04f5be6e2f8aa0bf3a9746a240fb0856_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

04f5be6e2f8aa0bf3a9746a240fb0856_JaffaCakes118
Size

137KB
MD5

04f5be6e2f8aa0bf3a9746a240fb0856
SHA1

00353366c74734c8f7722174d6653568938b1649
SHA256

b660babfd601e8904a9d2f72a8fd196d37471766778b056b793bffb7378c5dad
SHA512

25ad1112abb025af3d85d1ba947491fdc3c813cca1617589f246272a95104cda9055e09f5d8253d6d9eab77f45f57983c5ea577905f555a00f9658040fd82ef9
SSDEEP

3072:ZTe4LldbC+2kYAI/3iNKqtgQO6hXk8cFaid4CnPkeWLouO3Lg:LdbC+2kYpjkXkuiK4I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04f5be6e2f8aa0bf3a9746a240fb0856_JaffaCakes118

Files

04f5be6e2f8aa0bf3a9746a240fb0856_JaffaCakes118
.exe windows:5 windows x86 arch:x86

247d2f1e48398c3827503373fce846d5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

msiexec.pdb

Imports

msvcrt

_vsnwprintf
wcsrchr
_except_handler3
_c_exit
_exit
_XcptFilter
_cexit
exit
_controlfp
_onexit
__dllonexit
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_vsnprintf

advapi32

SetSecurityDescriptorOwner
StartServiceCtrlDispatcherW
OpenThreadToken
RevertToSelf
GetTokenInformation
MakeAbsoluteSD
RegGetKeySecurity
GetSecurityDescriptorOwner
EqualSid
RegisterServiceCtrlHandlerW
SetServiceStatus
RegEnumKeyExW
CreateServiceW
OpenSCManagerW
OpenServiceW
ControlService
QueryServiceStatus
DeleteService
CloseServiceHandle
SetThreadToken
RegEnumKeyW
RegOpenKeyExW
RegCreateKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
GetLengthSid
AllocateAndInitializeSid
FreeSid
MakeSelfRelativeSD
GetSecurityDescriptorLength
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetAce
AddAccessAllowedAce
InitializeAcl
RegCloseKey
RegSetValueExW
RegDeleteKeyW
RegQueryValueExW
RegDeleteValueW

kernel32

CompareStringW
GetFileType
GetStdHandle
GetCommandLineW
ExitProcess
SetConsoleCtrlHandler
CreateThread
GetUserDefaultLangID
GetSystemDirectoryW
GetModuleHandleW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
SetUnhandledExceptionFilter
GetModuleHandleA
GetStartupInfoA
GlobalAlloc
lstrlenW
lstrcmpiW
InterlockedExchange
GetLastError
CloseHandle
GetCurrentProcess
Sleep
GetVersionExW
GetEnvironmentVariableW
GetProcAddress
LoadLibraryW
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
lstrcpynW
lstrcpynA
WideCharToMultiByte
SetLastError
GetCurrentThread
GlobalFree
FreeLibrary
UnhandledExceptionFilter
WaitForSingleObject
CreateProcessW
GetModuleFileNameW
lstrcmpW
FormatMessageA
GetSystemDefaultLangID
LoadLibraryExW
WriteFile
FormatMessageW
GetLocaleInfoW
GetACP
GetUserDefaultUILanguage
SetCurrentDirectoryW
OutputDebugStringW
LeaveCriticalSection
EnterCriticalSection
OpenProcess
CreateEventW
OpenEventW

user32

PostQuitMessage
TranslateMessage
DispatchMessageW
PeekMessageW
GetMessageW
IsCharAlphaNumericW
PostThreadMessageW
MsgWaitForMultipleObjects

ntdll

NtQueryInformationProcess

ole32

CoUninitialize
StgOpenStorage
CoInitialize
CoRevokeClassObject
CoRegisterClassObject

msi

ord197
ord280
ord190
ord70
ord141
ord199
ord88
ord131
ord184
ord175
ord240
ord222
ord196
ord169
ord78
ord148
ord136
ord8
ord228

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

bekpakx
Size: 31KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

exiowgf
Size: 4KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

247d2f1e48398c3827503373fce846d5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

user32

ntdll

ole32

msi

Sections

.text Size: 60KB - Virtual size: 59KB

.data Size: 7KB - Virtual size: 11KB

.rsrc Size: 34KB - Virtual size: 35KB

bekpakx Size: 31KB - Virtual size: 32KB

exiowgf Size: 4KB - Virtual size: 32KB

.text
Size: 60KB - Virtual size: 59KB

.data
Size: 7KB - Virtual size: 11KB

.rsrc
Size: 34KB - Virtual size: 35KB

bekpakx
Size: 31KB - Virtual size: 32KB

exiowgf
Size: 4KB - Virtual size: 32KB