f65a326426fb583c728b32b5acad9af6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f65a326426fb583c728b32b5acad9af6_JaffaCakes118
Size

636KB
MD5

f65a326426fb583c728b32b5acad9af6
SHA1

43d1af89dbcb915c7ad36a1b113040f4e0b9bde0
SHA256

afa0939d913df268833055228a472e010079a1e276c87c846ccf364f84f82fd0
SHA512

e40aa8e26ee04c226eaeaa7a2262b06509b69bf23044726b803e2b45cd25a277d1969a9307faa0f6d486b231c7c99098cfc3ab42c3717a30205cb60e68e56a9e
SSDEEP

12288:gaPxCRLMdXxz6L7MjM/9utkYWHhIWy2Gl73anZrWyYVgvP4xmoBjvKPT7C:gOxtdBz6fMjM/9utkKWyDx3anZqyYVgG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f65a326426fb583c728b32b5acad9af6_JaffaCakes118

Files

f65a326426fb583c728b32b5acad9af6_JaffaCakes118
.exe .vbs windows:5 windows x86 arch:x86 polyglot

f582864a97d55f4c77dee599b05bb946

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

kernel32

SetUnhandledExceptionFilter
SetEnvironmentVariableA
GetSystemInfo
lstrlenA
FreeResource
LockResource
LoadResource
FindResourceA
LoadLibraryExA
GetTempPathA
GetCurrentProcess
GetDiskFreeSpaceExA
GetDiskFreeSpaceA
GetCompressedFileSizeA
GetComputerNameA
ReleaseSemaphore
SetEndOfFile
InterlockedDecrement
GetCurrentThread
GetExitCodeThread
CreateSemaphoreA
MoveFileA
InterlockedCompareExchange
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
CreateThread
GetStartupInfoA
HeapCreate
HeapDestroy
DosDateTimeToFileTime
LocalFileTimeToFileTime
GlobalAlloc
GlobalLock
GlobalHandle
GlobalUnlock
GlobalFree
SetThreadPriority
OpenFileMappingA
ExitProcess
DuplicateHandle
GetSystemDefaultLangID
GetModuleFileNameW
ReleaseMutex
CopyFileW
lstrlenW
GetTempFileNameW
GetVersionExW
ExpandEnvironmentStringsW
SearchPathW
lstrcpyW
lstrcpynW
GetDriveTypeW
GetLocalTime
OpenEventA
GetFileSizeEx
CreateRemoteThread
VirtualAllocEx
SetFileTime
CreateEventW
lstrcpyA
QueryDosDeviceA
DefineDosDeviceA
lstrcpynA
GetFullPathNameW
LoadLibraryW
FindFirstFileW
lstrcmpiW
FindNextFileW
MapViewOfFileEx
CreateProcessA
GetExitCodeProcess
FlushFileBuffers
CreateFileW
DeleteFileW
GetFileTime
HeapFree
GetProcessHeap
HeapAlloc
FlushViewOfFile
DelayLoadFailureHook
GetFullPathNameA
GetVolumeInformationA
lstrcmpA
GetWindowsDirectoryW
GetVolumeInformationW
SetErrorMode
CreateMutexA
CreateProcessW
TerminateThread
WaitForSingleObject
SetEvent
RemoveDirectoryA
EnterCriticalSection
LeaveCriticalSection
FileTimeToLocalFileTime
FileTimeToSystemTime
DeviceIoControl
GetFileAttributesExA
VirtualFree
SetCurrentDirectoryA
GetModuleFileNameA
GetEnvironmentVariableA
InitializeCriticalSection
Sleep
GetPrivateProfileStringA
VirtualAlloc
SetFilePointer
WriteFile
GetSystemDirectoryA
GetTempFileNameA
CopyFileA
OpenProcess
MoveFileExA
SetFileAttributesA
GetVersionExA
LocalAlloc
LocalFree
CreateFileA
GetFileSize
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
CloseHandle
GetThreadLocale
GetLocaleInfoA
GetDriveTypeA
FindFirstFileA
FindNextFileA
FindClose
GetFileInformationByHandle
FileTimeToDosDateTime
GetModuleHandleA
FormatMessageW
ReadFile
GetTickCount
WriteProcessMemory
CreateEventA
MultiByteToWideChar
WideCharToMultiByte
lstrcmpiA
ExpandEnvironmentStringsA
FormatMessageA
SetLastError
GetFileAttributesA
CreateDirectoryA
GetSystemDirectoryW
LoadLibraryA
GetLastError
GetProcAddress
GetWindowsDirectoryA
DeleteFileA
RaiseException
FreeLibrary
DeleteCriticalSection
RtlUnwind
InitializeCriticalSectionAndSpinCount
GetSystemTime
VirtualProtect
FlushInstructionCache

