dfdbe1275ff59264379b12053352099c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

dfdbe1275ff59264379b12053352099c_JaffaCakes118
Size

351KB
MD5

dfdbe1275ff59264379b12053352099c
SHA1

2ca010b565e7ab84ed0743cf4be9604e20a263d0
SHA256

2f79a48ccd7dff66fb98495479280def955df9de3b93abc1c2f30d200756cf90
SHA512

7551e2cabde9d60e2c710b80014e573847cb7f32a4c034901f13e78174ab01c8a4dc8927c980e070e2a56dc9c9721db26a96795d73e21367806b9727ea989100
SSDEEP

6144:PDuCTrxWG69oTcODqHyek1+3us+3fx6DrmQE5QAOPcc+zrod84K:LuCTrLoyekfB3fx6V9kc+/IK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dfdbe1275ff59264379b12053352099c_JaffaCakes118

Files

dfdbe1275ff59264379b12053352099c_JaffaCakes118
.exe windows:8 windows x86 arch:x86

a15a7e4ea59516c341c4c3d1c5ee9f61

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advpack

RegisterOCX
IsNTAdmin
DelNode
ExecuteCab
RunSetupCommand
CloseINFEngine
LaunchINFSection
GetVersionFromFile
DelNodeRunDLL32
RegInstall
TranslateInfStringEx
ExtractFiles
NeedReboot
RegRestoreAll
LaunchINFSectionEx
FileSaveRestoreOnINF
SetPerUserSecValues
AdvInstallFile
RegSaveRestoreOnINF
FileSaveRestore
OpenINFEngine
FileSaveMarkNotExist
GetVersionFromFileEx
TranslateInfString
UserInstStubWrapper
RebootCheckOnInstall
RegSaveRestore
NeedRebootInit
UserUnInstStubWrapper
AddDelBackupEntry

user32

EndDialog
EnableMenuItem
CreateDialogParamA
LoadIconA
SetMenu
SetCursor
CheckMenuRadioItem
GetProcessDefaultLayout
SetWindowTextA
DrawTextA
OpenClipboard
DialogBoxParamA
SendMessageA
InvalidateRect
UpdateWindow
GetClientRect
EndPaint
LoadMenuA
DestroyMenu
SetDlgItemTextA
GetWindowTextA
OffsetRect
GetWindowLongA
PostQuitMessage
SetWindowLongA
SetProcessDefaultLayout
GetSysColorBrush
CloseClipboard
GetDlgCtrlID
MessageBoxA
ShowWindow
IsDialogMessageA
GetSubMenu
GetDlgItem
LoadStringA
WinHelpA
SetFocus
TranslateMessage
CharNextA
GetSysColor
DestroyWindow
GetWindowRect
GetMenu
MapWindowPoints
DispatchMessageA
CheckDlgButton
SetWindowPos
LoadAcceleratorsA
RegisterClassExA
HideCaret
CheckMenuItem
MessageBeep
BeginPaint
GetDesktopWindow
CallWindowProcA
ChildWindowFromPoint
TrackPopupMenuEx
SystemParametersInfoA
SetDlgItemInt
CreateWindowExA
IsChild
TranslateAcceleratorA
IsClipboardFormatAvailable
GetMessageA
ScreenToClient
LoadCursorA
EnableWindow
GetClipboardData
DefWindowProcA
CheckRadioButton

kernel32

IsBadStringPtrA
ReadFileEx
SetEnvironmentVariableA
SetFirmwareEnvironmentVariableA
lstrcmpiA
GetLocalTime
InterlockedExchangeAdd
CloseHandle
GetFirmwareEnvironmentVariableA
TransactNamedPipe
CallNamedPipeA
ExpandEnvironmentStringsA
WaitNamedPipeA
InterlockedIncrement
InterlockedPushEntrySList
DeleteFileA
WriteFile
PeekNamedPipe
WriteFileGather
InterlockedFlushSList
SystemTimeToFileTime
GetSystemTimeAdjustment
GetEnvironmentVariableA
FreeEnvironmentStringsA
GetModuleHandleA
CreateFileA
CompareStringA
VirtualFree
lstrlenA
InterlockedPopEntrySList
GetSystemTime
lstrcmpA
GetStringTypeExA
GetNamedPipeHandleStateA
GetProcessHeap
lstrcpynA
GetFileAttributesA
FileTimeToLocalFileTime
HeapAlloc
ReadFileScatter
GetFileAttributesExA
InterlockedCompareExchange
ConnectNamedPipe
GetFileTime
GetStringTypeA
lstrcpyA
ReadFile
HeapSize
GetEnvironmentStringsA
WriteFileEx
GetProcessHeaps
FileTimeToDosDateTime
DisconnectNamedPipe
GetSystemTimeAsFileTime
SetNamedPipeHandleState
InterlockedExchange
GetSystemTimes
FileTimeToSystemTime
lstrcatA
DosDateTimeToFileTime
VirtualAlloc
InterlockedDecrement
SetFilePointerEx
SetFilePointer

cryptui

ACUIProviderInvokeUI
CryptUIFreeViewSignaturesPagesA
EnrollmentCOMObjectFactory_getInstance
CryptUIDlgViewCTLA
CryptUIGetViewSignaturesPagesA
CryptUIWizCreateCertRequestNoDS
CryptUIDlgSelectStoreA
DllRegisterServer
CryptUIDlgViewContext
CryptUIFreeCertificatePropertiesPagesA
CryptUIWizImport
DllUnregisterServer
CryptUIWizBuildCTL
CryptUIStartCertMgr
CryptUIDlgViewCertificateA
CryptUIDlgViewSignerInfoA
CryptUIDlgViewCertificatePropertiesA
CryptUIWizQueryCertRequestNoDS
I_CryptUIProtect
RetrievePKCS7FromCA
CryptUIWizDigitalSign
I_CryptUIProtectFailure
CryptUIDlgSelectCertificateFromStore
CryptUIWizExport
CryptUIDlgFreeCAContext
CryptUIDlgCertMgr
CryptUIWizSubmitCertRequestNoDS
CryptUIDlgViewCRLA
WizardFree
LocalEnroll
CryptUIWizFreeDigitalSignContext
CryptUIWizCertRequest
CryptUIGetCertificatePropertiesPagesA
CryptUIDlgSelectCertificateA

Sections

.text
Size: 273KB - Virtual size: 273KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67KB - Virtual size: 712KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a15a7e4ea59516c341c4c3d1c5ee9f61

Headers

DLL Characteristics

File Characteristics

Imports

advpack

user32

kernel32

cryptui

Sections

.text Size: 273KB - Virtual size: 273KB

.data Size: 10KB - Virtual size: 9KB

.rsrc Size: 67KB - Virtual size: 712KB

.text
Size: 273KB - Virtual size: 273KB

.data
Size: 10KB - Virtual size: 9KB

.rsrc
Size: 67KB - Virtual size: 712KB