e1ddf72c6a24bd59f46efd358f21ac13_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e1ddf72c6a24bd59f46efd358f21ac13_JaffaCakes118
Size

425KB
MD5

e1ddf72c6a24bd59f46efd358f21ac13
SHA1

1232126a354fb3c5e6cbb516d827bef51c5d373b
SHA256

82d79ba1638b6dad7f928a7d2d90108695cfb592554562e799157a680d1f1da8
SHA512

77cd53aa1c81c6fa29eed788528370d148a8d568dadab08106e884a09f6a64de55cef6a1494e77905ee17a803d888b7689b20eff35d590f578b6f04d0e95ebaa
SSDEEP

12288:K1y33A8HLGtRx7Gq8uWm428uVnhCYeNAevKYGztfBJ:ZQ4LMD7suWmt/hCeeyYmtf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e1ddf72c6a24bd59f46efd358f21ac13_JaffaCakes118

Files

e1ddf72c6a24bd59f46efd358f21ac13_JaffaCakes118
.exe windows:5 windows x86 arch:x86

2c9e0fed754acfd84b398ff5bb1b45eb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleExA
_llseek
GetConsoleWindow
TryEnterCriticalSection
GetNumaAvailableMemoryNode
ClearCommError
GetUserDefaultLCID
LoadLibraryA
PulseEvent
GetCurrentThread
GetLogicalDrives
MoveFileExA
LockResource
ReadConsoleOutputCharacterA
TlsAlloc
CreateFileMappingW
FlushConsoleInputBuffer
SetConsoleDisplayMode
WTSGetActiveConsoleSessionId
SetThreadIdealProcessor
UnhandledExceptionFilter
UnregisterWait
CreateConsoleScreenBuffer
SetThreadPriority
IsSystemResumeAutomatic
UnlockFileEx
OpenMutexA
FindActCtxSectionStringW
GetConsoleAliasExesLengthW
SetFileApisToANSI
GlobalAlloc
SetLocaleInfoW
AllocateUserPhysicalPages
GetModuleHandleA
GetVersion
GetNumberOfConsoleFonts
FindResourceW
VirtualAlloc
GetUserGeoID
WaitNamedPipeA
IsDBCSLeadByte
UnlockFile
CreateHardLinkW
DeactivateActCtx
FileTimeToSystemTime
FindFirstFileExW
CreateProcessInternalA

sqlunirl

_MessageBox@16
_IsCharAlpha_@4
_FindWindow_@8
_SetVolumeLabel_@8
_OpenEvent_@12
_GetDlgItemText@16
_CreateMutex_@12
_ReplaceText_@4
_GetTabbedTextExtent_@20
_ChooseFont_@4
_FormatMessage@28
_GetProp@8
_lstrcat_@8
_NDdeTrustedShareEnum_@24
_wvsprintf_@12
_SetWindowText@8
_RegSaveKey_@12
_GetCharABCWidthsFloat_@16
_IsCharUpper_@4
_GetUnicodeRedirectionLayer@0
_CreateFile@28
_GetCharWidthFloat_@16
_GetDefaultCommConfig_@12
_RegOpenKeyEx_@20
_CreateIC_@16
_GetAtomName_@12
_NDdeShareSetInfo_@24
_GetWindowsDirectory_@8
_StartService_@12
_GetOutlineTextMetrics_@12
_GetObject@12
_CreateDialogIndirectParam@20
_ObjectPrivilegeAuditAlarm_@24
_CopyFileEx_@24
_DialogBoxIndirectParam_@20

security

QueryCredentialsAttributesW
ImpersonateSecurityContext
QueryContextAttributesA
DecryptMessage
ExportSecurityContext
QuerySecurityPackageInfoW
DeleteSecurityContext
InitializeSecurityContextA
AcquireCredentialsHandleA
ApplyControlToken
ImportSecurityContextW
QueryContextAttributesW
QuerySecurityPackageInfoA
DeleteSecurityPackageW
SealMessage
EnumerateSecurityPackagesW
UnsealMessage
EncryptMessage
FreeCredentialsHandle
FreeContextBuffer
MakeSignature
AcquireCredentialsHandleW
DeleteSecurityPackageA
AddSecurityPackageW
QueryCredentialsAttributesA
InitializeSecurityContextW
EnumerateSecurityPackagesA
QuerySecurityContextToken
InitSecurityInterfaceW
AddSecurityPackageA
InitSecurityInterfaceA
ImportSecurityContextA

