d4c46b8c69229d8522642c4eae241ff5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d4c46b8c69229d8522642c4eae241ff5_JaffaCakes118
Size

472KB
MD5

d4c46b8c69229d8522642c4eae241ff5
SHA1

971e68f9b0a2952c5684ade9632d2c3fe9139c1d
SHA256

fe9de8652e338b5b021a4638ccf332e712da07d2ea9f0947489798a8d80549ec
SHA512

1e6c62bca32149b3944b3149edc698cd65d36011ae738ca8c8539d1dedcc9966011b9037f86fd3bdb6d5e23b8aeacf88b84eb70d169f4d3a93aa0a0e3bc3358c
SSDEEP

12288:eK1Vf3ykDa9uRXYU3euci3YZM6b/zqmqJtYg:eKXf3yulX6ZM63qm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d4c46b8c69229d8522642c4eae241ff5_JaffaCakes118

Files

d4c46b8c69229d8522642c4eae241ff5_JaffaCakes118
.exe windows:5 windows x86 arch:x86

3581884fbac4c76445bd50cfdb5ad507

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

user32

RegisterDeviceNotificationA
OemKeyScan
GetForegroundWindow
CharPrevA
SetClassLongA
GetWindowLongA
IsDialogMessageA
PrivateExtractIconExA
LoadImageW
GetRegisteredRawInputDevices
CloseClipboard
EnableMenuItem
SoftModalMessageBox
DdeDisconnect
CreateDesktopW
TrackMouseEvent
DlgDirSelectExA
BlockInput
CopyRect
SetWinEventHook
PackDDElParam
IsCharAlphaNumericA
MessageBoxA
GetMessageW
SetMenuInfo
GetDialogBaseUnits
CheckMenuItem
ReasonCodeNeedsBugID
SystemParametersInfoA
GetSysColorBrush
SetMenuContextHelpId
UserRealizePalette
SendDlgItemMessageW
RegisterUserApiHook
IsZoomed
MessageBoxExA
DrawCaptionTempW
wvsprintfW

crypt32

CertSerializeCertificateStoreElement
I_CryptUninstallOssGlobal
I_CryptFreeTls
CryptSetKeyIdentifierProperty
CryptEnumOIDInfo
CertCreateContext
CryptEncodeObjectEx
CryptEncodeObject
CertAddEncodedCertificateToSystemStoreA
RegCreateHKCUKeyExU
I_CryptWalkAllLruCacheEntries
CryptDecryptAndVerifyMessageSignature
CertNameToStrW
CryptVerifyDetachedMessageSignature
CryptImportPublicKeyInfo
CryptBinaryToStringW
CertAddStoreToCollection
CryptSignAndEncryptMessage
CryptInitOIDFunctionSet
CertAlgIdToOID
CertDeleteCTLFromStore
CertCreateCertificateContext
I_CryptFindLruEntry
I_CryptSetTls
CertEnumCRLsInStore
CryptHashMessage
CertFindSubjectInSortedCTL
I_CryptDetachTls
CryptMsgCalculateEncodedLength
CertVerifyCertificateChainPolicy
CryptMsgClose
CertOpenSystemStoreA
CryptGetKeyIdentifierProperty
CertGetPublicKeyLength
I_CryptGetLruEntryIdentifier
CryptSIPRetrieveSubjectGuidForCatalogFile
CertVerifyValidityNesting
RegCreateKeyExU
CryptImportPublicKeyInfoEx
CryptMemAlloc
CryptSignHashU
CertCreateCTLEntryFromCertificateContextProperties
CryptMsgSignCTL
CertGetCertificateContextProperty

