129879d0e0d3def720d71a970646e6e7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

129879d0e0d3def720d71a970646e6e7_JaffaCakes118
Size

805KB
MD5

129879d0e0d3def720d71a970646e6e7
SHA1

c391312ecce8d9a1b513d56ae67705038e4910e0
SHA256

232afef206d8f817d6b44290242f248e073c6b0f00c56d73fb55818a44f1bd44
SHA512

e4c4817b66b2ce4deb243351f3af928ffc937f7a7d60bf1a26d4d54522365cd984ba3c73a63048ee1fd1d9d20274b20b556e2c1d3962b90e5356f9b18cb3df34
SSDEEP

24576:X0fk9TB82+50trUJz5xIDDfjluI5uABmpIE:kk9TB8ar80DluI7BD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
129879d0e0d3def720d71a970646e6e7_JaffaCakes118

Files

129879d0e0d3def720d71a970646e6e7_JaffaCakes118
.exe windows:5 windows x86 arch:x86

74dba4475f4a2c242c145a9411d9d5d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

expsrv

__vbaVarErrI4
__vbaAryMove
__vbaError
__vbaGetOwner3
rtcInStr
rtcDatePart
GetMemVar
EbGetErrorInfo
__vbaUI1ErrVar
__vbaCyI2
__vbaStrLike
__vbaFreeStr
__vbaVarTextLike
__vbaNextEachCollAd
__vbaMidStmtVar
__vbaNew
__vbaLateMemCall
__vbaExitEachColl
__vbaCyUI1
BASIC_CLASS_Release
__vbaStrR4
rtcDDB
rtcAbsVar
rtcFileSeek
rtcMsgBox
__vbaHresultCheckObj

untfs

?AddExtent@NTFS_EXTENT_LIST@@QAEEVBIG_INT@@00@Z
??1NTFS_UPCASE_FILE@@UAE@XZ
??0NTFS_UPCASE_TABLE@@QAE@XZ
?ReadNext@NTFS_FRS_STRUCTURE@@QAEEVBIG_INT@@@Z
?Initialize@NTFS_MFT_INFO@@QAEEVBIG_INT@@PAVNTFS_UPCASE_TABLE@@EE_K@Z
?Write@NTFS_ATTRIBUTE@@UAEEPBXVBIG_INT@@KPAKPAVNTFS_BITMAP@@@Z
??1NTFS_INDEX_TREE@@UAE@XZ
?Initialize@NTFS_BITMAP_FILE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
?Flush@NTFS_MFT_FILE@@QAEEXZ
??1NTFS_BITMAP_FILE@@UAE@XZ
?Initialize@NTFS_BITMAP@@QAEEVBIG_INT@@EPAVLOG_IO_DP_DRIVE@@K@Z
?Initialize@NTFS_ATTRIBUTE_DEFINITION_TABLE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@E@Z
??0NTFS_FRS_STRUCTURE@@QAE@XZ
??0NTFS_CLUSTER_RUN@@QAE@XZ
?Read@NTFS_MFT_FILE@@UAEEXZ
?QueryFlags@NTFS_MFT_INFO@@SGEPAXG@Z
??1NTFS_BITMAP@@UAE@XZ
?TakeCensus@NTFS_SA@@QAEEPAVNTFS_MASTER_FILE_TABLE@@KPAUNTFS_CENSUS_INFO@@@Z
?QueryExtent@NTFS_EXTENT_LIST@@QBEEKPAVBIG_INT@@00@Z
?CompareFileName@NTFS_MFT_INFO@@SGEPAXKPAU_FILE_NAME@@PAG@Z
?Initialize@NTFS_MFT_INFO@@QAEEXZ
??1NTFS_ATTRIBUTE_DEFINITION_TABLE@@UAE@XZ
?Flush@NTFS_FILE_RECORD_SEGMENT@@QAEEPAVNTFS_BITMAP@@PAVNTFS_INDEX_TREE@@E@Z

advapi32

GetPrivateObjectSecurity
InitiateSystemShutdownA
I_ScSendTSMessage
WmiEnumerateGuids
DecryptFileW
WmiFreeBuffer
ConvertSidToStringSidA
CryptSignHashA
GetAuditedPermissionsFromAclA
GetServiceKeyNameW
GetCurrentHwProfileW
CancelOverlappedAccess
GetInheritanceSourceW
EnumServicesStatusW
SystemFunction004
EnableTrace
TreeResetNamedSecurityInfoW
CryptDuplicateKey
ConvertStringSDToSDRootDomainW
CryptDeriveKey
SetServiceBits
LsaEnumerateTrustedDomains
SaferIdentifyLevel
LookupPrivilegeNameW
CryptEnumProvidersW
LookupPrivilegeValueW
CryptHashSessionKey
LsaEnumerateAccounts
BackupEventLogW
LookupPrivilegeDisplayNameW

