d60f8ee2ce97cf4dda52c33f8137c569_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

d60f8ee2ce97cf4dda52c33f8137c569_JaffaCakes118
Size

44KB
MD5

d60f8ee2ce97cf4dda52c33f8137c569
SHA1

ea43b8a4718eadb0612c69fc7bc22957bf5e3572
SHA256

73f3c48bf91b551070c283f9674a65ee16c09c5d520a35db97b7d00c352ab494
SHA512

ae5f6470b420f8dce9b8cf955a6705f1deb4b66595c53e84907e4571fac4eb1a46b6bc08d64bf66905311cbe0a5c78c9eda9b5f5a78d8ee49afcad91ea881478
SSDEEP

768:y5lHjK0xI6eb8fSbgG0J+96m6+jfxgRUdmQLkW24QR3/YVIiGQKKar/UEDmqzgCt:yPHjfxIt8cgp0xxjmbQLkj4I/YV/GQs9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d60f8ee2ce97cf4dda52c33f8137c569_JaffaCakes118

Files

d60f8ee2ce97cf4dda52c33f8137c569_JaffaCakes118
.exe windows:5 windows x86 arch:x86

7e7df4b1a2dff39bb4218716c9c529ec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

esent

JetGetInstanceInfo
JetGotoSecondaryIndexBookmark
JetFreeBuffer
JetBeginSession
JetIndexRecordCount
JetComputeStats
JetCommitTransaction
JetResetTableSequential
JetMove
JetOpenFileInstance
JetRetrieveColumns
JetDelete
JetPrepareUpdate
JetRetrieveKey
JetMakeKey
JetGetCursorInfo
JetOSSnapshotPrepare
JetAttachDatabase
JetGetRecordPosition
JetGotoPosition
JetGetLogInfo
JetBeginExternalBackupInstance
JetTerm
JetSetCurrentIndex2
JetEscrowUpdate
JetGetTruncateLogInfoInstance
JetGotoBookmark
JetStopService
JetCloseTable
JetResetSessionContext
JetStopServiceInstance
JetUpdate@20
JetAttachDatabase2

kernel32

GetSystemTimeAsFileTime
FillConsoleOutputCharacterW
GetLocaleInfoW
GetCommandLineW
GetNumberOfConsoleInputEvents
GetNumberFormatW
AddRefActCtx
LocalAlloc
EndUpdateResourceW
CmdBatNotification
GenerateConsoleCtrlEvent
GetLocalTime
BuildCommDCBAndTimeoutsA
EnumLanguageGroupLocalesA
EnumSystemLocalesA
GetNamedPipeInfo
HeapCreate
GlobalHandle
FindCloseChangeNotification
FindFirstVolumeA
LoadLibraryA
SetTapeParameters
LoadResource
GetEnvironmentStrings
GetComputerNameExW
IsDBCSLeadByteEx
VirtualAlloc
CompareFileTime
IsDebuggerPresent
GetSystemInfo
OpenConsoleW
EnumResourceNamesA
UnregisterWaitEx
WriteConsoleOutputCharacterW
SetConsoleMaximumWindowSize
MoveFileExW
WriteFileEx
AddLocalAlternateComputerNameA
GetVersionExW
WritePrivateProfileStructW

userenv

ExpandEnvironmentStringsForUserW
ExpandEnvironmentStringsForUserA
GetUserProfileDirectoryW
GetAppliedGPOListA
GetAllUsersProfileDirectoryA
WaitForUserPolicyForegroundProcessing
RsopAccessCheckByType
GetDefaultUserProfileDirectoryW
GetProfileType
ProcessGroupPolicyCompleted
UnloadUserProfile
LoadUserProfileA
GetAllUsersProfileDirectoryW
DeleteProfileA
LeaveCriticalPolicySection
RegisterGPNotification
GetProfilesDirectoryA
RsopResetPolicySettingStatus
GetNextFgPolicyRefreshInfo
WaitForMachinePolicyForegroundProcessing
UnregisterGPNotification
GetDefaultUserProfileDirectoryA
ProcessGroupPolicyCompletedEx
DllGetClassObject
RsopSetPolicySettingStatus
RsopLoggingEnabled
GetProfilesDirectoryW
DestroyEnvironmentBlock
GetGPOListA
RsopFileAccessCheck
GetPreviousFgPolicyRefreshInfo
LoadUserProfileW
DeleteProfileW
FreeGPOListW

