08d9010a3524b29512190c6aa8a39682_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

08d9010a3524b29512190c6aa8a39682_JaffaCakes118
Size

259KB
MD5

08d9010a3524b29512190c6aa8a39682
SHA1

15542ea221bed077daf65a8d95cb8e0485c798cd
SHA256

007b77860f789332654e915a23105a83cdc6ee92865c3a5813c772fd1c87770f
SHA512

c3fbf9e7ca977c2aafea0706fe732fac05587eb95e29ef65bfd64c1c0b2193834b8b01a402f6cd245cd12e102a6791e3ea1747f51e47c5387023ea3bdf0e1e3d
SSDEEP

6144:vDXC0XnJ6hmVn+X6+hFyg7wz4Q2X1Bz0VygH:rC0Z6gcVhFy1z4Z1N7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
08d9010a3524b29512190c6aa8a39682_JaffaCakes118

Files

08d9010a3524b29512190c6aa8a39682_JaffaCakes118
.exe windows:5 windows x86 arch:x86

0526fdd803c5b8a8710f335c53d2e121

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

dnsrslvr.pdb

Imports

setupapi

SetupDiBuildClassInfoList
SetupDiGetClassDescriptionW
pSetupVerifyQueuedCatalogs
CMP_WaitNoPendingInstallEvents
SetupDiGetClassDevsExW
SetupGetLineTextW
CM_Open_Class_KeyW
SetupDiGetINFClassW
pSetupIsGuidNull
SetupDiClassGuidsFromNameW
SetupAddToSourceListW
SetupRemoveFromSourceListW
SetupInitDefaultQueueCallbackEx
SetupTermDefaultQueueCallback
SetupDefaultQueueCallbackW
pSetupStringFromGuid
SetupInstallServicesFromInfSectionExW
SetupIterateCabinetW
SetupScanFileQueueW
SetupPromptForDiskW
SetupOpenAppendInfFileW
pSetupGetGlobalFlags
pSetupSetGlobalFlags
SetupQueueCopyW
SetupOpenFileQueue
SetupInstallFilesFromInfSectionW
SetupCommitFileQueueW
SetupCloseFileQueue
SetupGetInfInformationW
SetupGetSourceFileLocationW
SetupGetSourceInfoW
SetupDecompressOrCopyFileW
SetupQueryInfFileInformationW
CM_Get_DevNode_Status
SetupDiCreateDeviceInfoW
SetupDiRegisterDeviceInfo
SetupDiDeleteDeviceInfo
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_SizeW
SetupGetLineCountW
SetupDiEnumDeviceInfo
SetupDiCreateDeviceInfoList
SetupDiGetDeviceInstanceIdW
SetupDiOpenDeviceInfoW
pSetupGetField
SetupGetFieldCount
SetupDiInstallDevice
SetupDiSetDeviceRegistryPropertyW
SetupInstallFromInfSectionW
SetupDiSelectBestCompatDrv
SetupFindNextMatchLineW
SetupOpenLog
SetupLogErrorW
SetupCloseLog
SetupDiSetSelectedDriverW
SetupDiEnumDriverInfoW
SetupDiGetDriverInstallParamsW
SetupDiSetDriverInstallParamsW
SetupDiCreateDevRegKeyW
SetupDiGetActualSectionToInstallW
SetupGetMultiSzFieldW
SetupGetIntField
SetupGetLineByIndexW
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
CM_Get_Parent
SetupDiDestroyDeviceInfoList
SetupDiCallClassInstaller
SetupDiDestroyDriverInfoList
SetupDiGetSelectedDriverW
pSetupGuidFromString
SetupDiOpenDevRegKey
SetupCopyOEMInfW
SetupDiBuildDriverInfoList
SetupDiOpenClassRegKey
SetupDiInstallClassW
SetupDiGetDriverInfoDetailW
SetupCloseInfFile
SetupOpenInfFileW
SetupDiGetClassInstallParamsW
SetupDiSetClassInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceInfoListDetailW
SetupDiLoadClassIcon
SetupDiGetDeviceRegistryPropertyW
SetupFindFirstLineW
SetupGetStringFieldW
SetupFindNextLine