msvcrt40

_cgets
_y1
?eof@ios@@QBEHXZ
??0streambuf@@QAE@ABV0@@Z
_adj_fpatan
getc
?writepad@ostream@@AAEAAV1@PBD0@Z
_telli64
_atoldbl
qsort
?fd@fstream@@QBEHXZ
?gbump@streambuf@@IAEXH@Z
??0stdiobuf@@QAE@ABV0@@Z
_mbsncat
_sys_errlist
fputs
??0Iostream_init@@QAE@AAVios@@H@Z
_snwprintf
?osfx@ostream@@QAEXXZ
?unsetf@ios@@QAEJJ@Z

atmlib

ATMGetFontPathsA
ATMEnumFontsW
ATMGetFontPaths
ATMXYShowTextW
ATMEndFontChange
ATMRemoveFontW
ATMGetPostScriptName
ATMFontStatusW
ATMAddFontA
ATMFontStatus
ATMMakePSSW
ATMGetVersionEx
ATMAddFontW
ATMGetNtmFields
ATMSelectObject
ATMEnumFonts
ATMXYShowTextA
ATMGetNtmFieldsW
ATMGetFontInfoA
ATMGetVersionExW
ATMProperlyLoaded
ATMGetPostScriptNameA
ATMGetVersion
ATMGetPostScriptNameW
ATMEnumFontsA
ATMFontSelected
ATMAddFontExW
ATMGetOutlineW
ATMGetBuildStrA

kernel32

SetConsoleFont
SetConsoleLocalEUDC
RemoveDirectoryA
GetConsoleOutputCP
FormatMessageW
GetProcessAffinityMask
VirtualAlloc
GetPriorityClass
LZClose
ZombifyActCtx
SuspendThread
DeleteCriticalSection
SetLocalTime
GetProfileStringA
GetNamedPipeInfo
GetSystemWindowsDirectoryA
DebugSetProcessKillOnExit
LoadLibraryA
OpenMutexW
BackupWrite
DisconnectNamedPipe
FindActCtxSectionGuid

ole32

WriteStringStream
HDC_UserUnmarshal
WriteClassStg
CoUninitialize
WdtpInterfacePointer_UserUnmarshal
ComPs_NdrDllCanUnloadNow
OleDoAutoConvert
OleGetClipboard
OleSetClipboard
CoAddRefServerProcess
HGLOBAL_UserUnmarshal
CoGetClassVersion
CoGetTreatAsClass
HMETAFILEPICT_UserUnmarshal
PropSysAllocString
OleCreateLinkToFileEx
HDC_UserSize
StgOpenStorageOnHandle
StgCreatePropSetStg
CoLoadLibrary
ComPs_NdrDllUnregisterProxy
CoGetCurrentLogicalThreadId
CoRegisterChannelHook
CLIPFORMAT_UserSize

rasapi32

RasSetEapUserDataW
RasGetConnectStatusW
RasHangUpW
RasSetAutodialEnableW
RasGetEntryPropertiesA
RasGetCredentialsW
RasDeleteEntryW
RasGetAutodialParamA
RasFreeEapUserIdentityA
RasAutoDialSharedConnection
RasGetAutodialEnableW
RasAutodialEntryToNetwork
RasRenameEntryA
RasGetProjectionInfoA
RasGetSubEntryHandleA
RasEditPhonebookEntryA
RasSetCredentialsA
RasSetEapUserDataA
UnInitializeRAS
RasGetCredentialsA
RasGetEntryDialParamsA
RasGetEntryDialParamsW

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 225KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 565KB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

74dba4475f4a2c242c145a9411d9d5d1

Headers

DLL Characteristics

File Characteristics

Imports

expsrv

untfs

advapi32

msvcrt40

atmlib

kernel32

ole32

rasapi32

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 225KB - Virtual size: 225KB

.data Size: 565KB - Virtual size: 1.9MB

.tls Size: 512B - Virtual size: 4B

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 512B - Virtual size: 292B

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 225KB - Virtual size: 225KB

.data
Size: 565KB - Virtual size: 1.9MB

.tls
Size: 512B - Virtual size: 4B

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 512B - Virtual size: 292B