07cda0f551b7dbf36d1f6be7c09f8f20_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

07cda0f551b7dbf36d1f6be7c09f8f20_JaffaCakes118
Size

133KB
MD5

07cda0f551b7dbf36d1f6be7c09f8f20
SHA1

7695538c6da7c7631d36728fd8a3e1a26a6240e6
SHA256

243d941a2dfb8189ae8c1e0ff6ae1bb7e5728fc3c468113ad21ffd14dd742dfd
SHA512

322424ab99094dda8cd7ae68bb40e7f1bbe29a786ced1cbeb3b34b629ec6c595ec31edded1f5d340298fb8d48deab05e39b9a3b27dd98923c20005dc45a3b557
SSDEEP

3072:HoTX7HeZygZtmRbzK9WEgmQa0Gy0pdwFvhRZewvW2jR3l4iTdWPqN:HmqZFIuWEgmh0j0/8ewvRjRV4iTdL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
07cda0f551b7dbf36d1f6be7c09f8f20_JaffaCakes118

Files

07cda0f551b7dbf36d1f6be7c09f8f20_JaffaCakes118
.exe windows:5 windows x86 arch:x86

0d94a0dc05bac17e34622227e3732f67

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

inetcomm

HrGetAttachIcon
CreateIMAPTransport
CreatePOP3Transport
EssMLHistoryEncodeEx
MimeOleFindCharset
MimeOleSetPropW
MimeOleGetRelatedSection
CreateRASTransport
MimeOleGetPropertySchema
MimeOleEncodeHeader
MimeOleCreateSecurity
EssKeyExchPreferenceDecodeEx
MimeOleDecodeHeader
CreateIMAPTransport2
HrGetDisplayNameWithSizeForFile
MimeOleGenerateCID
MimeOleCreateMessageParts
MimeEditViewSource
MimeOleGetPropA
MimeOleGetDefaultCharset
MimeOleConvertEnrichedToHTML
EssContentHintDecodeEx
EssSecurityLabelDecodeEx
HrGetLastOpenFileDirectoryW
EssMLHistoryDecodeEx
MimeEditCreateMimeDocument

kernel32

UTRegister
GetConsoleAliasesLengthW
SetFileApisToANSI
LCMapStringW
GetCurrentThread
CreateMutexA
IsBadStringPtrW
GetVolumePathNamesForVolumeNameW
LoadLibraryW
SetLocaleInfoW
GetModuleHandleW
ZombifyActCtx
FindVolumeClose
GetCompressedFileSizeA
GetLocaleInfoW
VerLanguageNameA
GetModuleFileNameW
FlushFileBuffers
SetCommTimeouts
GetConsoleScreenBufferInfo
FindNextVolumeA

crypt32

CertAddEncodedCertificateToSystemStoreA
CertEnumCertificateContextProperties
CertDuplicateCTLContext
CryptHashMessage
CertIsRDNAttrsInCertificateName
CertFreeCTLContext
I_CryptSetTls
CertFindCRLInStore
CertNameToStrA
CryptSIPRetrieveSubjectGuidForCatalogFile
CryptFindLocalizedName
CryptMsgVerifyCountersignatureEncodedEx
RegCreateKeyExU
CertDuplicateCertificateChain
CertAddCRLLinkToStore
CertAddEnhancedKeyUsageIdentifier
CryptVerifyDetachedMessageHash
CertAddSerializedElementToStore
CertCreateContext
I_CryptInsertLruEntry

odbctrac

TraceSQLSetParam
TraceSQLSetDescFieldW
TraceOpenLogFile
FireVSDebugEvent
TraceSQLGetInfo
TraceSQLDrivers
TraceSQLEndTran
TraceSQLConnect
TraceSQLDescribeCol
TraceSQLProcedures
TraceSQLPrepareW
TraceSQLGetTypeInfo
TraceSQLColAttributesW
TraceSQLSetEnvAttr
TraceCloseLogFile

mfcsubs

??1CObject@@UAE@XZ
?GetHashTableSize@CMapStringToPtr@@QBEIXZ
??YCString@@QAEABV0@PBG@Z
?LookupKey@CMapStringToPtr@@QBEHPBGAAPBG@Z
?RemoveAll@CStringArray@@QAEXXZ
??N@YG_NPBGABVCString@@@Z
?LoadStringW@CString@@QAEHI@Z
?FreeExtra@CStringArray@@QAEXXZ
?ConcatCopy@CString@@IAEXHPBGH0@Z
?Add@CStringArray@@QAEHPBG@Z
??1CMapStringToPtr@@UAE@XZ
??0CString@@QAE@PBG@Z
?GetData@CStringArray@@QAEPAVCString@@XZ
?AfxW2AHelper@@YGPADPADPBGH@Z
??0CMapStringToPtr@@QAE@H@Z
?Empty@CString@@QAEXXZ
?ReleaseBuffer@CString@@QAEXH@Z
?GetSize@CStringArray@@QBEHXZ
?GetStartPosition@CMapStringToPtr@@QBEPAU__POSITION@@XZ
?Unlock@CSyncObject@@UAEHJPAJ@Z
?Collate@CString@@QBEHPBG@Z
??4CString@@QAEABV0@PBE@Z
??_7CStringArray@@6B@
?AfxExtractSubString@@YGHAAVCString@@PBGHG@Z
?Find@CString@@QBEHG@Z
??0CString@@QAE@PBE@Z

oleaut32

SafeArrayAllocDescriptorEx
VarUI4FromI1
VariantTimeToDosDateTime
SysAllocStringLen
VarCyAbs
LHashValOfNameSysA
VarUI2FromDisp
VarUI4FromUI8
DispInvoke
VarDateFromI2
SysAllocString
SafeArrayCopyData
VarCyCmpR8
VarCyRound
VarParseNumFromStr
VarI4FromUI8
LPSAFEARRAY_UserFree

shsvcs

CreateHardwareEventMoniker
HardwareDetectionServiceMain

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0d94a0dc05bac17e34622227e3732f67

Headers

File Characteristics

Imports

inetcomm

kernel32

crypt32

odbctrac

mfcsubs

oleaut32

shsvcs

Sections

.text Size: 55KB - Virtual size: 55KB

.rdata Size: 54KB - Virtual size: 53KB

.data Size: 17KB - Virtual size: 17KB

.rsrc Size: 4KB - Virtual size: 4KB

.text
Size: 55KB - Virtual size: 55KB

.rdata
Size: 54KB - Virtual size: 53KB

.data
Size: 17KB - Virtual size: 17KB

.rsrc
Size: 4KB - Virtual size: 4KB