cfgmgr32

CM_Is_Dock_Station_Present_Ex
CM_Enumerate_Classes
CM_Locate_DevNode_ExA
CM_Add_Empty_Log_Conf
CM_Setup_DevNode_Ex
CMP_WaitNoPendingInstallEvents
CM_Run_Detection
CM_Get_Device_ID_List_SizeA
CM_Remove_SubTree_Ex
CM_Connect_MachineA
CM_Open_Class_KeyW
CM_Get_Device_Interface_Alias_ExW
CM_Get_Device_ID_List_Size_ExW
CM_Open_Class_Key_ExA
CM_Enable_DevNode_Ex
CM_Get_Class_Registry_PropertyA
CM_Get_DevNode_Registry_Property_ExA
CM_Disconnect_Machine
CM_Unregister_Device_Interface_ExW
CM_Open_DevNode_Key
CM_Invert_Range_List
CM_Get_HW_Prof_FlagsW
CM_Disable_DevNode_Ex
CM_Detect_Resource_Conflict
CM_Set_HW_Prof_FlagsW
CM_Get_Res_Des_Data_Size
CM_Open_Class_KeyA
CM_Get_Device_Interface_List_SizeA
CM_Set_HW_Prof
CM_Detect_Resource_Conflict_Ex
CM_Get_Device_ID_List_Size_ExA
CM_Free_Range_List
CM_Get_Device_Interface_ListA
CM_Enumerate_Enumerators_ExW
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_ExA
CM_Get_Device_Interface_List_Size_ExW
CM_Get_Next_Res_Des
CM_Locate_DevNode_ExW
CM_Query_Arbitrator_Free_Size_Ex
CM_Get_Resource_Conflict_DetailsW
CM_Get_First_Log_Conf
CM_Move_DevNode
CM_Get_First_Log_Conf_Ex
CM_Set_DevNode_Registry_PropertyW

msvcrt40

putc
_wspawnvpe
__RTDynamicCast
??1ofstream@@UAE@XZ
?sputc@streambuf@@QAEHH@Z
_ismbbkana
?lock@ios@@QAAXXZ
??6ostream@@QAEAAV0@M@Z
?init@ios@@IAEXPAVstreambuf@@@Z
isalpha
_CIatan2
??_Difstream@@QAEXXZ
??_Gifstream@@UAEPAXI@Z
??5istream@@QAEAAV0@AAH@Z
_wsopen
_dstbias
?str@ostrstream@@QAEPADXZ
?tie@ios@@QBEPAVostream@@XZ
?ws@@YAAAVistream@@AAV1@@Z
putchar
??0stdiobuf@@QAE@ABV0@@Z
_wtmpnam
fputws
?xalloc@ios@@SAHXZ
_swab
?get@istream@@QAEAAV1@AAE@Z
ispunct
_wstrtime

ntdll

ZwCreateDirectoryObject
ZwCreateTimer
LdrGetProcedureAddress
NtCreateMutant
RtlEqualLuid
RtlDefaultNpAcl
NtCloseObjectAuditAlarm
NtQuerySystemInformation
NtDisplayString
ZwLockProductActivationKeys
NtContinue
ZwSetInformationToken
memcmp
RtlIpv6StringToAddressW
NtSetContextThread
ZwOpenThreadToken
RtlDeleteAtomFromAtomTable
NtQueryValueKey
ZwProtectVirtualMemory
NtRenameKey
ZwDeleteObjectAuditAlarm
ZwReleaseSemaphore
NtCreateIoCompletion
NtFlushBuffersFile
RtlSetGroupSecurityDescriptor
ZwSetSystemPowerState
NtResumeProcess
ZwSaveKeyEx
RtlDestroyEnvironment
ZwModifyBootEntry
NtQuerySystemTime
RtlAddCompoundAce
RtlNormalizeProcessParams

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7e7df4b1a2dff39bb4218716c9c529ec

Headers

DLL Characteristics

File Characteristics

Imports

esent

kernel32

userenv

cfgmgr32

msvcrt40

ntdll

Sections

.text Size: 31KB - Virtual size: 31KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 1KB - Virtual size: 23KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 31KB - Virtual size: 31KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 1KB - Virtual size: 23KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1024B - Virtual size: 1024B