27f709953e87147c745b326345075ed0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

27f709953e87147c745b326345075ed0_JaffaCakes118
Size

144KB
MD5

27f709953e87147c745b326345075ed0
SHA1

101bf4df05b68345c17ab59640c721ee2598fb47
SHA256

65c159c8421359501c8ac3bb941b3dcae5cf54a3826889b1e0e3074eb3107723
SHA512

bee544ab2dc7cdc4b0b406c0d5b06c271e49c967600a1cfa680744bb849dbc626a7d7e111833849fe98ed93eef6832f384bdbaecb68356e64eb9a6f14e8b076d
SSDEEP

3072:L3m7SGVtlRqobyHH7An/y8L3tG/gPcTQb06VV21McEKM0A:Cn7lRqoO7An/yKd+TQ40VDRKMx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27f709953e87147c745b326345075ed0_JaffaCakes118

Files

27f709953e87147c745b326345075ed0_JaffaCakes118
.exe windows:5 windows x86 arch:x86

25495cbb066abf8c9abdeb8d5e550217

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscms

GetCMMInfo
CreateDeviceLinkProfile
UninstallColorProfileW
UninstallColorProfileA
GetColorProfileElement
OpenColorProfileW
InternalGetPS2CSAFromLCS
ConvertColorNameToIndex
GetColorProfileFromHandle
GetPS2ColorRenderingDictionary
RegisterCMMA
GetStandardColorSpaceProfileW
RegisterCMMW
SetColorProfileElementSize
AssociateColorProfileWithDeviceA
DeleteColorTransform
TranslateBitmapBits
DisassociateColorProfileFromDeviceW
SetColorProfileHeader
SetStandardColorSpaceProfileA
SelectCMM
InternalGetPS2PreviewCRD
SetStandardColorSpaceProfileW

rtm

DeleteFromTable
RtmGetRouteAge
RtmUpdateAndUnlockRoute
DestroyTable
MgmGetMfe
RtmLockNextHop
RtmReleaseDests
RtmGetInstanceInfo
CreateTable
MgmGetFirstMfeStats
RtmGetEntityMethods
RtmRegisterClient
RtmHoldDestination
RtmGetRoutePointer
RtmLockDestination
RtmGetMostSpecificDestination
RtmBlockConvertRoutesToStatic
NextMatchInTable
RtmReleaseEntities
RtmAddRoute
RtmDeleteRoute
RtmGetChangedDests
RtmIsRoute
RtmGetRegisteredEntities

msasn1

ASN1BERDecGeneralizedTime
ASN1_FreeDecoded
ASN1bitstring_cmp
ASN1DecSetError
ASN1_GetEncoderOption
ASN1BEREncBool
ASN1CEREncEndBlk
ASN1CEREncZeroMultibyteString
ASN1BEREncExplicitTag
ASN1BEREncEoid
ASN1BERDecOpenType2
ASN1BERDecCheck
ASN1ztcharstring_free
ASN1_Decode
ASN1BEREoid_free
ASN1BEREncCheck
ASN1BEREncMultibyteString
ASN1_CreateEncoder
ASN1_CloseEncoder
ASN1_GetDecoderOption
ASN1octetstring_cmp
ASN1BERDecOctetString
ASN1intx_free
ASN1CEREncOctetString
ASN1_CloseModule
ASN1utf8string_free

kernel32

GetTempPathW
SetTermsrvAppInstallMode
InitializeCriticalSection
ReadConsoleInputExW
GetThreadPriorityBoost
QueueUserWorkItem
CreateTapePartition
SetPriorityClass
GetProfileSectionW
HeapCompact
GetProcessAffinityMask
LoadLibraryW
GetOEMCP
ConvertFiberToThread
AddVectoredExceptionHandler
GetEnvironmentVariableA
lstrcat
GetModuleHandleA
LoadModule
RemoveDirectoryA
MulDiv
SetConsoleTextAttribute
GlobalReAlloc
FatalExit
EndUpdateResourceW
HeapWalk
CreateRemoteThread
ReadFile

linkinfo

DestroyLinkInfo
CompareLinkInfoVolumes
CreateLinkInfo
ResolveLinkInfo
IsValidLinkInfo
GetLinkInfoData
GetCanonicalPathInfo
DisconnectLinkInfo
CreateLinkInfoA
CreateLinkInfoW
CompareLinkInfoReferents
GetCanonicalPathInfoW
GetCanonicalPathInfoA
ResolveLinkInfoW
ResolveLinkInfoA

msvcrt

_ungetch
__unDName
_open
_adj_fprem
_ecvt
_logb
_wutime64
_spawnl
??4exception@@QAEAAV0@ABV0@@Z
_open_osfhandle
_setjmp3
_cscanf
_wspawnlp
__set_app_type
_wcsdup
_vsnprintf
__winitenv
_mbsinc
?name@type_info@@QBEPBDXZ
exit
__getmainargs
_getdllprocaddr
_scalb
_fsopen
wcsncpy
__p__commode
isleadbyte
clearerr
_commit
wcsncmp
_mbctype
_adj_fprem1
_mbsnbcnt
??_Gbad_typeid@@UAEPAXI@Z

mprapi

MprAdminIsDomainRasServer
MprConfigGetFriendlyName
MprAdminTransportSetInfo
MprConfigInterfaceTransportSetInfo
MprAdminPortEnum
MprConfigTransportGetHandle
MprAdminUserWriteProfFlags
MprInfoCreate
MprInfoRemoveAll
MprAdminTransportGetInfo
MprAdminMIBEntryGetNext
MprInfoBlockQuerySize
MprAdminBufferFree
MprConfigInterfaceTransportRemove
MprAdminUpgradeUsers
MprConfigInterfaceEnum
MprAdminServerDisconnect
MprAdminInterfaceGetCredentials
MprAdminServerConnect
MprAdminInterfaceDelete
MprAdminInterfaceSetCredentials
MprAdminInterfaceSetCredentialsEx
MprConfigServerRefresh
MprConfigServerRestore
MprAdminMIBServerDisconnect

user32

GetNextDlgTabItem
CharUpperA
GetMonitorInfoA
SetSysColors
RegisterClassW
PostQuitMessage
EqualRect
MapVirtualKeyExA
CharPrevA
NotifyWinEvent
ChangeMenuA
wvsprintfA
GetFocus
DefWindowProcW
CreateDialogParamA

Sections

.text
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

25495cbb066abf8c9abdeb8d5e550217

Headers

File Characteristics

Imports

mscms

rtm

msasn1

kernel32

linkinfo

msvcrt

mprapi

user32

Sections

.text Size: 93KB - Virtual size: 93KB

.rdata Size: 42KB - Virtual size: 41KB

.data Size: 3KB - Virtual size: 82KB

.rsrc Size: 3KB - Virtual size: 2KB

.text
Size: 93KB - Virtual size: 93KB

.rdata
Size: 42KB - Virtual size: 41KB

.data
Size: 3KB - Virtual size: 82KB

.rsrc
Size: 3KB - Virtual size: 2KB