398bc0683fa4caae658ae2e3b52e7218_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

398bc0683fa4caae658ae2e3b52e7218_JaffaCakes118
Size

2.6MB
MD5

398bc0683fa4caae658ae2e3b52e7218
SHA1

8b40ad118257f0b81460c2b03244a16435cd5a4d
SHA256

ee3ef1d169a7c180fdd9130eb717838408ad291016ef4bfd0cfc2e0e97e7890f
SHA512

fa25bc6af2f252bdb7d2aebfbda15eb9ca438256eda238581e0da9feba0f2f5f59e18c1e51559b7f2e0b33c0ad4c70314769b06460bc6d8842986de38f598857
SSDEEP

49152:K0Qz8Dz2dE8ylrLte0367sbOdR1W9D34guDQRHo5vR57UK2ZZ70LyBmjjGQBF3ZP:K3z83P8CrLp6ZU54gu8RImKqY2KZaaz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
398bc0683fa4caae658ae2e3b52e7218_JaffaCakes118

Files

398bc0683fa4caae658ae2e3b52e7218_JaffaCakes118
.exe windows:5 windows x86 arch:x86

94e5b43645023da55b240b1f7df2c465

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

RpcServerRegisterAuthInfoW
CStdStubBuffer_Disconnect
RpcBindingToStringBindingW
CStdStubBuffer_Connect
RpcStringFreeA
CStdStubBuffer_CountRefs
NdrOleFree
RpcBindingVectorFree
NdrCStdStubBuffer_Release
CStdStubBuffer_IsIIDSupported
NdrOleAllocate
NdrDllRegisterProxy
RpcStringBindingParseW
NdrStubForwardingFunction
RpcServerRegisterIfEx
RpcServerUnregisterIf
RpcBindingSetAuthInfoW
CStdStubBuffer_DebugServerRelease
RpcImpersonateClient
UuidToStringA
NdrCStdStubBuffer2_Release
RpcStringBindingComposeW
IUnknown_QueryInterface_Proxy
RpcServerUseProtseqEpW
UuidFromStringW
RpcEpResolveBinding
NdrStubCall2
CStdStubBuffer_QueryInterface
RpcStringFreeW
RpcBindingFromStringBindingW
CStdStubBuffer_DebugServerQueryInterface
RpcRaiseException
RpcRevertToSelf
RpcBindingFree
NdrDllGetClassObject
UuidToStringW
CStdStubBuffer_Invoke

shlwapi

PathIsURLW
PathFindFileNameW
StrToIntW
PathRemoveBackslashW
StrRChrW
PathFindExtensionW
UrlUnescapeW
StrCmpW
PathGetDriveNumberW
SHDeleteKeyA
PathFindExtensionA
StrStrIW
PathRemoveExtensionW
PathStripToRootW
PathRemoveFileSpecW
StrTrimW
SHStrDupW
SHDeleteValueW
StrStrIA
PathAppendA
PathIsRelativeW
SHRegGetBoolUSValueW
PathRemoveBlanksW
StrChrW
UrlCanonicalizeW
PathAddBackslashW
UrlIsW
StrCatBuffW
StrCmpNW
StrCmpIW
SHSetValueW
StrStrW
PathFindFileNameA
wnsprintfA
SHGetValueW
PathIsUNCW
StrCpyNW
StrCpyW
StrCmpNIW
AssocQueryStringW
PathIsDirectoryW
PathIsRootW
PathAppendW
StrChrIW
PathRemoveFileSpecA
StrToIntExW
wnsprintfW
StrRetToBufW
StrCmpNIA

msvcrt

__p__iob
srand
_rotr
_commit
_finite
__p__osver
rand
_access

version

GetFileVersionInfoSizeW
VerFindFileW
GetFileVersionInfoSizeA
VerLanguageNameA
GetFileVersionInfoW
GetFileVersionInfoA
VerQueryValueA
VerQueryValueW

advapi32

LsaClose
RegisterEventSourceW
CryptAcquireContextA
SetSecurityDescriptorOwner
DeleteService
RegDeleteKeyW
CheckTokenMembership
OpenSCManagerA
RegCloseKey
MakeSelfRelativeSD
RegSetValueExA
SetEntriesInAclW
GetSidIdentifierAuthority
RegQueryInfoKeyA
RegQueryValueExA
GetSidSubAuthority
CryptReleaseContext
RegFlushKey
GetTraceLoggerHandle
LsaQueryInformationPolicy
RegCreateKeyExW
OpenSCManagerW
GetLengthSid
GetUserNameA
CryptGetHashParam
GetTraceEnableFlags
RegOpenKeyExW
OpenThreadToken
GetTokenInformation
RegNotifyChangeKeyValue
ControlService
RegQueryValueW
IsValidSecurityDescriptor
GetSecurityDescriptorLength
UnregisterTraceGuids
SetSecurityDescriptorDacl
RegEnumKeyA
QueryServiceConfigW

