup
gethostbyname
gethostname
WSAStartup
inet_ntoa

kernel32

GetVersionExW
GetFileSize
GetFullPathNameW
GetPrivateProfileIntW
TerminateThread
TryEnterCriticalSection
GetFileTime
MoveFileW
UnlockFile
LockFile
SetFilePointer
DuplicateHandle
SetLastError
WriteFile
ReadFile
RemoveDirectoryW
WideCharToMultiByte
CreateDirectoryW
GetFileAttributesExW
LocalFileTimeToFileTime
GetTimeFormatW
GetDateFormatW
CompareFileTime
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
RaiseException
CreateMutexW
ReleaseMutex
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateThread
GetLocaleInfoW
CreateProcessW
GlobalAlloc
GlobalFree
VerifyVersionInfoW
VerSetConditionMask
DeviceIoControl
SetErrorMode
GetExitCodeThread
GetSystemTime
WritePrivateProfileStringW
PulseEvent
LoadLibraryExW
SetFileAttributesW
GetFileAttributesW
lstrlenW
lstrcmpiW
SetFileTime
DosDateTimeToFileTime
LoadLibraryA
ExpandEnvironmentStringsA
InterlockedDecrement
CloseHandle
WaitForSingleObject
Sleep
CreateEventW
GetCurrentProcessId
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetCurrentProcess
GetDiskFreeSpaceExW
GetLastError
CopyFileW
FreeLibrary
GetProcAddress
LoadLibraryW
LocalFree
FormatMessageW
GetModuleFileNameW
OpenEventW
DeleteFileW
FindClose
FindNextFileW
FindFirstFileW
SystemTimeToFileTime
GetLocalTime
FileTimeToSystemTime
OutputDebugStringW
MoveFileExW
GetTempPathW
GetSystemWindowsDirectoryW
GetModuleHandleW
SetProcessShutdownParameters
GetCommandLineW
SetProcessAffinityMask
SetEvent
MultiByteToWideChar
lstrlenA
CreateFileW
TerminateProcess
GetExitCodeProcess
OpenProcess
GetComputerNameW
GetPrivateProfileStringW
GetSystemDirectoryW
GetWindowsDirectoryW
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
InterlockedExchangeAdd
LeaveCriticalSection

advapi32

AddAce
InitializeAcl
IsValidSid
GetLengthSid
CopySid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetAclInformation
GetAce
GetSecurityInfo
SetSecurityInfo
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
DeregisterEventSource
CreateProcessAsUserW
SetEntriesInAclW
BuildExplicitAccessWithNameW
GetSecurityDescriptorDacl
LookupAccountSidW
DuplicateTokenEx
RegQueryValueExA
RegOpenKeyExA
RegisterEventSourceW
GetTokenInformation
OpenProcessToken
GetUserNameW
ControlService
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
StartServiceW
QueryServiceConfigW
ImpersonateLoggedOnUser
RevertToSelf
SetThreadToken
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
ReportEventW

shell32

CommandLineToArgvW
ShellExecuteW
SHGetSpecialFolderPathW

shlwapi

PathGetDriveNumberW

msvcp90

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAE@XZ
?open@?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAEXPB_WHH@Z
??_D?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?endl@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@AAV21@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?close@?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?_Lock@_Mutex@std@@QAEXXZ
?_Unlock@_Mutex@std@@QAEXXZ

user32

GetSystemMetrics
ExitWindowsEx
GetForegroundWindow
LoadStringW

Sections

.text
Size: 382KB - Virtual size: 382KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 10KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 82KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f56e176693e2c03eb9d5eede0d01b05b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr90

scewxmlw

version

ws2_32

kernel32

advapi32

shell32

shlwapi

msvcp90

user32

Sections

.text Size: 382KB - Virtual size: 382KB

.rdata Size: 105KB - Virtual size: 104KB

.data Size: 10KB - Virtual size: 15KB

.rsrc Size: 82KB - Virtual size: 84KB

.text
Size: 382KB - Virtual size: 382KB

.rdata
Size: 105KB - Virtual size: 104KB

.data
Size: 10KB - Virtual size: 15KB

.rsrc
Size: 82KB - Virtual size: 84KB