ntdll

NtOpenFile
NtSetSystemInformation
_strcmpi
RtlCopyUnicodeString
RtlEqualUnicodeString
RtlSubAuthorityCountSid
RtlLengthRequiredSid
RtlCopySid
RtlSubAuthoritySid
NtPowerInformation
NtDeviceIoControlFile
NtQuerySystemInformation
NtCreateFile
NtOpenKey
NtQueryValueKey
RtlIntegerToUnicodeString
RtlEqualSid
RtlNtStatusToDosError
VerSetConditionMask
NtQuerySystemEnvironmentValue
RtlInitializeSid
NtQuerySymbolicLinkObject
NtClose
RtlUnwind
NtOpenEvent
NtCreateEvent
RtlImageNtHeader
DbgBreakPoint
NtSetSystemEnvironmentValue
NtOpenDirectoryObject
NtQueryDirectoryObject
RtlAppendUnicodeStringToString
RtlInitUnicodeString
NtOpenSymbolicLinkObject

gdi32

SetTextColor
GetDeviceCaps
AddFontResourceW
GetStockObject
CreateFontIndirectW
SelectObject
StretchDIBits
CreateCompatibleDC
GetObjectW
SetBkColor
GetTextExtentPointW
BitBlt
DeleteDC
DeleteObject
SetStretchBltMode
SetBkMode
CreateDIBSection

kernel32

GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
VirtualProtect
VirtualQuery
InterlockedExchange
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsAlloc
TlsGetValue
TlsFree
GetModuleHandleA
HeapReAlloc
GetVersionExA
GetCommandLineA
TlsSetValue
lstrcpynA
LocalReAlloc
UnhandledExceptionFilter
GetCurrentProcessId
QueryPerformanceCounter
FindResourceW
LoadResource
LockResource
GetLogicalDriveStringsW
GlobalMemoryStatusEx
MoveFileW
lstrcpyA
lstrcmpiA
SetThreadLocale
TerminateThread
GetThreadLocale
SetThreadExecutionState
SetComputerNameExW
GetLogicalDrives
IsDebuggerPresent
ExitThread
ExitProcess
CreateEventW
CreateNamedPipeW
SetEvent
ConnectNamedPipe
DisconnectNamedPipe
GetACP
SearchPathW
GetSystemTime
OpenEventW
CopyFileA
DeleteFileA
GetSystemTimeAsFileTime
GetTickCount
LoadLibraryExW
LoadLibraryA
GlobalAlloc
GlobalFree
InitializeCriticalSection
GetUserDefaultLCID
EnumSystemLocalesW
GetLocaleInfoW
IsValidLocale
DnsHostnameToComputerNameW
GetModuleHandleW
GetVersion
FreeLibraryAndExitThread
ReleaseMutex
CreateMutexW
lstrlenA
GetPrivateProfileIntW
GetOEMCP
WaitForSingleObjectEx
RemoveDirectoryW
GetStartupInfoW
GetTempPathW
CopyFileW
CreateFileMappingW
MapViewOfFile
MoveFileExW
GetModuleFileNameW
GetLocalTime
WideCharToMultiByte
OutputDebugStringW
SetUnhandledExceptionFilter
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEnvironmentVariableW
CreateDirectoryW
FindNextFileW
GetTempFileNameW
RaiseException
LocalSize
WritePrivateProfileStringW
GetSystemInfo
FormatMessageW
GetFileAttributesW
lstrcmpW
LocalAlloc
GetExitCodeThread
GetCPInfo
LocalFree
GetCurrentThreadId
CreateThread
SetTimeZoneInformation
Sleep
GetDriveTypeW
SetErrorMode
GetFileSize
SetFilePointer
ReadFile
MultiByteToWideChar
FlushFileBuffers
VerifyVersionInfoW
DuplicateHandle
ExpandEnvironmentStringsW
GetLocaleInfoA
CreateProcessW
WaitForSingleObject
GetWindowsDirectoryA
EnumSystemLocalesA
IsValidCodePage
SetStdHandle
CreateFileA
SetEndOfFile
lstrcmpA
GetFullPathNameA
CreateEventA
IsDBCSLeadByte
FormatMessageA
CompareStringW
UnmapViewOfFile
_lwrite
_lcreat
SetFileAttributesA
_lclose
_lread
_llseek
_lopen
GetCurrentThread
SetThreadAffinityMask
GetProcessAffinityMask
GetCurrentProcess
InterlockedIncrement
GetProcAddress
LoadLibraryW
GetPrivateProfileStringW
FreeLibrary
DeleteFileW
SetFileAttributesW
GetWindowsDirectoryW
HeapFree
HeapAlloc
GetProcessHeap
lstrcatW
FindClose
FindFirstFileW
QueryDosDeviceW
CloseHandle
GetLastError
DeviceIoControl
CreateFileW
lstrlenW
GetVolumeInformationW
GetSystemDirectoryW
lstrcpyW
lstrcpynW
GetSystemWindowsDirectoryW
lstrcmpiW
SetLastError
GetDiskFreeSpaceW
GetTimeZoneInformation
GetVersionExW
GetEnvironmentVariableW
GetComputerNameW
WriteFile
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetExitCodeProcess
TerminateProcess

