df11762f8826f89cb665455893b82890_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

df11762f8826f89cb665455893b82890_JaffaCakes118
Size

86KB
MD5

df11762f8826f89cb665455893b82890
SHA1

9cd6a65aff43f4f4eba9aa6c687059de6a6cd4d4
SHA256

7bd69f6f4811167045af28a7e9f95040785d65edac195f91e451b4e51ffe9975
SHA512

a4e2e115065d9a8687a15998131517b916c6c6eeec78321f526d9ffe3274772e9e7e15cef87a5927fc4631e0f3a9cfa87a2a0eca33f6bc8ea7b954c3c7646f1d
SSDEEP

1536:jHjH7h8la/lWPqWF0jqWKResrhGYbZo0iq2r0IVvYoHH8U1fLIkQNj6Y:vN8qwB0WFResNPbZOq242vYonVFrY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df11762f8826f89cb665455893b82890_JaffaCakes118

Files

df11762f8826f89cb665455893b82890_JaffaCakes118
.exe windows:5 windows x86 arch:x86

fa65e2aeb8091a6bd65526e2472f1efb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

hhsetup

??0CLocation@@QAE@XZ
?GetIdW@CTitle@@QAEPBGXZ
??4CPointerList@@QAEAAV0@ABV0@@Z
?GetColNo@CCollection@@QAEKXZ
?IncrementRefTitleCount@CCollection@@QAEXXZ
?NewLocation@CCollection@@AAEPAVCLocation@@XZ
?SetId@CLocation@@QAEXPBD@Z
?Open@CCollection@@QAEKPBD@Z
??1CCollection@@QAE@XZ
?NewTitle@CCollection@@AAEPAVCTitle@@XZ
?AddTail@CFIFOString@@QAEKPAD@Z
?AddRefedTitle@CCollection@@AAEKPAVCFolder@@@Z
?SetSampleLocation@CCollection@@QAEXPBG@Z

msvcrt20

printf
?open@fstream@@QAEXPBDHH@Z
_fstat
fgets
_mbsdup
??0ios@@QAE@PAVstreambuf@@@Z
_wspawnlpe
??1stdiostream@@UAE@XZ
??0ostrstream@@QAE@ABV0@@Z
mblen
?lockptr@ios@@IAEPAU_RTL_CRITICAL_SECTION@@XZ
fflush
__wgetmainargs
strerror
?flags@ios@@QBEJXZ

kernel32

GetCurrentProcessId
GetTickCount
VirtualUnlock
HeapCreate
SetConsoleActiveScreenBuffer
ReadConsoleOutputAttribute
GetLastError
GetExitCodeThread
GetConsoleMode
VirtualAlloc
EscapeCommFunction
SetConsoleNlsMode
QueryPerformanceCounter
GetCurrentThreadId
LoadLibraryA
GetConsoleInputExeNameA
GetSystemTimeAsFileTime
GetStartupInfoA
GetPrivateProfileSectionNamesW
GlobalAddAtomW
CreateJobObjectW

usp10

ScriptCPtoX
ScriptString_pSize
ScriptItemize
ScriptStringValidate
ScriptStringXtoCP
ScriptStringGetLogicalWidths
ScriptFreeCache
ScriptPlace
ScriptStringFree
ScriptStringCPtoX
ScriptString_pLogAttr

esent

JetAttachDatabaseWithStreaming
JetDupSession
JetSetCurrentIndex2
JetRetrieveKey
JetRetrieveColumns
JetRenameColumn
JetAddColumn
JetCreateInstance2
JetAttachDatabase2
JetTruncateLog

user32

EndDialog

msvcrt

_snprintf
_mbsnset
vprintf
__p___argc
??_G__non_rtti_object@@UAEPAXI@Z
_CItan
_strupr
atan2
gets
_environ
_wchmod
_spawnlpe
strncat

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fa65e2aeb8091a6bd65526e2472f1efb

Headers

DLL Characteristics

File Characteristics

Imports

hhsetup

msvcrt20

kernel32

usp10

esent

user32

msvcrt

Sections

.text Size: 35KB - Virtual size: 34KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 21KB - Virtual size: 46KB

.rsrc Size: 20KB - Virtual size: 20KB

.reloc Size: 512B - Virtual size: 360B

.text
Size: 35KB - Virtual size: 34KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 21KB - Virtual size: 46KB

.rsrc
Size: 20KB - Virtual size: 20KB

.reloc
Size: 512B - Virtual size: 360B