dba6177fe0ce475f7e4a4d0a84038545_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

dba6177fe0ce475f7e4a4d0a84038545_JaffaCakes118
Size

861KB
MD5

dba6177fe0ce475f7e4a4d0a84038545
SHA1

7cb66691fc59211ad7e1039901c35b58360320ae
SHA256

16c41fad403ff512e512a6b08fe341e53d21720d9d3e21ef22ca4172af761cb4
SHA512

7c6bffd673264b4fed203d87f8896766c1a3df0c08cf84133cbb8dfb9ca08e7119ea35826e67aa6e31c3ce3bc2b1061e9bb59d8d438131ac7d62f9bd99891b13
SSDEEP

24576:a4Y/l2aajMebkft6HShzjzOzonBphWUiq4cld5dZf9fQ+hTW:Kl2abeAft+uHNx9vB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dba6177fe0ce475f7e4a4d0a84038545_JaffaCakes118

Files

dba6177fe0ce475f7e4a4d0a84038545_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b62d579d3c31a77e066eb8eadf129bfa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MapVirtualKeyA
GetRawInputBuffer
IsGUIThread
DdeQueryStringA
SwitchToThisWindow
GetMenuDefaultItem
ExcludeUpdateRgn
AnyPopup
WCSToMBEx
GetAsyncKeyState
SetWindowPos
ModifyMenuA
ClientToScreen
MonitorFromRect
DdeGetQualityOfService
DialogBoxIndirectParamAorW
AnimateWindow
DrawStateA
PaintMenuBar
wvsprintfW
CharUpperW
QuerySendMessage
EnumPropsExW
GetCursor
DlgDirListComboBoxW
SetThreadDesktop
ChangeDisplaySettingsA
SetTaskmanWindow
IsChild
RegisterClipboardFormatW
GetAncestor
LoadImageA
CsrBroadcastSystemMessageExW
DefRawInputProc
RegisterWindowMessageW
IMPSetIMEA
SetShellWindow
RegisterUserApiHook
UserRegisterWowHandlers
DefDlgProcA
SetLayeredWindowAttributes
SendMessageCallbackA
EnumWindowStationsA
TranslateAcceleratorW

kernel32

GetDriveTypeA
SwitchToThread
QueryInformationJobObject
GetProcessId
SleepEx
GetFileInformationByHandle
SetThreadPriorityBoost
GetDateFormatW
DeleteFileA
FindNextVolumeMountPointA
SetComPlusPackageInstallStatus
GetProfileSectionW
LoadLibraryA
IsValidLocale
QueueUserAPC
SetErrorMode
GetNumberOfConsoleInputEvents
GetProfileIntA
GetModuleHandleA
GetTimeZoneInformation
_llseek
GetProcessIoCounters
GetCalendarInfoW
CreateNamedPipeA
ResetWriteWatch
FindNextVolumeW
WriteProfileStringA
WaitNamedPipeA
_lcreat
DefineDosDeviceA
GetProcessVersion
SetLocalPrimaryComputerNameA
_hwrite
GetWindowsDirectoryA
GetCurrentProcessId
QueryMemoryResourceNotification
UnregisterWait
GetNextVDMCommand
GetStartupInfoA
GetThreadPriority
VirtualAlloc
GetDiskFreeSpaceA
lstrcmp
SetConsolePalette
SetConsoleTitleA
Toolhelp32ReadProcessMemory
GetConsoleAliasesLengthA
FormatMessageA

advapi32

SystemFunction027
CredMarshalCredentialA
CryptDestroyKey
GetInformationCodeAuthzLevelW
StartServiceCtrlDispatcherW
GetCurrentHwProfileA
QueryServiceStatus
I_ScSendTSMessage
CloseCodeAuthzLevel
RegCreateKeyW
LookupPrivilegeValueA
LookupPrivilegeValueW
SaferIdentifyLevel
MapGenericMask
InitiateSystemShutdownA
DecryptFileA
PrivilegedServiceAuditAlarmW
ReadEncryptedFileRaw
BuildTrusteeWithSidA
GetAce
CloseTrace
LsaFreeMemory
GetSecurityDescriptorDacl
ElfBackupEventLogFileW
AddAccessDeniedAce
QueryAllTracesA
WmiReceiveNotificationsA
FreeInheritedFromArray
GetLengthSid
ComputeAccessTokenFromCodeAuthzLevel
OpenServiceA
ConvertSecurityDescriptorToAccessA
WmiSetSingleItemW
WmiQueryAllDataMultipleA
LookupSecurityDescriptorPartsA
RegSaveKeyW
CryptSetHashParam
CryptHashData
LookupAccountNameW
InitiateSystemShutdownW
GetSecurityInfoExW
GetNumberOfEventLogRecords
InitializeSid
SystemFunction011
CryptSetProvParam

