00123ccc7a94af85dd07fba2682e195f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

00123ccc7a94af85dd07fba2682e195f_JaffaCakes118
Size

436KB
MD5

00123ccc7a94af85dd07fba2682e195f
SHA1

9ecae460dc663e1664b4574aaeb0ea73eeb81f92
SHA256

a10f3aadaef34847c6fdadfaf7a6399e997812340fc8dc7496ed4f48f6d4a236
SHA512

95a1b41b3610fba6c3d73a0107aca2e9932f3b67f8334a720bebbd1ac17f5c05ec4ddeba00b68a10b9073e11f7505b9190ed44b8a636ee614638585c155f418c
SSDEEP

6144:cs7twLnPRVRsGLOCodaXVFOG0ZTAV7qIyCqnlv5aJVkAwjzkO:qPiHVUX7a8V7MHnlvIJV3wjzk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00123ccc7a94af85dd07fba2682e195f_JaffaCakes118

Files

00123ccc7a94af85dd07fba2682e195f_JaffaCakes118
.exe windows:6 windows x86 arch:x86

a03fc7b0f8e2a8ca568e7346f7930f1a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

unregmp2.pdb

Imports

advapi32

RegDeleteKeyW
RegCloseKey
RegDeleteValueW
RegEnumValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
CloseServiceHandle
ControlService
QueryServiceStatus
ChangeServiceConfigW
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
RegEnumKeyW
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyW

kernel32

GetLastError
WriteFile
SizeofResource
CreateFileW
LoadResource
FindResourceW
GetSystemWindowsDirectoryW
RegisterApplicationRestart
HeapSetInformation
Sleep
GetShortPathNameW
lstrcmpW
FindFirstFileExW
FindNextFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
lstrlenW
RemoveDirectoryW
ExpandEnvironmentStringsW
CloseHandle
CreateFileA
GetFileSize
GetWindowsDirectoryA
GetTempPathA
CreateDirectoryW
GetLocalTime
WritePrivateProfileStringW
GetPrivateProfileStringW
GetProfileStringW
WriteProfileStringW
GetTempPathW
MoveFileW
MoveFileExW
GetModuleFileNameW
CreateDirectoryA
GetSystemDefaultLangID
CopyFileW
GetFileTime
FileTimeToSystemTime
GetTimeZoneInformation
GetWindowsDirectoryW
GetVersionExA
GetVersionExW
GetFileAttributesA
LoadLibraryW
GetProcAddress
FreeLibrary
UnhandledExceptionFilter
SetLastError
DeleteFileW
LCIDToLocaleName
GetUserDefaultLCID
RaiseException
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
GetTickCount
FindFirstFileW
FindClose
CreateHardLinkW
SetFileAttributesW
GetSystemDirectoryW
GetFileAttributesW
SetFilePointer

user32

CharNextA
LoadStringW

msvcrt

_lock
__dllonexit
_unlock
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_initterm
_acmdln
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_onexit
_wtol
mbstowcs
wcsrchr
??_U@YAPAXI@Z
??_V@YAXPAX@Z
memset
wcschr
_wcslwr
wcsstr
_wcsicmp
_wcsnicmp
_vsnwprintf
free
_amsg_exit
_vsnprintf
swscanf
_wtoi
_itow
malloc
memcpy
_wcsupr
iswalnum
iswalpha
exit

ole32

StringFromGUID2
CoCreateGuid
CoUninitialize
CoCreateInstance
CoInitialize
PropVariantClear

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime
SysFreeString
SysAllocString
VariantClear

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

shell32

SHGetSpecialFolderPathW
SHSetLocalizedName
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetMalloc
ShellExecuteW
SHGetFolderPathW
SHChangeNotify
SHCreateItemFromParsingName
SHGetPathFromIDListA

shlwapi

PathRemoveFileSpecW
PathAppendW
PathIsDirectoryW
PathAddBackslashW
PathUnExpandEnvStringsW
PathAddBackslashA
PathRemoveBlanksW

slc

SLGetWindowsInformationDWORD

wmdrmsdk

WMDRMCreateProvider

Sections

.text
Size: 246KB - Virtual size: 246KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp0
Size: 164KB - Virtual size: 428KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a03fc7b0f8e2a8ca568e7346f7930f1a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

ole32

oleaut32

version

shell32

shlwapi

slc

wmdrmsdk

Sections

.text Size: 246KB - Virtual size: 246KB

.data Size: 5KB - Virtual size: 9KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 16KB - Virtual size: 15KB

.vmp0 Size: 164KB - Virtual size: 428KB

.text
Size: 246KB - Virtual size: 246KB

.data
Size: 5KB - Virtual size: 9KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 16KB - Virtual size: 15KB

.vmp0
Size: 164KB - Virtual size: 428KB