msdtcprx

?RemoveDtc@@YGJPAG00@Z
DllGetClassObject
DTC_XaRollback
DTC_XaCommit
DTC_XaStart
?Create@CNameService@@SGJPAPAV1@@Z
ContactToNameObject
DllGetTransactionManagerCore
?InstallDtcClient@@YGJPAGKK@Z
?GetDtcLogPath@@YGHKPAG@Z
DTC_XaComplete
DTC_XaForget
DllGetDTCConnectionManager
DllGetDTCProxy
DTC_XaRecover
DTC_XaPrepare
ShutDownCM
DTC_XaOpen
DTC_XaEnd
DTC_XaClose
DllGetDTCUtilObject
?CreateInstance@CTmProxyCore@@SGJPAPAV1@PAUIUnknown@@@Z

ntdll

ZwInitiatePowerAction
RtlNumberGenericTableElements
RtlNtStatusToDosErrorNoTeb
ZwCreateToken
bsearch
ZwEnumerateBootEntries
NtUnloadDriver
NtCreateJobObject
ZwResumeThread
LdrSetDllManifestProber
RtlZeroHeap
RtlDeregisterWait
LdrGetProcedureAddress
RtlQueryDepthSList
CsrCaptureMessageString
NtReplyWaitReceivePort
NtFlushWriteBuffer
ZwRequestWaitReplyPort
NtSetHighWaitLowEventPair
NtQueryBootEntryOrder
RtlSecondsSince1980ToTime
RtlSetSecurityObjectEx
RtlUnlockHeap
RtlQueryEnvironmentVariable_U
NtProtectVirtualMemory
RtlGetLengthWithoutTrailingPathSeperators
RtlDebugPrintTimes
NtQueryDefaultUILanguage
NtQueryInformationAtom
NtModifyBootEntry
ZwCompactKeys
ZwUnmapViewOfSection
ZwWaitForDebugEvent
ZwAccessCheck
ZwOpenMutant
ZwTranslateFilePath
RtlUnicodeStringToCountedOemString
CsrCaptureMessageBuffer
ZwSetInformationFile
RtlSetGroupSecurityDescriptor
NtOpenProcessTokenEx

wininet

InternetSetPerSiteCookieDecisionW
InternetTimeToSystemTime
FindNextUrlCacheContainerW
FtpPutFileW
InternetGetCookieExW
FindFirstUrlCacheEntryExW
FtpCommandA
GetUrlCacheEntryInfoW
GetUrlCacheConfigInfoW
GetUrlCacheEntryInfoExA
PrivacyGetZonePreferenceW
IncrementUrlCacheHeaderData
CreateUrlCacheGroup
ShowSecurityInfo
InternetSetCookieW
UnlockUrlCacheEntryFileA
RetrieveUrlCacheEntryFileA
FtpGetCurrentDirectoryW
ShowClientAuthCerts
InternetFindNextFileA
InternetFortezzaCommand
InternetCreateUrlW
GetUrlCacheEntryInfoA
FtpRenameFileW
FindFirstUrlCacheEntryW
InternetGoOnlineA
SetUrlCacheConfigInfoA
InternetGoOnlineW
FreeUrlCacheSpaceW
InternetSetStatusCallbackA
InternetWriteFileExA
CreateMD5SSOHash
InternetGetCertByURLA
IsUrlCacheEntryExpiredA
FtpRemoveDirectoryW
InternetGetConnectedStateExA
InternetGetPerSiteCookieDecisionW
InternetConnectW
InternetUnlockRequestFile
InternetAutodialCallback
DeleteUrlCacheGroup
InternetQueryOptionA
GopherGetAttributeW
FtpCreateDirectoryA
InternetTimeFromSystemTimeW

gdi32

GdiPlayScript
GetDCPenColor
Escape
EnumICMProfilesA
EngFindResource
SetMetaRgn
GetArcDirection
GetCharABCWidthsI
RemoveFontResourceA
GdiGetLocalDC
PolyPatBlt
CreateFontW
EngCreateSemaphore
GdiSetLastError
EngGetPrinterDataFileName
STROBJ_bEnum
SetBitmapBits
GetFontResourceInfoW
SetDIBitsToDevice
GdiGetDC
GetOutlineTextMetricsA
GdiConsoleTextOut
EngMultiByteToWideChar
SetPixelV
PathToRegion
SelectObject
EngCreateClip
EngQueryEMFInfo

Sections

.text
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 252KB - Virtual size: 656KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2c9e0fed754acfd84b398ff5bb1b45eb

Headers

File Characteristics

Imports

kernel32

sqlunirl

security

msdtcprx

ntdll

wininet

gdi32

Sections

.text Size: 85KB - Virtual size: 85KB

.rdata Size: 66KB - Virtual size: 66KB

.data Size: 252KB - Virtual size: 656KB

.rsrc Size: 20KB - Virtual size: 19KB

.text
Size: 85KB - Virtual size: 85KB

.rdata
Size: 66KB - Virtual size: 66KB

.data
Size: 252KB - Virtual size: 656KB

.rsrc
Size: 20KB - Virtual size: 19KB