gdi32

SetTextAlign
LineTo
GetCurrentObject
CreateDIBitmap
EndPage
CreateFontIndirectW
GetBitmapBits
ScaleViewportExtEx
MoveToEx
SetStretchBltMode
CreatePatternBrush
SetBkMode
DPtoLP
BitBlt
Ellipse
CreateDCW
StartPage
GetTextExtentPoint32W
TranslateCharsetInfo
SetWindowOrgEx
CreateMetaFileW
CreateFontA
GetTextColor
ExcludeClipRect
GetTextMetricsA
GetSystemPaletteEntries
ScaleWindowExtEx
GetObjectType
EndDoc
CreatePen
GetRgnBox
SetBrushOrgEx
GetNearestColor
EnumFontFamiliesExW
SelectClipRgn
DeleteObject
ExtTextOutA
CreateRectRgn
RealizePalette
CreateRectRgnIndirect
GetBkMode
CombineRgn
GetTextExtentPointW
GetTextExtentPoint32A
Escape
GetStockObject
DeleteDC
GetMapMode
PlayMetaFile
IntersectClipRect
CreateBrushIndirect
PatBlt
GetObjectA
GetTextMetricsW
GetPixel
CreatePalette
GetViewportExtEx
StretchDIBits
GetPaletteEntries
GetDIBits
CreateCompatibleDC
GetClipBox
GetTextAlign

user32

GetWindowRect
GetWindowTextLengthW
IsIconic
GetWindowThreadProcessId
GetMenu
GetMenuItemCount
ScreenToClient
GetCapture
SetWindowRgn
GetKeyState
DrawIcon
IsMenu
GetDC
IsChild

kernel32

ReadFile
GetTempPathA
Sleep
GetACP
GetSystemInfo
GetProcAddress
CreateFileMappingA
GetFileSize
GetModuleFileNameW
GetLocaleInfoA
UnmapViewOfFile
GetLocalTime
ExitProcess
CreateFileW
ResumeThread
ReleaseSemaphore
GetCommandLineW
GetModuleFileNameA
CreateMutexA
GetThreadLocale
GlobalAlloc
GetStdHandle
lstrcpyA
FormatMessageW
SizeofResource
CreateMutexW
LockResource
lstrcpynA
CreateDirectoryA
FileTimeToLocalFileTime
GetSystemTime
CreateEventW
InitializeCriticalSection
WaitForSingleObject
OpenMutexW
GetCurrentThreadId
DisableThreadLibraryCalls
lstrcpyW
EnterCriticalSection
SetFileAttributesA
MapViewOfFile
WaitForMultipleObjects
SetUnhandledExceptionFilter
FindResourceW
lstrcmpiA
lstrcmpA
HeapDestroy
MulDiv
CreateThread
FindFirstFileA
CloseHandle
GetCurrentProcess
GetStringTypeW
GetFileAttributesW
GetCPInfo
FindResourceA
VirtualAlloc
IsBadWritePtr
OutputDebugStringW

ntdll

RtlSetGroupSecurityDescriptor
RtlRaiseStatus
NtAllocateLocallyUniqueId
RtlConvertSidToUnicodeString
RtlRunDecodeUnicodeString
RtlCopyUnicodeString
wcstoul
RtlxOemStringToUnicodeSize
_allmul
NtSetValueKey
_stricmp
NtOpenProcess
NtQuerySymbolicLinkObject
NtOpenProcessToken
NtCreateFile
RtlQueueWorkItem
RtlFreeSid
RtlCreateUserThread
RtlInsertElementGenericTable
RtlEqualSid
RtlQueryEnvironmentVariable_U
NlsMbCodePageTag
RtlSubAuthoritySid
RtlLeaveCriticalSection
RtlValidSecurityDescriptor
NtQuerySystemInformation
NtFreeVirtualMemory
RtlCreateAcl
NtCreateSection
NtUnmapViewOfSection
NtSetSecurityObject
wcsrchr
RtlCreateTimerQueue
NtQueryValueKey
RtlInitializeCriticalSection
NtQueryPerformanceCounter
wcsstr
RtlLengthSid
NtQueryDirectoryFile
_chkstk
NtAllocateVirtualMemory
RtlGUIDFromString
RtlCreateEnvironment
RtlDestroyEnvironment
RtlAcquireResourceShared
RtlxUnicodeStringToOemSize
NtFsControlFile
RtlUnicodeToOemN
RtlFreeHeap

shell32

SHGetPathFromIDListA
ShellExecuteA
SHBrowseForFolderW
ShellExecuteW
SHGetDesktopFolder
SHGetMalloc
SHGetSpecialFolderLocation
SHGetFileInfoW
DragQueryFileW
SHGetPathFromIDListW
CommandLineToArgvW
SHBindToParent
DragQueryFileA
SHGetSpecialFolderPathW
SHChangeNotify
SHBrowseForFolderA
SHGetFolderPathW
ShellExecuteExW
SHFileOperationW

Sections

DATA
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.code
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 3KB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

94e5b43645023da55b240b1f7df2c465

Headers

File Characteristics

Imports

rpcrt4

shlwapi

msvcrt

version

advapi32

gdi32

user32

kernel32

ntdll

shell32

Sections

DATA Size: 2KB - Virtual size: 2KB

.tls Size: 3KB - Virtual size: 3KB

.code Size: 2.6MB - Virtual size: 2.6MB

.bss Size: 3KB - Virtual size: 3.1MB

.tls Size: 4KB - Virtual size: 3KB

.tls Size: - Virtual size: 14KB

.rsrc Size: 10KB - Virtual size: 9KB

DATA
Size: 2KB - Virtual size: 2KB

.tls
Size: 3KB - Virtual size: 3KB

.code
Size: 2.6MB - Virtual size: 2.6MB

.bss
Size: 3KB - Virtual size: 3.1MB

.tls
Size: 4KB - Virtual size: 3KB

.tls
Size: - Virtual size: 14KB

.rsrc
Size: 10KB - Virtual size: 9KB