f9ad450f5794831aa8dcb30ccdee4316_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f9ad450f5794831aa8dcb30ccdee4316_JaffaCakes118
Size

291KB
MD5

f9ad450f5794831aa8dcb30ccdee4316
SHA1

65af11a517db6d3a657991046b772e42edaf1aaf
SHA256

cbe7c45e24bf226214c40a7e956472816411d7131ff35824a1cff62d89636cb4
SHA512

fd68f24ee4e3ed84a37c02123e0c848f7c81300ebdfe7a79e88c09a7eb236c5c2fde14b885a0be55e6742368f9743af45e3ec0b075f771a1a8f1b4f85d5d9521
SSDEEP

6144:VT2tCvARTjpLONv5H34uouz9wYvyzjBpOLs1p5J4Ig/+S:V6tCvA51LOV2uP9wiyzP3M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9ad450f5794831aa8dcb30ccdee4316_JaffaCakes118

Files

f9ad450f5794831aa8dcb30ccdee4316_JaffaCakes118
.exe windows:1 windows x86 arch:x86

304951e84c78846f1e038cfe9746d62c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advpack

RegInstall
IsNTAdmin
UserUnInstStubWrapper
AdvInstallFile
GetVersionFromFileEx
FileSaveMarkNotExist
RegSaveRestore
RunSetupCommand
NeedRebootInit
ExtractFiles
CloseINFEngine
NeedReboot
AddDelBackupEntry
RegRestoreAll
LaunchINFSectionEx
FileSaveRestoreOnINF
SetPerUserSecValues
ExecuteCab
DoInfInstall
OpenINFEngine
FileSaveRestore
LaunchINFSection
DelNodeRunDLL32
TranslateInfStringEx
RegSaveRestoreOnINF
RegisterOCX
RebootCheckOnInstall
GetVersionFromFile
DelNode
UserInstStubWrapper
TranslateInfString

kernel32

GetFileAttributesA
GetSystemTimes
DosDateTimeToFileTime
DeleteFileA
GetNamedPipeHandleStateA
SystemTimeToFileTime
HeapAlloc
WaitNamedPipeA
GetModuleHandleA
GetStringTypeExA
GetFileAttributesExA
InterlockedPopEntrySList
SetNamedPipeHandleState
PeekNamedPipe
TransactNamedPipe
GetProcessHeap
lstrcatA
InterlockedExchange
ReadFileScatter
SetFilePointerEx
CompareStringA
GetNamedPipeInfo
FileTimeToDosDateTime
lstrcmpiA
GetSystemTime
FreeEnvironmentStringsA
FileTimeToSystemTime
VirtualAlloc
lstrcmpA
CloseHandle
GetSystemTimeAsFileTime
GetEnvironmentVariableA
IsBadStringPtrA
GetLocalTime
DisconnectNamedPipe
ExpandEnvironmentStringsA
WriteFileEx
InterlockedDecrement
InterlockedCompareExchange
InterlockedFlushSList
lstrcpynA
FileTimeToLocalFileTime
ReadFileEx
ConnectNamedPipe
GetFirmwareEnvironmentVariableA
InterlockedExchangeAdd
WriteFileGather
InterlockedIncrement
lstrlenA
WriteFile
CreateFileA
ReadFile
CallNamedPipeA
SetEnvironmentVariableA
InterlockedPushEntrySList
SetFirmwareEnvironmentVariableA
GetFileTime
GetSystemTimeAdjustment
SetFilePointer
GetProcessHeaps
GetStringTypeA
VirtualFree
lstrcpyA
GetEnvironmentStringsA
HeapSize

user32

MapWindowPoints
ShowWindow
GetClipboardData
EndPaint
SendMessageA
RegisterClassExA
WinHelpA
MessageBoxA
IsClipboardFormatAvailable
GetSysColorBrush
GetDesktopWindow
IsChild
SetWindowTextA
LoadStringA
GetClientRect
IsDialogMessageA
CreateWindowExA
InvalidateRect
UpdateWindow
GetMessageA
CheckMenuRadioItem
DestroyMenu
PostQuitMessage
GetDlgCtrlID
HideCaret
LoadAcceleratorsA
DialogBoxParamA
SystemParametersInfoA
EndDialog
SetDlgItemInt
DestroyWindow
SetWindowLongA
GetSubMenu
OpenClipboard
GetProcessDefaultLayout
TranslateMessage
EnableMenuItem
SetCursor
SetWindowPos
CloseClipboard
SetFocus
CheckRadioButton
DispatchMessageA
ScreenToClient
TranslateAcceleratorA
SetDlgItemTextA
GetWindowLongA
CharNextA
LoadMenuA
LoadCursorA
OffsetRect
CreateDialogParamA
EnableWindow
CheckDlgButton
SetProcessDefaultLayout
GetSysColor
LoadIconA
DrawTextA
GetWindowTextA
CallWindowProcA
MessageBeep
ChildWindowFromPoint
BeginPaint
GetDlgItem
SetMenu
GetMenu
GetWindowRect
DefWindowProcA
CheckMenuItem
TrackPopupMenuEx

cryptui

CryptUIDlgViewCertificateA
CryptUIWizFreeDigitalSignContext
CryptUIDlgViewCRLA
CryptUIDlgCertMgr
LocalEnroll
CryptUIDlgViewCertificatePropertiesA
CryptUIWizCreateCertRequestNoDS
DllRegisterServer
CryptUIFreeViewSignaturesPagesA
CryptUIWizImport
I_CryptUIProtect
CryptUIDlgFreeCAContext
CryptUIGetViewSignaturesPagesA
CryptUIDlgViewCTLA
ACUIProviderInvokeUI
CryptUIStartCertMgr
EnrollmentCOMObjectFactory_getInstance
CryptUIWizCertRequest
CryptUIWizFreeCertRequestNoDS
CryptUIWizExport
CryptUIDlgSelectStoreA
CryptUIFreeCertificatePropertiesPagesA
CryptUIWizSubmitCertRequestNoDS
LocalEnrollNoDS
CryptUIWizBuildCTL
DllUnregisterServer
CryptUIWizDigitalSign
CryptUIWizQueryCertRequestNoDS
CryptUIDlgViewContext
RetrievePKCS7FromCA
CryptUIDlgSelectCertificateA
WizardFree
I_CryptUIProtectFailure
CryptUIGetCertificatePropertiesPagesA
CryptUIDlgSelectCA
CryptUIDlgSelectCertificateFromStore
CryptUIDlgViewSignerInfoA

Sections

.text
Size: 271KB - Virtual size: 271KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 700KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

304951e84c78846f1e038cfe9746d62c

Headers

DLL Characteristics

File Characteristics

Imports

advpack

kernel32

user32

cryptui

Sections

.text Size: 271KB - Virtual size: 271KB

.data Size: 14KB - Virtual size: 13KB

.rsrc Size: 4KB - Virtual size: 700KB

.text
Size: 271KB - Virtual size: 271KB

.data
Size: 14KB - Virtual size: 13KB

.rsrc
Size: 4KB - Virtual size: 700KB