01cfe0f2dfcbe098ec926e2a528163db_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

01cfe0f2dfcbe098ec926e2a528163db_JaffaCakes118
Size

193KB
MD5

01cfe0f2dfcbe098ec926e2a528163db
SHA1

be931d5491689f3b7f82903a64b649358fce8c94
SHA256

19aee02afa89be1bce5b23c1a1b6b8a20fc77d3e54732ffb67cadd2aea473be9
SHA512

67f39a12fbe0f06e61154dc1fedb896234304b00722ec5d104af07c337d17ba492c24d72227c0d3fb860bba05521a62eeceb845a512d45118c4639ca3aa6ea65
SSDEEP

3072:DZp30Lo6KHju+odDYgut2tYJBp7NUTkj5t7vYo4A8YQe:tt16wyDFsjBp7NU4lt7Qo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01cfe0f2dfcbe098ec926e2a528163db_JaffaCakes118

Files

01cfe0f2dfcbe098ec926e2a528163db_JaffaCakes118
.exe windows:5 windows x86 arch:x86

2a0bbb7db482bb8090de05a2adf66ea5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

__setusermatherr
wcstok
wcscat
wcschr
_except_handler3
_snwprintf
_wcsicmp
wcsncat
atoi
memmove
swprintf
_snprintf
wcsstr
wcspbrk
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__p__commode
_adjust_fdiv
wcsncmp
wcscpy
wcslen
_controlfp
__p__fmode
__set_app_type
wcscmp

advapi32

RegQueryInfoKeyW
AddAccessAllowedAce
RegEnumValueW
SetSecurityDescriptorDacl
EnumServicesStatusW
AllocateLocallyUniqueId
RegNotifyChangeKeyValue
QueryServiceConfigW
SetKernelObjectSecurity
RegEnumKeyExW
RegQueryInfoKeyA
AdjustTokenPrivileges
SynchronizeWindows31FilesAndWindowsNTRegistry
QueryWindows31FilesMigration
OpenProcessToken
LogonUserW
OpenThreadToken
LookupAccountSidW
CheckTokenMembership
RegCreateKeyExW
LsaGetUserName
CreateProcessAsUserW
RegQueryValueExA
RegDeleteValueW
FreeSid
InitializeSecurityDescriptor
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
CloseServiceHandle
ControlService
StartServiceW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
DeregisterEventSource
ReportEventW
GetTokenInformation
RegisterEventSourceW
GetUserNameW
RevertToSelf
ImpersonateLoggedOnUser
DuplicateToken
RegOpenKeyW

kernel32

SetTimerQueueTimer
FindFirstFileW
PostQueuedCompletionStatus
Beep
CloseProfileUserMapping
ExitProcess
DelayLoadFailureHook
OpenProfileUserMapping
GetDriveTypeW
GetStartupInfoA
GetModuleHandleA
GlobalGetAtomNameW
SetNamedPipeHandleState
TransactNamedPipe
AssignProcessToJobObject
CreateJobObjectW
CreateIoCompletionPort
SetInformationJobObject
GetQueuedCompletionStatus
VirtualQuery
TerminateJobObject
FindClose
VirtualFree
InitializeCriticalSection
CreateFileA
LocalFree
LocalAlloc
lstrcatW
lstrcpyW
GetCurrentThreadId
Sleep
FormatMessageW
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemTimeAsFileTime
ReleaseMutex
SetWaitableTimer
WaitForSingleObject
CloseHandle
UnregisterWaitEx
RegisterWaitForSingleObject
CreateWaitableTimerW
GetCurrentProcessId
CreateEventW
LoadLibraryW
CreateMutexW
GlobalFree
GlobalAlloc
lstrlenW
GetTimeFormatW
GetUserDefaultLCID
FileTimeToSystemTime
FileTimeToLocalFileTime
GetProfileIntW
lstrcmpiW
lstrcpynW
GetShortPathNameW
GetProfileStringW
GetModuleHandleW
ReleaseSemaphore
CreateSemaphoreW
GetCurrentThread
WaitForSingleObjectEx
CreateThread
SetEvent
LoadResource
FindResourceW
SetThreadExecutionState
GetComputerNameW
SetEnvironmentVariableW
VirtualLock
GetCurrentProcess
SetPriorityClass
SearchPathW
GetTickCount
LocalReAlloc
ExpandEnvironmentStringsW
TerminateThread
ResumeThread
SetLastError
GetExitCodeProcess
WriteProfileStringW
ExitThread
DeleteFileW
TerminateProcess
CreateProcessW
GetSystemDirectoryW
ReadFile
CreateFileW
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
SetThreadPriority
OpenEventW
MoveFileExW
WaitForMultipleObjectsEx
SleepEx
InterlockedExchange
RaiseException
lstrcmpW
LeaveCriticalSection
EnterCriticalSection
CompareStringW
UnregisterWait
GetPrivateProfileStringW
DebugBreak
CreateRemoteThread
OpenProcess
SetErrorMode
SetUnhandledExceptionFilter
LocalSize
VirtualAlloc
VirtualQueryEx
GetEnvironmentVariableW

