06f8d58726a0916bda65bd42381926e2_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

06f8d58726a0916bda65bd42381926e2_JaffaCakes118
Size

50KB
MD5

06f8d58726a0916bda65bd42381926e2
SHA1

e023090e8ab45dc8e920a6afca8341a14616a123
SHA256

d29a72a48cd3546154ce90a1a766c24eee83058222361da4f52c4674bd882659
SHA512

6dd99c1a56af1373beeb674858560777f23be46c8af5468bca2ce9dced9d594fe6762853b8c9219fb141fc2d0d9ad24ad47514cee6a5153008c0177a2e2c9e6a
SSDEEP

1536:Zv9/57vEg3c1zilTcWsnEJplrWVvSoSA:BLlMpilTcWrRC6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06f8d58726a0916bda65bd42381926e2_JaffaCakes118

Files

06f8d58726a0916bda65bd42381926e2_JaffaCakes118
.exe windows:5 windows x86 arch:x86

d7378038e813ca06183cdb39237778de

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateEventA
SetNamedPipeHandleState
FindFirstFileExA
LockFile
SetConsoleNumberOfCommandsA
Process32FirstW
LoadModule
WaitNamedPipeW
GetComputerNameA
LoadLibraryA
SetConsoleNumberOfCommandsW
_lcreat
FindResourceW
GetFileAttributesA
GetProcAddress
GetNamedPipeHandleStateA
GetConsoleKeyboardLayoutNameA
VirtualLock
SetFileApisToOEM
GetStartupInfoA
InterlockedIncrement
GetModuleHandleW
DeleteVolumeMountPointW
EnumTimeFormatsW
VirtualAlloc
OpenJobObjectA
GetVersion
GetNumberOfConsoleFonts
GetConsoleCursorMode
GetConsoleAliasA
CreateFileMappingW
GetStartupInfoW
GlobalAlloc

user32

CreateWindowStationA
EqualRect
UnlockWindowStation
GetDlgCtrlID
CsrBroadcastSystemMessageExW
DdeGetQualityOfService
DialogBoxParamW
DlgDirSelectExW
GetDoubleClickTime
LoadStringA
DdeKeepStringHandle
MBToWCSEx
EndDeferWindowPos
GetAppCompatFlags
UnregisterUserApiHook
GetGUIThreadInfo
MessageBoxExW
ClipCursor
SetPropW
SendMessageTimeoutW
DdeAddData
OpenWindowStationW
DlgDirListA
ResolveDesktopForWOW
RealGetWindowClassA

cmutil

?IsEnabled@CmLogFile@@QAEHXZ
CmAtolA
?GPPI@CIniW@@QBEKPBG0K@Z
CmMoveMemory
?SetReadICSData@CIniA@@QAEXH@Z
?WPPI@CIniA@@QAEXPBD0K@Z
CmIsDigitW
?SetICSDataPath@CIniA@@QAEXPBD@Z
?GetLogFilePath@CmLogFile@@QAEPBGXZ
?Init@CmLogFile@@QAEJPAUHINSTANCE__@@HPBD@Z
??0CRandom@@QAE@I@Z
?SetPrimaryFile@CIniA@@QAEXPBD@Z
?Clear@CIniA@@QAEXXZ
?GetFile@CIniW@@QBEPBGXZ
?GPPS@CIniA@@QBEPADPBD00@Z
?SetHInst@CIniA@@QAEXPAUHINSTANCE__@@@Z
?SetParams@CmLogFile@@QAEJHKPBD@Z
?DeInit@CmLogFile@@QAEJXZ
CmLoadIconA
?Banner@CmLogFile@@QAEXXZ
SzToWz
?CIniA_DeleteEntryFromReg@CIniA@@IBEHPAUHKEY__@@PBD1@Z
CmLoadImageW
?SetRegPath@CIniA@@QAEXPBD@Z
CmWinHelp
IsFarEastNonOSR2Win95
?SetHInst@CIniW@@QAEXPAUHINSTANCE__@@@Z
CmStripPathAndExtW
?GetSection@CIniA@@QBEPBDXZ

mapi32

cmc_logoff
FBadRglpszA@8
ScCopyNotifications@16
MAPISendMail
ScInitMapiUtil@4
ScMAPIXFromCMC
HrGetOmiProvidersFlags
UNKOBJ_COFree@8
OpenTnefStreamEx
ChangeIdleRoutine@28
FtNegFt@8
FBadProp@4
BMAPIResolveName
RTFSync@12
MAPILogon
MAPIDeinitIdle@0
BMAPIFindNext
FBadRglpNameID@8
__CPPValidateParameters@8
FEqualNames@8
ScBinFromHexBounded@12
MAPIAllocateMore
HrEntryIDFromSz@12
MAPIInitialize
ScCopyProps@16
MAPIOpenFormMgr@8
BuildDisplayTable@40
FixMAPI
PropCopyMore@16
MAPIInitialize@4
MAPIAdminProfiles@8
OpenTnefStream
FBadRglpszW@8
EncodeID@12

Sections

.text
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d7378038e813ca06183cdb39237778de

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

cmutil

mapi32

Sections

.text Size: 41KB - Virtual size: 40KB

.rdata Size: 7KB - Virtual size: 6KB

.rsrc Size: 2KB - Virtual size: 1KB

.text
Size: 41KB - Virtual size: 40KB

.rdata
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 2KB - Virtual size: 1KB