powrprof

SetActivePwrScheme

user32

CharToOemA
GetSysColorBrush
wsprintfA
IsDlgButtonChecked
SendMessageW
SetWindowLongW
CheckRadioButton
PostMessageW
GetParent
EnableWindow
GetDlgItem
CheckDlgButton
LoadStringW
SetDlgItemTextW
DestroyIcon
SendDlgItemMessageW
WinHelpW
wsprintfW
CharLowerW
EndDialog
LoadBitmapW
LoadCursorW
PostThreadMessageW
ShowCursor
SetCursor
DialogBoxParamW
IsWindow
SetFocus
SetTimer
KillTimer
DispatchMessageW
GetMessageW
CharUpperBuffW
GetWindowLongW
LoadIconW
MessageBoxW
CharUpperW
EndPaint
GetClientRect
GetSysColor
DrawTextW
GetSystemMetrics
BeginPaint
DefWindowProcW
UnregisterClassW
RegisterClassW
MsgWaitForMultipleObjects
SetForegroundWindow
SetWindowTextW
ReleaseDC
GetDC
LoadImageW
PostQuitMessage
DestroyWindow
RegisterHotKey
SetShellWindow
ShowWindow
CreateWindowExW
PeekMessageW
WaitMessage
GetKeyboardLayout
GetDlgItemTextW
wvsprintfW
ChangeDisplaySettingsW
EnumDisplaySettingsW
CallWindowProcW
GetDlgCtrlID
UpdateWindow
InvalidateRect
CharUpperA
SendMessageTimeoutW
wvsprintfA
MoveWindow
ClientToScreen
GetWindowRect
GetDesktopWindow
GetAsyncKeyState
GetActiveWindow
FillRect
SetActiveWindow
SetWindowPos
EnableMenuItem
GetSystemMenu
MessageBoxA

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

cryptui

I_CryptUIProtect

netapi32

NetApiBufferFree
NetGetJoinInformation
NetUserSetInfo
NetUserGetInfo

rpcrt4

UuidToStringW
UuidFromStringW
UuidCreate
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingFree
NdrClientCall2
RpcStringFreeW

urlmon

CoInternetParseUrl

imm32

ImmAssociateContext

wintrust

CryptCATClose
CryptCATEnumerateCatAttr
CryptCATAdminAcquireContext
CryptCATAdminReleaseContext
IsCatalogFile
CryptCATOpen

Sections

.text
Size: 44KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 201KB - Virtual size: 331KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0526fdd803c5b8a8710f335c53d2e121

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

setupapi

ntdll

gdi32

kernel32

powrprof

user32

version

cryptui

netapi32

rpcrt4

urlmon

imm32

wintrust

Sections

.text Size: 44KB - Virtual size: 47KB

.data Size: 201KB - Virtual size: 331KB

.rsrc Size: 5KB - Virtual size: 5KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 44KB - Virtual size: 47KB

.data
Size: 201KB - Virtual size: 331KB

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 7KB - Virtual size: 7KB