02b9c8710f22dde76090a46be8527833_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

02b9c8710f22dde76090a46be8527833_JaffaCakes118
Size

376KB
MD5

02b9c8710f22dde76090a46be8527833
SHA1

96c0b258a2d2db4f0c3f410edde41df55b70aa9d
SHA256

fa34ee34e1af9361b2f20a072214d8d14891eacf584cd5b274c730e084c7bddb
SHA512

0f6e9c301c6b8e7f42a13f1d07afc72dff974689fa182aa421f395222df47aa25fe7a059bdb71c52d199421c502d23c35f0b67cfc0ac8511575f9905f3eb8be6
SSDEEP

6144:FM6TZq2vuAebpeo5u00SZ1aa956wtwOVMqtZqFH//87siEkKTVJuSPFu2ixuRV93:q6THuAe8oM6ZUajrVMqih2siExTVYSN1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
02b9c8710f22dde76090a46be8527833_JaffaCakes118

Files

02b9c8710f22dde76090a46be8527833_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cc9e028f0d00e6ef1f290b77a5f8b068

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

P:\p\agents\hpam1.eem\recipes\146488331\base\branches\ci_release_branch\googleclient\ci\build\ship\obj\service\GoogleUpdaterService_not_signed_exe.pdb

Imports

kernel32

RtlUnwind
HeapCreate
VirtualFree
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetOEMCP
IsValidCodePage
TlsFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
SystemTimeToTzSpecificLocalTime
lstrcmpW
DuplicateHandle
GetProcAddress
LoadLibraryW
GetCurrentThread
MultiByteToWideChar
GetTempPathW
WaitForSingleObject
SetLastError
OpenProcess
CloseHandle
InitializeCriticalSection
lstrcpynW
lstrlenW
CreateThread
lstrcmpiW
FindResourceExW
CreateEventW
LoadResource
FindResourceW
LoadLibraryExW
LockResource
InterlockedIncrement
SizeofResource
SetEvent
GetLastError
InterlockedDecrement
GetCurrentThreadId
LoadLibraryA
GetModuleHandleA
VirtualAlloc
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLocaleInfoA
GetACP
GetModuleHandleW
DeleteCriticalSection
RaiseException
GetModuleFileNameW
FreeLibrary
GetCommandLineW
GetCurrentProcessId
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
InterlockedExchange
GlobalFree
TerminateProcess
Sleep
GetTempFileNameW
IsDebuggerPresent
QueryPerformanceFrequency
QueryPerformanceCounter
ResetEvent
TlsAlloc
TlsGetValue
TlsSetValue
FlushFileBuffers
SetFilePointer
ReadFile
WriteFile
GetFileSize
GetSystemTimeAsFileTime
FindClose
FileTimeToSystemTime
CreateFileW
GetFileAttributesExW
FindFirstFileW
FindNextFileW
GetFileAttributesW
SetFileAttributesW
DeleteFileW
CopyFileW
MoveFileExW
GetTickCount
GetCurrentProcess
CreateProcessW
CreateMutexW
ReleaseMutex
EnterCriticalSection
LeaveCriticalSection
InterlockedCompareExchange
RemoveDirectoryW
GetExitCodeProcess
FileTimeToLocalFileTime
GetVersionExW
GetNativeSystemInfo
WideCharToMultiByte
lstrlenA
GetDateFormatW
GetTimeFormatW
GetThreadLocale
ExitProcess

user32

UnregisterClassA
CharLowerW
LoadStringW
DispatchMessageW
TranslateMessage
GetMessageW
PostThreadMessageW
KillTimer
wvsprintfW
SetTimer
CharNextW

ole32

CoImpersonateClient
CoCreateGuid
CoRevertToSelf
StringFromGUID2
CoTaskMemRealloc
CoUninitialize
CoRegisterClassObject
CoInitializeSecurity
CoInitialize
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance

oleaut32

SysFreeString
RegisterTypeLi
UnRegisterTypeLi
VarUI4FromStr
SysAllocString
LoadTypeLi
SysStringLen

advapi32

ReportEventW
CopySid
RegOpenKeyExW
GetSecurityDescriptorControl
CloseServiceHandle
GetSecurityDescriptorLength
GetSidSubAuthority
RegDeleteValueW
RegCloseKey
FreeSid
AllocateAndInitializeSid
CheckTokenMembership
OpenThreadToken
SetSecurityDescriptorDacl
ControlService
GetSecurityDescriptorDacl
StartServiceW
SetSecurityDescriptorGroup
QueryServiceStatus
GetSecurityDescriptorGroup
RegSetValueExW
SetSecurityDescriptorOwner
ChangeServiceConfigW
RegCreateKeyExW
GetSecurityDescriptorOwner
OpenServiceW
DeleteService
OpenSCManagerW
ChangeServiceConfig2W
CreateServiceW
IsValidSid
RegQueryInfoKeyW
GetLengthSid
SetServiceStatus
DeregisterEventSource
MakeSelfRelativeSD
RegisterEventSourceW
RegisterServiceCtrlHandlerW
RegEnumKeyExW
GetAclInformation
AddAce
StartServiceCtrlDispatcherW
InitializeAcl
InitializeSecurityDescriptor
MakeAbsoluteSD
RegQueryValueExW
GetSecurityDescriptorSacl
GetSidLengthRequired
RegDeleteKeyW
InitializeSid
SetSecurityDescriptorControl

shlwapi

StrRetToStrW
SHQueryValueExW
PathStripPathW

crypt32

CertDuplicateCertificateContext
CertFreeCertificateContext
CertNameToStrW
CryptQueryObject
CertEnumCertificatesInStore
CertCloseStore

shell32

SHGetDesktopFolder
SHCreateDirectoryExW
SHGetFolderLocation
SHFileOperationW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wintrust

WinVerifyTrust

Sections

.text
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 192KB - Virtual size: 1.3MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cc9e028f0d00e6ef1f290b77a5f8b068

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

ole32

oleaut32

advapi32

shlwapi

crypt32

shell32

version

wintrust

Sections

.text Size: 125KB - Virtual size: 124KB

.rdata Size: 29KB - Virtual size: 29KB

.data Size: 7KB - Virtual size: 15KB

.rsrc Size: 21KB - Virtual size: 21KB

.vmp0 Size: 192KB - Virtual size: 1.3MB

.text
Size: 125KB - Virtual size: 124KB

.rdata
Size: 29KB - Virtual size: 29KB

.data
Size: 7KB - Virtual size: 15KB

.rsrc
Size: 21KB - Virtual size: 21KB

.vmp0
Size: 192KB - Virtual size: 1.3MB