de0cdef0ce357498800fb3bc6ac6a94e_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

de0cdef0ce357498800fb3bc6ac6a94e_JaffaCakes118
Size

147KB
MD5

de0cdef0ce357498800fb3bc6ac6a94e
SHA1

5fc0a3d4c0dbc903a5cd68090327ed2a48b75e63
SHA256

a1bd0ff591e4dc3a82d8e9a1382c3edbf6cdbfd04be8ce42ef94d58e00905f0b
SHA512

f7c41ace0b9487a99e2d818540f44e91ebab24a1316023cd1746ca1ef8db3217128c99592ee7e59f0d6d1c8195d4e76ceebd5738e5b2ca384f78a4ff84f941f4
SSDEEP

3072:SRyhSeoAwzznccBRJ9Ne1vEru/QOP8eAnRTxOcXupjaRK:SRyhQAwzjv7J9Ai6FEOc+daRK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de0cdef0ce357498800fb3bc6ac6a94e_JaffaCakes118

Files

de0cdef0ce357498800fb3bc6ac6a94e_JaffaCakes118
.exe windows:2 windows x86 arch:x86

1ee73fe1e3f52517989de00ef14c58b2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegQueryValueExA
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetFileSecurityW
RegQueryValueExW
OpenProcessToken
OpenThreadToken
DestroyPrivateObjectSecurity
GetSecurityDescriptorSacl
SetNamedSecurityInfoW
GetNamedSecurityInfoW
CreatePrivateObjectSecurityEx
GetSecurityDescriptorDacl
RegDeleteValueW
RegOpenKeyExA
RegCreateKeyExW

kernel32

ExpandEnvironmentStringsW
GetWindowsDirectoryW
FreeLibrary
GetCurrentThread
GetDateFormatA
GetTimeFormatA
InterlockedDecrement
InterlockedIncrement
FlushFileBuffers
GetFileSize
SetEndOfFile
UnlockFileEx
LockFileEx
SetFilePointer
ReadFile
GetSystemTime
SystemTimeToFileTime
CopyFileW
CreateFileW
GetFileAttributesW
SetFileAttributesW
LocalFree
RemoveDirectoryW
FindNextFileW
FindFirstFileW
CreateDirectoryW
UnmapViewOfFile
LocalAlloc
MapViewOfFile
GetTickCount
GetModuleHandleW
CloseHandle
SetLastError
GetVersion
InitializeCriticalSectionAndSpinCount
VirtualFree
ExitProcess
DeleteFileW
HeapAlloc
GetProcessHeap
HeapFree
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetLastError
GetVersionExA
GetVersionExW
InterlockedExchange
Sleep
InterlockedCompareExchange
OutputDebugStringA
GetModuleHandleA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
CreateFileMappingW
VirtualAllocEx
FindFirstFileA

msvcrt

fprintf
fflush
fclose
fread
_wfopen
_errno
_purecall
iswctype
_onexit
_lock
__dllonexit
_unlock
_controlfp
memmove
memcpy
memset
__set_app_type
__setusermatherr
_amsg_exit
_initterm
__initenv
exit
_XcptFilter
_exit
_cexit
__getmainargs

ole32

StringFromIID
CoInitialize
CoCreateInstance
StgOpenStorage
StgOpenStorageEx
PropVariantClear
CoTaskMemFree
CoUninitialize

oleaut32

SysStringLen
SysAllocStringLen
SysAllocStringByteLen
SysAllocString
SysFreeString
SysStringByteLen

ntdll

wcsrchr
_wcsnicmp
_ltow
_vsnprintf
towlower
atol
_vsnwprintf
wcsncmp
RtlUnwind
_wcsicmp

rpcrt4

UuidCreate

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

mscat32

CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseContext
CryptCATCatalogInfoFromContext
CryptCATAdminAcquireContext

user32

IsCharLowerW

msi

MsiSourceListAddSourceW
MsiGetTargetPathA
MsiGetProductInfoFromScriptA
MsiEnumProductsExW
MsiEnumProductsExA
MsiApplyMultiplePatchesW
MsiSetTargetPathA
MsiSourceListClearSourceW
MsiDatabaseOpenViewW
MsiEnumProductsA
MsiSummaryInfoPersist
MsiDatabaseGetPrimaryKeysW
MsiSourceListClearAllW
MsiOpenPackageA
MsiConfigureFeatureW
MsiSourceListForceResolutionW
MsiSetInternalUI
MsiDatabaseExportW
MsiQueryFeatureStateA
MsiGetProductCodeFromPackageCodeW
MsiRecordSetStreamW
MsiNotifySidChangeA
MsiSourceListAddSourceExA
MsiPreviewDialogA
MsiEnableUIPreview
MsiUseFeatureExW
MsiPreviewBillboardA
MsiSourceListAddMediaDiskW
MsiDatabaseIsTablePersistentW
MsiDatabaseCommit
MsiViewModify
MsiSetMode

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1ee73fe1e3f52517989de00ef14c58b2

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

ole32

oleaut32

ntdll

rpcrt4

version

mscat32

user32

msi

Sections

.text Size: 17KB - Virtual size: 17KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 9KB - Virtual size: 215KB

.rsrc Size: 113KB - Virtual size: 112KB

.text
Size: 17KB - Virtual size: 17KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 9KB - Virtual size: 215KB

.rsrc
Size: 113KB - Virtual size: 112KB