kernel32

VirtualFree
GetCurrentThread
PeekConsoleInputA
VirtualAlloc
GlobalDeleteAtom
FindNextChangeNotification
GlobalLock
GetDefaultCommConfigA
GetStringTypeA
LZCopy
HeapQueryInformation
LoadLibraryA
LocalAlloc
CreateTapePartition
RegisterWowBaseHandlers
_hwrite
WaitForMultipleObjectsEx
Module32FirstW
CreateProcessInternalW
UTRegister
HeapReAlloc
SetConsoleCP
GetLocaleInfoA
OutputDebugStringW
GetSystemTimeAdjustment
WriteTapemark
RemoveVectoredExceptionHandler
GetSystemDefaultLCID
GetFirmwareEnvironmentVariableA
ReleaseSemaphore
FreeConsole
ReleaseActCtx
GetConsoleAliasExesLengthW
HeapAlloc
EnumSystemLocalesW
CreateMutexA
AddLocalAlternateComputerNameW
QueryDosDeviceA
SetConsoleScreenBufferSize
GetDiskFreeSpaceA
EnumResourceNamesW
GetEnvironmentStringsW
DefineDosDeviceW
DeleteCriticalSection
CreateNamedPipeW
TransactNamedPipe
VirtualQuery
SignalObjectAndWait
SetVolumeLabelW
QueryPerformanceCounter
LZSeek

ntdll

RtlAllocateHeap
ZwQueryQuotaInformationFile
RtlCopyLuid
__isascii
NtFilterToken
NtCompactKeys
ZwQueryFullAttributesFile
RtlAppendUnicodeToString
iswctype
NtFindAtom
RtlGetNativeSystemInformation
RtlNewSecurityObject
_lfind
CsrCaptureMessageBuffer
NtTerminateJobObject
NtQueryEaFile
RtlZombifyActivationContext
RtlSetLastWin32ErrorAndNtStatusFromNtStatus
isgraph
ZwSetInformationDebugObject
NtGetDevicePowerState
ZwCompleteConnectPort
NtTestAlert
PfxInitialize
ZwSetBootEntryOrder
NtRemoveProcessDebug
ZwSetInformationFile
DbgBreakPoint
ZwWaitForSingleObject
NtReleaseSemaphore
NtResumeProcess
ZwCreateFile
RtlSecondsSince1970ToTime
ZwOpenJobObject
NtModifyBootEntry

sqlunirl

_SendMessageTimeout_@28
_CreateFontIndirect@4
_GetCharWidthFloat_@16
_ChangeServiceConfig_@44
_ChangeMenu_@20
_CreateFont@56
_CharToOemBuff_@12
_RegOpenKey_@12
_WritePrivateProfileString_@16
_RegUnLoadKey_@8
_GetSaveFileName@4
_GlobalAddAtom_@4
_UnregisterClass_@8
_VkKeyScanEx_@8
_RegQueryValueEx_@24
_GetServiceDisplayName_@16
_GetVersionEx@4
_GetWindowsDirectory_@8
_GetCharWidth32_@16
_WaitNamedPipe_@8
_CreateWindowStation_@16
_GetPrivateProfileSection_@16
_RegisterClipboardFormat_@4
_SearchPath_@24
_PostMessage@16
_GetDiskFreeSpaceEx_@16

winscard

SCardTransmit
SCardReleaseAllEvents
SCardGetCardTypeProviderNameA
SCardIntroduceReaderA
SCardBeginTransaction
SCardAddReaderToGroupA
SCardIntroduceCardTypeA
SCardStatusA
SCardForgetCardTypeA
SCardIntroduceReaderGroupA
SCardGetProviderIdA
SCardListInterfacesW
SCardListCardsW
SCardAccessNewReaderEvent
SCardAddReaderToGroupW
SCardSetAttrib
SCardStatusW
g_rgSCardRawPci
SCardSetCardTypeProviderNameW
SCardEndTransaction
SCardRemoveReaderFromGroupW
SCardLocateCardsByATRW
SCardLocateCardsW
SCardState
SCardCancel
SCardListCardsA
SCardDisconnect
SCardGetProviderIdW
g_rgSCardT1Pci
SCardIntroduceReaderW

Sections

.text
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 150KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 595KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 214KB - Virtual size: 214KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3581884fbac4c76445bd50cfdb5ad507

Headers

File Characteristics

Imports

user32

crypt32

kernel32

ntdll

sqlunirl

winscard

Sections

.text Size: 105KB - Virtual size: 105KB

.rdata Size: 150KB - Virtual size: 150KB

.data Size: 1KB - Virtual size: 595KB

.rsrc Size: 214KB - Virtual size: 214KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 105KB - Virtual size: 105KB

.rdata
Size: 150KB - Virtual size: 150KB

.data
Size: 1KB - Virtual size: 595KB

.rsrc
Size: 214KB - Virtual size: 214KB

.reloc
Size: 1024B - Virtual size: 1024B