0faf45eb7efb5764661d14685d1f4562_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0faf45eb7efb5764661d14685d1f4562_JaffaCakes118
Size

370KB
MD5

0faf45eb7efb5764661d14685d1f4562
SHA1

5cbe93170e229f7b99070d418c24dd96237b9e75
SHA256

89b49abb6c89ebd0941077324c4c18d01a0c927adc58b3b3978d10ff559cad91
SHA512

06cb03d27b7ec614f1ba23a5d2d7003cd461582e30427db4a01e0e7f68ae69dd18ecac1a474b8b2d7b27656159a1280f58df5f9749ba8fd008d2c42b20e64b59
SSDEEP

6144:6WEOC1Lt7btVu6jD88tH8DFDn1lSkQKcnSAdt8MHs2j2s5QDGJhwT6:4OCRtfl88tknPSkQK4SgCYLYmwT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0faf45eb7efb5764661d14685d1f4562_JaffaCakes118

Files

0faf45eb7efb5764661d14685d1f4562_JaffaCakes118
.exe windows:5 windows x86 arch:x86

fd87edd39d592e4da3cc15ae61c84554

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

cryptdlg.pdb

Imports

msvcrt

wcsstr
_adjust_fdiv
wcscat
wcschr
_wtol
memmove
mktime
wcsncpy
malloc
_initterm
memcpy
free
_wcsicmp
_except_handler3
time
memset
_errno
mbstowcs
wcscmp
wcscpy
wcslen

ntdll

NtDeleteKey
NtGetDevicePowerState
NtQueryIoCompletion
NtQueryObject
NtFlushBuffersFile
NtQueryMultipleValueKey
RtlLengthSid

kernel32

SetEvent
DeleteCriticalSection
IsDebuggerPresent
GetModuleHandleA
QueryPerformanceCounter
GlobalFree
SetFileAttributesA
LoadLibraryA
GetStdHandle
GetCurrentThreadId
FindFirstFileA
CreateEventA
lstrlenA
GetCurrentProcessId
CreateFileA
OpenSemaphoreA
InterlockedExchange
TlsGetValue
GetSystemTimeAsFileTime
GlobalAlloc
TerminateProcess
CreateMutexW
FindResourceW
GetCurrentProcess
GetSystemDefaultUILanguage
GetAtomNameA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetEnvironmentStringsA
SetFilePointer
DisableThreadLibraryCalls
WaitForSingleObject
CloseHandle
InterlockedDecrement
ResetEvent
WaitForMultipleObjects
GetModuleFileNameA
CreateSemaphoreW
HeapDestroy
GetConsoleCP
OpenMutexW
HeapFree
CreateEventW
InitializeCriticalSection
FindResourceExW
GetCommandLineW
CreateMutexA
GetModuleHandleW
LoadLibraryW
GetProcAddress
GetSystemDefaultLCID
FindAtomA
FreeLibrary
lstrlenW
CreateSemaphoreA
GetLastError
LocalAlloc
OpenEventA
LCMapStringW
TlsSetValue
GetComputerNameW
GetSystemDefaultLangID
WideCharToMultiByte
GetLogicalDrives
LoadLibraryExA
InterlockedIncrement
GetStartupInfoA
GlobalMemoryStatusEx
MultiByteToWideChar
Sleep
CreateThread
TlsFree
GetCurrentDirectoryA
LocalFree
EnterCriticalSection
FormatMessageW
LeaveCriticalSection
PulseEvent
AddAtomA
ReadFile
HeapAlloc
GetUserDefaultLCID
GetProcessHeap
GetOEMCP
DeviceIoControl
GetComputerNameExW
SetLastError
FindClose
DeleteFileA
FindNextFileA
TlsAlloc
CreateFileW

rpcrt4

RpcServerInqDefaultPrincNameW
RpcServerUseProtseqW
RpcServerRegisterIfEx
RpcServerInqBindings
RpcEpRegisterW
RpcBindingVectorFree
RpcEpUnregister
RpcBindingToStringBindingW
RpcStringBindingParseW
RpcBindingInqAuthClientW
RpcStringFreeW
NdrServerCall2
RpcImpersonateClient
RpcRevertToSelf
UuidCreate
I_RpcBindingIsClientLocal
RpcServerRegisterAuthInfoW

advapi32

AddAccessDeniedAce
GetAce
SetSecurityDescriptorDacl
GetSecurityDescriptorLength
MakeSelfRelativeSD
RegDeleteKeyW
RegEnumKeyExW
RegDeleteValueW
RegOpenKeyExW
InitializeAcl
GetLengthSid
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
FreeSid
AllocateAndInitializeSid
RegEnumValueA
RegEnumKeyExA
RegCloseKey
RegQueryValueExW
RegOpenKeyW
RegSetValueExW
RegCreateKeyExW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegOpenKeyExA
RegisterTraceGuidsW
UnregisterTraceGuids
SetServiceStatus
RegQueryInfoKeyA
RegisterServiceCtrlHandlerExW
AddAccessAllowedAce

iphlpapi

GetPerAdapterInfo
GetAdaptersInfo
GetIpAddrTable
NhGetInterfaceNameFromGuid
GetInterfaceInfo

ws2_32

WSAIoctl
WSAEventSelect
WSACreateEvent
WSASocketW

user32

CountClipboardFormats
GetCursor
ReleaseDC
GetSysColor
GetDesktopWindow
GetDoubleClickTime
SendMessageA
LoadStringW
GetClipboardOwner
GetSystemMetrics
EnumWindows
PostQuitMessage
FindWindowExA
FindWindowA
RegisterClassExA
GetMessageA
DestroyWindow
DefWindowProcA
LoadCursorA
CreateWindowExA
wsprintfW

crypt32

CertStrToNameW

userenv

RefreshPolicy

netapi32

NetApiBufferFree
DsGetDcNameW

Sections

.text
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 199KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 27KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd87edd39d592e4da3cc15ae61c84554

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

rpcrt4

advapi32

iphlpapi

ws2_32

user32

crypt32

userenv

netapi32

Sections

.text Size: 56KB - Virtual size: 53KB

.rdata Size: 80KB - Virtual size: 80KB

.data Size: 199KB - Virtual size: 200KB

.bss Size: - Virtual size: 27KB

.rsrc Size: 29KB - Virtual size: 29KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 56KB - Virtual size: 53KB

.rdata
Size: 80KB - Virtual size: 80KB

.data
Size: 199KB - Virtual size: 200KB

.bss
Size: - Virtual size: 27KB

.rsrc
Size: 29KB - Virtual size: 29KB

.reloc
Size: 4KB - Virtual size: 3KB