0b2cf9abc1b88e6db894191bdae4a95f_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

0b2cf9abc1b88e6db894191bdae4a95f_JaffaCakes118
Size

259KB
MD5

0b2cf9abc1b88e6db894191bdae4a95f
SHA1

22c2765d188b5e1780fdd732a361fbd732e8441e
SHA256

34f30c88f787108b49a07c2f36ffae92d8c337dfdaeaf4266683c711832a06e1
SHA512

b660f78cc3e1064094060c868cac14e01909d2f1e9cfedc032ebc62df49f562bbee0702c7ad00db987db7bd951cfe5fd2992e604ad17746f4e271a992ddd64f6
SSDEEP

6144:uSaBurd4ixUO3crX87b09HVVw+YOEB/gSlK7KOwb2:V/mybcQXUm+YOe2wb2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b2cf9abc1b88e6db894191bdae4a95f_JaffaCakes118

Files

0b2cf9abc1b88e6db894191bdae4a95f_JaffaCakes118
.exe windows:5 windows x86 arch:x86

1b2e5b9fdddd7a150f3069a300832c1f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Puli awe\Herehopna\Kabsbey.pdb

Imports

rpcrt4

RpcServerUseAllProtseqsEx
NdrConformantVaryingArrayBufferSize
RpcErrorClearInformation
NdrInterfacePointerMemorySize
NdrDcomAsyncClientCall
I_RpcNsBindingSetEntryNameA
NdrXmitOrRepAsMarshall
RpcMgmtEnableIdleCleanup
NdrConformantArrayMarshall

secur32

EncryptMessage
ExportSecurityContext
InitializeSecurityContextW
AddCredentialsA
QuerySecurityPackageInfoW
MakeSignature
QueryContextAttributesW

oleaut32

VarDateFromBool
VarI4FromDisp
VarFormatNumber
VarR8FromDec
SafeArrayRedim
VarUI4FromI4
VarUI2FromI1
LPSAFEARRAY_Unmarshal
VarUI1FromCy
VarI4FromI8
VarUI8FromDate
VARIANT_UserUnmarshal
VarI1FromI2

rasapi32

RasSetEntryPropertiesW
RasGetCredentialsW
RasGetEapUserDataW
RasGetAutodialAddressA
RasSetAutodialEnableW
RasDeleteSubEntryW
RasDeleteEntryW
RasEnumDevicesA
RasGetProjectionInfoA
RasGetSubEntryHandleA
RasSetEapUserDataA

ole32

CoFreeAllLibraries
ProgIDFromCLSID
CoQueryAuthenticationServices
GetConvertStg
CLSIDFromString
CoInvalidateRemoteMachineBindings
ReadClassStm
CoGetInstanceFromIStorage
CoUnmarshalInterface
CoGetObjectContext
OleCreateDefaultHandler
CLSIDFromProgID

shell32

ord195
SHIsFileAvailableOffline
ExtractIconExW
CommandLineToArgvW
ord90
ord4
ord80
SHFileOperationW
SHFormatDrive

imm32

ImmEnumRegisterWordW
ImmGetDefaultIMEWnd
ImmSetStatusWindowPos
ImmGetCandidateListW
ImmRegisterWordW
ImmCreateContext
ImmGetRegisterWordStyleA
ImmSimulateHotKey
ImmUnregisterWordW
ImmConfigureIMEW
ImmGetContext
ImmAssociateContextEx

glu32

gluBuild1DMipmaps
gluTessBeginPolygon
gluLoadSamplingMatrices
gluTessCallback
gluGetNurbsProperty
gluGetString
gluNurbsCurve
gluCylinder
gluTessProperty
gluQuadricOrientation
gluOrtho2D

opengl32

glTexCoord1dv
glColor4bv
glMapGrid2d
glColor3ub
wglCopyContext
glLoadIdentity
glTexCoordPointer
glVertexPointer
glVertex4s
glLineWidth
glIndexd

msvcrt

wcstoul
_time64
isxdigit
iswspace
toupper
iswxdigit
_mbctoupper
swscanf
exit
isspace

wininet

HttpOpenRequestW
InternetSetOptionW
HttpSendRequestA
InternetFindNextFileA
HttpOpenRequestA
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetSetOptionA
InternetCrackUrlA
InternetFindNextFileW

shlwapi

ChrCmpIW
PathIsContentTypeA
ChrCmpIA
IsCharSpaceA
PathRemoveExtensionW
PathFindExtensionA
PathParseIconLocationA
PathRemoveBlanksA
PathAddBackslashA
PathMakePrettyW
ord157
PathIsUNCServerShareW
PathRenameExtensionA

comctl32

ord6
PropertySheetA
CreatePropertySheetPageA
ImageList_LoadImageW
ImageList_SetIconSize
ImageList_Read
PropertySheetW
ImageList_Draw
CreateStatusWindowW
ImageList_Remove
ImageList_Write
DestroyPropertySheetPage

kernel32

UnmapViewOfFile
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
CancelWaitableTimer
GetConsoleAliasesLengthA
WritePrivateProfileSectionW
GetLastError
GetModuleHandleA
GetUserDefaultUILanguage
GetCommandLineW
GlobalUnlock
GetTickCount
GetPrivateProfileSectionW

gdi32

GetTextFaceW
ExtFloodFill
CreateHatchBrush
ScaleWindowExtEx
GetLayout
GetViewportOrgEx
GetTextMetricsW
SetRectRgn
ExtTextOutW
CombineRgn
StretchDIBits
GetPixel
GetStockObject
CreateEnhMetaFileA

comdlg32

FindTextA
GetOpenFileNameA
GetSaveFileNameA
ChooseColorW
GetFileTitleW
FindTextW
PrintDlgW
PrintDlgA
GetOpenFileNameW
ChooseFontA

advapi32

LookupSecurityDescriptorPartsA
AccessCheckByTypeResultList
EnumDependentServicesW
SetThreadToken
CreateRestrictedToken
CryptSetProviderA
LogonUserA
AccessCheck
CredDeleteA

Exports

Exports

AtopHideReelUveamittgramDribheloGlopef
BoysBuhrManaTitsRubetaxatat
FarlMittMoshFealSlum
GnatAnasSlawbatsBolaGinkAgerHogsHinsYapsrainup
GrownounCeltBaaldayaa
ImmyRubeRumpTeasapeae
KakiFurlFordWarmJoukgeesweenlocoBitsfun
MoorMageokayHastcoedropeTrodHogs

Sections

.text
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 246KB - Virtual size: 245KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1b2e5b9fdddd7a150f3069a300832c1f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

rpcrt4

secur32

oleaut32

rasapi32

ole32

shell32

imm32

glu32

opengl32

msvcrt

wininet

shlwapi

comctl32

kernel32

gdi32

comdlg32

advapi32

Exports

Exports

Sections

.text Size: - Virtual size: 4KB

.rdata Size: 246KB - Virtual size: 245KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: - Virtual size: 4KB

.rdata
Size: 246KB - Virtual size: 245KB

.reloc
Size: 12KB - Virtual size: 12KB