ntdll

NtQueryInformationToken
wcstoul
RtlApplyRXactNoFlush
NtIsSystemResumeAutomatic
ZwFreeVirtualMemory
_strcmpi
DbgUiRemoteBreakin
isalpha
ZwQueryMultipleValueKey
RtlUpdateTimer
RtlCopyLuidAndAttributesArray
abs
NtFlushKey
RtlIsGenericTableEmpty
RtlSetLastWin32Error
RtlCharToInteger
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle
RtlUpperChar
ZwTestAlert
wcstol
ZwSetTimer
NtFindAtom
ZwEnumerateSystemEnvironmentValuesEx
NtInitializeRegistry
KiRaiseUserExceptionDispatcher
RtlGetUserInfoHeap
ZwSetEvent
NtGetPlugPlayEvent
ZwCompactKeys
RtlTimeToElapsedTimeFields
isalnum
NtQueryTimer
RtlUnicodeToCustomCPN
RtlConvertSidToUnicodeString
ZwCreateProcessEx
NtUnloadDriver
VerSetConditionMask
RtlTraceDatabaseCreate

hhsetup

?GetMasterCHM@CCollection@@QAEHPAPAGPAG@Z
?AddFolder@CCollection@@QAEPAVCFolder@@PBDKPAKG@Z
?bIsVisable@CFolder@@QAEHXZ
??0CFIFOString@@QAE@XZ
?HandleCollection@CCollection@@AAEKPAVCParseXML@@PAD@Z
??4CFIFOString@@QAEAAV0@ABV0@@Z
??1CTitle@@QAE@XZ
?Next@CPointerList@@QAEPAUListItem@@PAU2@@Z
?SetTitle@CFolder@@QAEXPBD@Z
?GetTitleW@CLocation@@QAEPBGXZ
?DeleteTitle@CCollection@@AAEKPAVCTitle@@@Z
?ConfirmTitles@CCollection@@QAEXXZ
??4CLocation@@QAEAAV0@ABV0@@Z
?GetCollectionFileNameW@CCollection@@QAEPBGXZ
?GetLangId@CCollection@@QAEGPBD@Z
??4CPointerList@@QAEAAV0@ABV0@@Z
?SetNextLocation@CLocation@@QAEXPAV1@@Z
??1CCollection@@QAE@XZ
?GetFirstChildFolder@CFolder@@QAEPAV1@XZ
?GetTitleW@CFolder@@QAEPBGXZ
?SetTitle@CFolder@@QAEXPBG@Z
?GetIdW@CTitle@@QAEPBGXZ
?IncrementRefTitleCount@CCollection@@QAEXXZ
?GetVolumeW@CLocation@@QAEPBGXZ
?GetCollectionFileName@CCollection@@QAEPBDXZ
?AddChildFolder@CFolder@@QAEPAV1@PBGKPAKG@Z
?RemoveAll@CPointerList@@QAEXXZ
?FindLocation@CCollection@@QAEPAVCLocation@@PBGPAI@Z
?AddFolder@CCollection@@QAEPAVCFolder@@PBGKPAKG@Z
?Dirty@CCollection@@QAEXXZ
?AddChildFolder@CFolder@@QAEKPAV1@@Z
?GetVersion@CCollection@@QAEKXZ
?GetNextLocation@CLocation@@QAEPAV1@XZ
?MergeKeywords@CCollection@@QAEHPAD@Z
??4CTitle@@QAEAAV0@ABV0@@Z

w32topl

ToplVertexGetInEdge
ToplIterAdvance
ToplScheduleCacheDestroy
ToplEdgeInit
ToplListAddElem
ToplIterCreate
ToplHeapInsert
ToplIterGetObject
ToplScheduleValid
ToplEdgeSetFromVertex
ToplHeapCreate
ToplScheduleImport
ToplMakeGraphState
ToplGraphFindEdgesForMST
ToplEdgeSetToVertex
ToplSTHeapAdd
ToplHeapExtractMin
ToplEdgeGetToVertex
ToplEdgeDestroy
ToplSTHeapDestroy
ToplGraphFree
ToplEdgeDisassociate
ToplScheduleMerge
ToplEdgeGetWeight
ToplScheduleMaxUnavailable
ToplScheduleCacheCreate
ToplVertexGetOutEdge

Sections

.text
Size: 578KB - Virtual size: 578KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 273KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b62d579d3c31a77e066eb8eadf129bfa

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

advapi32

ntdll

hhsetup

w32topl

Sections

.text Size: 578KB - Virtual size: 578KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 273KB - Virtual size: 1.7MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 578KB - Virtual size: 578KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 273KB - Virtual size: 1.7MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 1024B