f9d5a9fc7dbeea307bb7df65f1cc21b1_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

f9d5a9fc7dbeea307bb7df65f1cc21b1_JaffaCakes118
Size

862KB
MD5

f9d5a9fc7dbeea307bb7df65f1cc21b1
SHA1

a3646e3a895323a09d4217d07b99c2febf21d295
SHA256

0db1869b4d3bd84c23a70707ee41719f12b838d2a1c3bbdc475fa8135c5d2519
SHA512

7c379a7311f18f8e0f74d65232de9456e8a8b1d6e73b7fab5ddabe939c192e30a5353553dd9f6b05f04726aa535008d42221e3ca3e0059f1889d250488cfbe25
SSDEEP

24576:zjDkK4995EpPnJOxGXje+kBjreKXhDXx:zD4FEpPlzeBBjPXhDX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9d5a9fc7dbeea307bb7df65f1cc21b1_JaffaCakes118

Files

f9d5a9fc7dbeea307bb7df65f1cc21b1_JaffaCakes118
.exe windows:5 windows x86 arch:x86

1d0f631b80ec7bb8dcd466179c40211a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CommConfigDialogW
FindResourceExW
DuplicateHandle
HeapWalk
lstrcat
WriteConsoleOutputAttribute
HeapFree
InterlockedPopEntrySList
SetConsoleCP
ExitVDM
InitializeCriticalSection
DebugActiveProcessStop
HeapReAlloc
FillConsoleOutputAttribute
ReleaseMutex
CreateDirectoryW
GetOEMCP
CopyFileExW
SetConsoleNumberOfCommandsA
SetMailslotInfo
HeapLock
SetStdHandle
QueryPerformanceCounter
EnumCalendarInfoExA
RegisterConsoleIME
GetWindowsDirectoryW
FindFirstVolumeA
VirtualAlloc
GetCurrentConsoleFont
GlobalUnlock
LoadLibraryA
ReadFileEx
ChangeTimerQueueTimer
AllocateUserPhysicalPages
GetProcAddress
SetThreadContext
GetSystemDefaultUILanguage
LoadLibraryExA
OutputDebugStringW

setupapi

pSetupAddTagToGroupOrderListEntry
CM_Disable_DevNode_Ex
SetupDiGetClassInstallParamsA
pSetupSetGlobalFlags
SetupFindNextMatchLineW
SetupDiOpenDevRegKey
SetupRemoveFileLogEntryW
CM_Free_Res_Des_Handle
SetupRemoveFromSourceListA
pSetupStringTableLookUpStringEx
CM_Get_Class_Key_NameW
SetupGetMultiSzFieldW
CM_Free_Res_Des
CM_Get_Device_Interface_List_SizeA
SetupDiSetDeviceInterfaceDefault
CM_Get_First_Log_Conf
SetupDiInstallClassExW
CM_Set_HW_Prof_Ex
SetupSetPlatformPathOverrideA
CM_Get_Next_Res_Des
SetupQueryFileLogW
CMP_WaitServicesAvailable
CM_Enumerate_Enumerators_ExA
CM_Get_DevNode_Custom_PropertyA
SetupRemoveFromDiskSpaceListA
pSetupStringTableInitializeEx
SetupGetLineByIndexA
SetupDiGetClassDevsExW
CM_Enumerate_EnumeratorsA
SetupDiEnumDeviceInfo
SetupGetFieldCount
pSetupUnicodeToMultiByte
SetupDiGetClassImageIndex
pSetupStringTableAddStringEx
CMP_Init_Detection
CM_Set_DevNode_Registry_PropertyA
CM_Test_Range_Available
CM_Get_DevNode_Status_Ex
SetupDiDeleteDeviceInfo
SetupCloseLog
SetupDiGetDeviceInfoListClass
SetupQueryInfFileInformationW
SetupGetFileQueueFlags
CM_Get_First_Log_Conf_Ex

msvcirt

?setp@streambuf@@IAEXPAD0@Z
??0ofstream@@QAE@HPADH@Z
?close@fstream@@QAEXXZ
??5istream@@QAEAAV0@AAE@Z
??_8iostream@@7Bistream@@@
??_7ofstream@@6B@
?close@filebuf@@QAEPAV1@XZ
??_Dofstream@@QAEXXZ
??6ostream@@QAEAAV0@PBD@Z
?close@ifstream@@QAEXXZ
??4iostream@@IAEAAV0@PAVstreambuf@@@Z
??5istream@@QAEAAV0@AAI@Z
?sh_write@filebuf@@2HB
?setf@ios@@QAEJJJ@Z
?base@streambuf@@IBEPADXZ
??0fstream@@QAE@ABV0@@Z
??_Glogic_error@@UAEPAXI@Z
??0Iostream_init@@QAE@AAVios@@H@Z
?sh_none@filebuf@@2HB
?open@ifstream@@QAEXPBDHH@Z
?rdbuf@ios@@QBEPAVstreambuf@@XZ
?setlock@streambuf@@QAEXXZ
?rdbuf@ofstream@@QBEPAVfilebuf@@XZ
??0ifstream@@QAE@HPADH@Z
??_Estreambuf@@UAEPAXI@Z
??_7exception@@6B@
??0ostream@@IAE@XZ
?x_maxbit@ios@@0JA
?is_open@filebuf@@QBEHXZ