gdi32

RemoveFontResourceW
AddFontResourceW

user32

ExitWindowsEx
SetProcessWindowStation
PostMessageW
MoveWindow
ShowWindow
UpdateWindow
GetDlgItemTextW
CharNextW
CreateWindowExW
RegisterClassW
SetTimer
GetMessageTime
KillTimer
DefWindowProcW
RegisterHotKey
UnregisterHotKey
ReplyMessage
CreateDesktopW
SetUserObjectSecurity
DispatchMessageW
GetMessageW
GetAsyncKeyState
SetUserObjectInformationW
PostThreadMessageW
SetWindowPlacement
DeleteMenu
GetSystemMenu
GetWindowPlacement
EnumWindows
GetWindowTextW
SetWindowsHookW
UnhookWindowsHook
CallNextHookEx
MessageBoxW
CreateWindowStationW
SetDlgItemTextW
SetCursor
LoadCursorW
SetFocus
CheckDlgButton
IsDlgButtonChecked
CloseWindowStation
CreateDialogParamW
OpenDesktopW
SwitchDesktop
SetForegroundWindow
GetParent
GetKeyState
LoadImageW
SetLastErrorEx
wvsprintfW
TranslateMessage
RegisterWindowMessageW
MsgWaitForMultipleObjects
PostQuitMessage
SendNotifyMessageW
FindWindowW
DestroyWindow
SystemParametersInfoW
SendMessageTimeoutW
GetThreadDesktop
OpenInputDesktop
SetThreadDesktop
GetDesktopWindow
FindWindowExW
DialogBoxParamW
CloseDesktop
GetWindowLongW
UpdatePerUserSystemParameters
SetWindowStationUser
LockWindowStation
UnlockWindowStation
SetLogonNotifyWindow
LoadLocalFonts
RegisterLogonProcess
MBToWCSEx
EnableWindow
GetWindowRect
GetSystemMetrics
SetWindowPos
EndDialog
wsprintfW
SetWindowLongW
SendMessageW
GetUserObjectInformationW
SetWindowTextW
LoadStringW
GetDlgItem
PeekMessageW
DialogBoxIndirectParamW
SendDlgItemMessageW

rpcrt4

RpcImpersonateClient
RpcServerListen
RpcServerUseProtseqEpW
RpcServerRegisterIf
I_RpcMapWin32Status
NdrServerCall2
RpcRevertToSelf

ntdll

NtCreateEvent
RtlCreateSecurityDescriptor
RtlAddAce
RtlCreateAcl
RtlGetDaclSecurityDescriptor
RtlCopySid
RtlLengthSid
NtSetInformationThread
NtDuplicateToken
NtDuplicateObject
RtlEqualSid
NtQueryInformationToken
RtlNtStatusToDosError
NtAllocateLocallyUniqueId
RtlSetDaclSecurityDescriptor
RtlFreeHeap
NtCreatePagingFile
RtlDosPathNameToNtPathName_U
NtQuerySystemInformation
RtlRegisterWait
NtOpenDirectoryObject
NtPrivilegeObjectAuditAlarm
NtOpenProcessToken
NtQuerySystemTime
RtlTimeToSecondsSince1980
NtPrivilegeCheck
NtOpenThreadToken
DbgPrint
NtSetInformationProcess
RtlSubAuthoritySid
NtInitiatePowerAction
NtQueryInformationJobObject
NtFilterToken
NtOpenEvent
NtSetValueKey
RtlOemStringToUnicodeString
RtlInitAnsiString
NtReadFile
NtClose
RtlGetAce
RtlAddAccessAllowedAce
RtlFreeSid
NtCreateKey
NtOpenKey
RtlAppendUnicodeToString
RtlCopyUnicodeString
RtlDestroyHeap
RtlCreateHeap
NtQueryValueKey
RtlUpcaseUnicodeChar
RtlAppendUnicodeStringToString
RtlExpandEnvironmentStrings_U
NtQueryInformationFile
RtlQueryInformationAcl
NtQuerySecurityObject
RtlCompareUnicodeString
RtlLengthRequiredSid
RtlInitializeSid
NtOpenSymbolicLinkObject
NtSetSystemPowerState
NtRaiseHardError
NtSetSecurityObject
NtQuerySymbolicLinkObject
NtQueryVolumeInformationFile
NtFsControlFile
RtlAdjustPrivilege
NtOpenFile
NtQueryInformationProcess
DbgBreakPoint
RtlAllocateHeap
RtlAllocateAndInitializeSid
RtlDestroyEnvironment
NtShutdownSystem
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlCreateEnvironment
RtlSetEnvironmentVariable
NtCreatePort
RtlInitializeCriticalSection
RtlInitUnicodeString
RtlQueryEnvironmentVariable_U
NtAcceptConnectPort
RtlOpenCurrentUser
NtReplyPort
NtCompleteConnectPort
NtReplyWaitReceivePort

userenv

ord118
GetDefaultUserProfileDirectoryW
ord131
ord117
GetAllUsersProfileDirectoryW
DestroyEnvironmentBlock
UnloadUserProfile
CreateEnvironmentBlock
ord130
GetUserProfileDirectoryW
LoadUserProfileW
UnregisterGPNotification
RegisterGPNotification

nddeapi

ord611
ord612
ord613
ord603

sfc

ord1
ord2

secur32

GetUserNameExW

profmap

InitializeProfileMappingApi
RemapAndMoveUserW

Sections

.text
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2a0bbb7db482bb8090de05a2adf66ea5

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

gdi32

user32

rpcrt4

ntdll

userenv

nddeapi

sfc

secur32

profmap

Sections

.text Size: 127KB - Virtual size: 127KB

.data Size: 8KB - Virtual size: 8KB

.rsrc Size: 56KB - Virtual size: 60KB

.text
Size: 127KB - Virtual size: 127KB

.data
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 56KB - Virtual size: 60KB