e0913d0d9b507836d124953bc5ef3056_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e0913d0d9b507836d124953bc5ef3056_JaffaCakes118
Size

628KB
MD5

e0913d0d9b507836d124953bc5ef3056
SHA1

e37bbc39192d5e79fa9cfb0a3d0b7833f410d52f
SHA256

f81e370d2d8435546d44df194cbe3d3ac1dd2d71fbccb8c2045fa7c50b00a20c
SHA512

f687a5275b16bff5454b99007e35aacfa281492452173fc9fd9f6f0ebef2fb8431668189bcfb22867cf1796d21d1dce2383bae3615fbe1d7780dcd212f364260
SSDEEP

12288:Gm5lDQPp9C/iBX4QaMfPwG4AGyQTsIQgIDx120E/1GhLZP1qPr:dqvC/ixBayQTUgIDrt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e0913d0d9b507836d124953bc5ef3056_JaffaCakes118

Files

e0913d0d9b507836d124953bc5ef3056_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b6e0b9d97e700f7f8f6acf24fbfeadcb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\repository\REL_AV12\winupd\bin\Release\update.pdb

Imports

msvcr100

_purecall
_snwprintf_s
_CxxThrowException
memcpy_s
wmemcpy_s
memmove_s
iswspace
wcscmp
iswdigit
toupper
_chdrive
_getdrive
__RTDynamicCast
memmove
ferror
ftell
_controlfp_s
_invoke_watson
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
?terminate@@YAXXZ
_snwprintf
_localtime64_s
wcsftime
mbstowcs
strncpy
_wcsupr_s
_wfopen_s
fwrite
_wcsnicmp
fgets
_recalloc
calloc
strnlen
_errno
sscanf
strcmp
wcscpy
?_wopen@@YAHPB_WHH@Z
fopen
_wcsdup
_wmakepath
iswalnum
wcscat_s
wcscpy_s
__CxxFrameHandler3
clock
rand
srand
realloc
strtoul
_wsopen
_vsnwprintf_s
_lseek
_read
swscanf
strstr
strchr
strlen
memcpy
memcmp
fseek
sprintf
mbstowcs_s
_wfsopen
fread
malloc
free
wcsncat_s
_ltow_s
??3@YAXPAX@Z
feof
fgetws
fclose
wcsrchr
_time64
wcsncpy
swscanf_s
wcsncpy_s
??_U@YAPAXI@Z
??_V@YAXPAX@Z
_wsplitpath_s
wcsncmp
_wcslwr_s
_wsplitpath
wcsncat
?_wsopen@@YAHPB_WHHH@Z
_filelength
_close
wcschr
wcscspn
wcsspn
_itow_s
_wtoi
_waccess
??0exception@std@@QAE@ABV01@@Z
wcsnlen
??2@YAPAXI@Z
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
wcslen
vswprintf_s
_vscwprintf
wcsstr
_wcsicmp
strncat
wcstombs
strncpy_s
strtok_s
atoi
_beginthreadex
qsort
memset
swprintf_s
_wfopen

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

ws2_32

inet_ntoa
gethostbyname
gethostname
WSAStartup
WSACleanup

scewxmlw

ord111
ord93
ord104
ord103
ord70

setupapi

SetupOpenInfFileW
SetupOpenFileQueue
SetupInstallFilesFromInfSectionW
SetupCloseInfFile
SetupCloseFileQueue
SetupInstallFromInfSectionW
SetupTermDefaultQueueCallback
SetupCommitFileQueueW
SetupDefaultQueueCallbackW
SetupInitDefaultQueueCallback
SetupInstallServicesFromInfSectionW

kernel32

InitializeCriticalSectionAndSpinCount
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
InterlockedExchangeAdd
InterlockedDecrement
LoadLibraryA
SetErrorMode
DeviceIoControl
DosDateTimeToFileTime
SetFileTime
lstrcmpiW
GetFullPathNameW
lstrlenW
WideCharToMultiByte
GetSystemTime
GetFileAttributesW
SetFileAttributesW
WritePrivateProfileStringW
VerSetConditionMask
VerifyVersionInfoW
GlobalAlloc
GlobalFree
CreateProcessW
RemoveDirectoryW
CreateDirectoryW
LoadLibraryW
GetLocaleInfoW
GetVersionExW
GetFileSize
ReadFile
GetPrivateProfileIntW
FileTimeToLocalFileTime
GetFileTime
MoveFileW
TerminateThread
WriteFile
LockFile
UnlockFile
TryEnterCriticalSection
SetFilePointer
LocalFileTimeToFileTime
GetTimeFormatW
GetDateFormatW
CreateMutexW
ReleaseMutex
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateThread
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
CloseHandle
PulseEvent
WaitForSingleObject
Sleep
CreateEventW
GetCurrentProcessId
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetLastError
GetCurrentProcess
GetDiskFreeSpaceExW
CopyFileW
LoadLibraryExW
GetModuleHandleW
SetLastError
FreeLibrary
GetProcAddress
LocalFree
FormatMessageW
GetModuleFileNameW
OpenEventW
DeleteFileW
FindClose
FindNextFileW
FindFirstFileW
SystemTimeToFileTime
GetLocalTime
FileTimeToSystemTime
OutputDebugStringW
MoveFileExW
GetTempPathW
GetSystemWindowsDirectoryW
GetCommandLineW
SetEvent
MultiByteToWideChar
lstrlenA
CreateFileW
GetSystemDirectoryW
TerminateProcess
GetExitCodeProcess
OpenProcess
GetComputerNameW
GetPrivateProfileStringW
EncodePointer
DecodePointer
InterlockedExchange
InterlockedCompareExchange
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter

user32

LoadStringW
GetSystemMetrics

advapi32

ReportEventW
RegisterEventSourceW
GetTokenInformation
OpenProcessToken
GetUserNameW
ControlService
QueryServiceStatus
CloseServiceHandle
OpenServiceW
DuplicateTokenEx
LookupAccountSidW
GetSecurityDescriptorDacl
BuildExplicitAccessWithNameW
SetEntriesInAclW
CreateProcessAsUserW
RegCreateKeyExW
RegSetValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
AddAce
SetSecurityInfo
InitializeAcl
GetSecurityInfo
GetAce
GetAclInformation
GetLengthSid
IsValidSid
CopySid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
SetThreadToken
RevertToSelf
ImpersonateLoggedOnUser
QueryServiceConfigW
StartServiceW
OpenSCManagerW
DeregisterEventSource

shell32

CommandLineToArgvW

shlwapi

PathGetDriveNumberW

userenv

ExpandEnvironmentStringsForUserW

msvcp100

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z

Sections

.text
Size: 367KB - Virtual size: 366KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 11KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.erdata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b6e0b9d97e700f7f8f6acf24fbfeadcb

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr100

version

ws2_32

scewxmlw

setupapi

kernel32

user32

advapi32

shell32

shlwapi

userenv

msvcp100

Sections

.text Size: 367KB - Virtual size: 366KB

.rdata Size: 115KB - Virtual size: 115KB

.data Size: 11KB - Virtual size: 16KB

.rsrc Size: 25KB - Virtual size: 24KB

.reloc Size: 36KB - Virtual size: 36KB

.erdata Size: 72KB - Virtual size: 72KB

.text
Size: 367KB - Virtual size: 366KB

.rdata
Size: 115KB - Virtual size: 115KB

.data
Size: 11KB - Virtual size: 16KB

.rsrc
Size: 25KB - Virtual size: 24KB

.reloc
Size: 36KB - Virtual size: 36KB

.erdata
Size: 72KB - Virtual size: 72KB