netapi32

NetServiceControl
DsGetDcOpenW
NetReplExportDirSetInfo
NetpNetBiosReset
I_NetServerAuthenticate
I_NetGetForestTrustInformation
DsRoleDnsNameToFlatName
NetScheduleJobDel
DsMergeForestTrustInformationW
NetLogonGetTimeServiceParentDomain
NetMessageNameDel
DsValidateSubnetNameA
I_NetServerPasswordSet
DsGetDcCloseW
NetDfsAdd
NetErrorLogRead
NetUserGetGroups
NetDfsRemove
RxNetAccessAdd
DsGetDcNextA
NetErrorLogClear
NetMessageNameEnum
NetGroupDelUser
NetSetPrimaryComputerName
DsGetForestTrustInformationW
I_NetlogonComputeServerDigest
NetGetJoinableOUs
I_BrowserDebugTrace
NetLocalGroupAddMembers
NetWkstaTransportAdd
NetLocalGroupDelMember
NetpDbgPrint
DsRoleDcAsDc
NetUserDel
NetDfsAddStdRootForced
NetDfsGetInfo
NetDfsAddStdRoot

dnsapi

DnsModifyRecordsInSet_A
DnsNameCompareEx_UTF8
DnsNameCompare_W
DnsCreateReverseNameStringForIpAddress
QueryDirectEx
DnsGetBufferLengthForStringCopy
DnsFlushResolverCacheEntry_W
DnsGetLastFailedUpdateInfo
DnsQuery_W
DnsQuery_A
Dns_InitializeWinsock
DnsApiFree
DnsRecordSetCompare
DnsAsyncRegisterInit
Dns_ReadRecordStructureFromPacket
DnsModifyRecordsInSet_UTF8
DnsExtractRecordsFromMessage_UTF8
NetInfo_Free
DnsFree
NetInfo_ResetServerPriorities
DnsApiHeapReset
DnsRecordBuild_W
DnsExtractRecordsFromMessage_W
BreakRecordsIntoBlob
DnsNotifyResolverEx
DnsGetCacheDataTable
DnsQueryConfigAllocEx
DnsRecordSetCopyEx
DnsStatusString
DnsNameCompare_UTF8
DnsDhcpSrvRegisterHostName
DnsUpdateTest_A
NetInfo_IsForUpdate
Dns_SendEx
Dns_UpdateLib
DnsAcquireContextHandle_A
NetInfo_Build
Dns_SkipToRecord
Dns_CloseConnection
CombineRecordsInBlob

advapi32

OpenTraceA
FreeSid
BuildSecurityDescriptorW
ObjectDeleteAuditAlarmW
ElfDeregisterEventSource
FlushTraceW
WmiReceiveNotificationsW
CreateProcessWithLogonW
TraceMessageVa
ReadEventLogW
DuplicateTokenEx
RegDeleteKeyW
WmiQueryAllDataMultipleA
GetUserNameW
CryptCreateHash
AbortSystemShutdownW
SaferRecordEventLogEntry
SetInformationCodeAuthzPolicyW
ElfRegisterEventSourceA
LsaStorePrivateData
LsaSetInformationTrustedDomain
GetSidIdentifierAuthority
LsaOpenTrustedDomain
LsaQueryInformationPolicy
BuildSecurityDescriptorA
RegisterTraceGuidsA
ChangeServiceConfig2A
GetCurrentHwProfileW
SetNamedSecurityInfoExA
SaferSetPolicyInformation
DeregisterEventSource
BuildTrusteeWithSidW
CryptEnumProvidersA
MSChapSrvChangePassword2
OpenSCManagerA
LsaAddPrivilegesToAccount

iasads

DllGetClassObject

Sections

.text
Size: 374KB - Virtual size: 374KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 353KB - Virtual size: 353KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 132KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1d0f631b80ec7bb8dcd466179c40211a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

setupapi

msvcirt

netapi32

dnsapi

advapi32

iasads

Sections

.text Size: 374KB - Virtual size: 374KB

.rdata Size: 353KB - Virtual size: 353KB

.data Size: 132KB - Virtual size: 1.5MB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 374KB - Virtual size: 374KB

.rdata
Size: 353KB - Virtual size: 353KB

.data
Size: 132KB - Virtual size: 1.5MB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 1024B - Virtual size: 1024B