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetMalloc
SHGetSpecialFolderPathA

comctl32

PropertySheetW

user32

SetForegroundWindow
SystemParametersInfoA
GetDC
ReleaseDC
CheckDlgButton
IsDlgButtonChecked
LoadBitmapA
SetDlgItemTextW
PostMessageA
EnumChildWindows
GetWindowTextA
GetWindowLongA
SetWindowLongA
RedrawWindow
SetWindowTextA
PostThreadMessageA
GetMessageA
TranslateMessage
DispatchMessageA
GetDlgItem
EnableWindow
ShowWindow
SetDlgItemTextA
SendMessageA
DestroyWindow
PostQuitMessage
MessageBoxA
LoadStringW
LoadStringA
GetSystemMetrics
SetFocus
GetDesktopWindow
SetWindowTextW
MessageBoxW
DefWindowProcA
CreateWindowExA
RegisterClassA
wvsprintfW
EndDialog
DialogBoxParamA

ntdll

mbstowcs
sprintf
strrchr
_stricmp
strchr
_chkstk
strncpy
_snprintf
_strcmpi
_itoa
_snwprintf
wcscpy
swprintf
wcslen
_strnicmp
NtQuerySystemTime
memchr
_allmul
strstr
_strlwr
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
strtoul
_strupr
strncmp
_alldiv
memmove
vsprintf
strncat
wcscat
_vsnprintf
_memicmp
atoi
_aulldiv
RtlUnwind
NtClose
NtAdjustPrivilegesToken
NtOpenProcessToken
NtQuerySystemInformation
NtQueryInformationProcess
RtlCharToInteger
LdrAccessResource
LdrFindResource_U
NtShutdownSystem
RtlFreeHeap
RtlAllocateHeap
RtlRaiseStatus
NtYieldExecution
NtSetSystemInformation
NtCreateSection
NtOpenFile
NtOpenSection
NtOpenDirectoryObject
RtlCompareUnicodeString
NtCreateFile
RtlDosPathNameToNtPathName_U
LdrUnloadDll
NtFreeVirtualMemory
NtQueryInformationThread
NtWaitForSingleObject
RtlCreateUserThread
NtWriteVirtualMemory
NtAllocateVirtualMemory
NtOpenProcess
LdrGetProcedureAddress
LdrLoadDll
RtlDestroyHeap
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlGetAce
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
RtlAllocateAndInitializeSid
RtlCreateHeap
DbgPrint
RtlTimeToTimeFields

mpr

WNetGetUserA
WNetGetUniversalNameA

version

GetFileVersionInfoW
GetFileVersionInfoA
VerQueryValueW
VerQueryValueA
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA

psapi

GetModuleFileNameExA

ole32

CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

SysFreeString

winspool.drv

GetPrinterDriverDirectoryA

crypt32

CertSetCertificateContextProperty
CertOpenStore
CertCloseStore
CertFreeCertificateContext
CertCreateCertificateContext
CertAddCertificateContextToStore
CryptEncodeObject

msvcrt

calloc
getenv
_wcsdup
malloc
free
_errno
_open
wcscmp
_read
_write
_lseek
remove
_tempnam
rename
ctime
realloc
_vsnwprintf
strcspn
wcsrchr
isdigit
wcsncat
wcsncpy
_wcslwr
_controlfp
?terminate@@YAXXZ
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_cexit
_XcptFilter
_exit
_c_exit
_ltoa
_ultoa
wcschr
fprintf
fopen
_close
??2@YAPAXI@Z
fclose
_CxxThrowException
??0exception@@QAE@ABV0@@Z
??3@YAXPAX@Z
__CxxFrameHandler
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_itow
exit
wcstoul
_wcsicmp
_wtoi64
isspace
strpbrk
atol
strspn
_strdup
toupper

advapi32

RegCloseKey
InitializeSecurityDescriptor
AllocateAndInitializeSid
SetSecurityDescriptorOwner
CloseServiceHandle
ControlService
StartServiceA
OpenServiceA
OpenSCManagerA
RegDeleteValueA
RegOpenKeyA
GetServiceDisplayNameA
QueryServiceStatus
SetFileSecurityA
AddAccessAllowedAce
InitializeAcl
RegSetKeySecurity
FreeSid
EnumDependentServicesA
RegFlushKey
RegSaveKeyA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
AddAce
SetFileSecurityW
GetAclInformation
CopySid
GetLengthSid
AdjustTokenPrivileges
RegUnLoadKeyA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegLoadKeyA
OpenProcessToken
DeregisterEventSource
ReportEventA
RegisterEventSourceA
GetTokenInformation
SetNamedSecurityInfoA
GetNamedSecurityInfoA
UnlockServiceDatabase
ChangeServiceConfigA
QueryServiceConfigA
LockServiceDatabase
GetFileSecurityA
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
AbortSystemShutdownA
InitiateSystemShutdownA
OpenServiceW
SetSecurityDescriptorDacl
RegQueryValueExA

gdi32

StretchBlt
GetDIBits
CreateCompatibleDC
DeleteObject
CreateFontIndirectA
GetDeviceCaps
BitBlt
SelectObject

userenv

ord138
ord121

rpcrt4

UuidFromStringA

Sections

.text
Size: 517KB - Virtual size: 516KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f582864a97d55f4c77dee599b05bb946

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shell32

comctl32

user32

ntdll

mpr

version

psapi

ole32

oleaut32

winspool.drv

crypt32

msvcrt

advapi32

gdi32

userenv

rpcrt4

Sections

.text Size: 517KB - Virtual size: 516KB

.data Size: 8KB - Virtual size: 183KB

.rsrc Size: 89KB - Virtual size: 89KB

.edata Size: 20KB - Virtual size: 20KB

.text
Size: 517KB - Virtual size: 516KB

.data
Size: 8KB - Virtual size: 183KB

.rsrc
Size: 89KB - Virtual size: 89KB

.edata
Size: 20KB - Virtual size: 20KB