4126113dbf1b012d1cc2df9753c16036_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4126113dbf1b012d1cc2df9753c16036_JaffaCakes118
Size

168KB
MD5

4126113dbf1b012d1cc2df9753c16036
SHA1

f9441462164202d429cf0b6e75f35e1d36be3914
SHA256

a240e806fa586d60fd3dffd0a3655b42165a17f5396f3fbc4019672b359d18d7
SHA512

14caf86d0ec349839bdb0bd942b865d2f3bbae3ce31aefa909b5f44b187ba60fc1872b3e711fccd5fb1c7bd118499e15258023356b98900cce2236166dafe36a
SSDEEP

3072:fE3fLJ69qIjyjaHurIApX5Rf40xOkuzKHFGsTIPo0JEf1bTbqe4Gmf8RKwEEowov:qLUBjyjGurFX5ofzJssQ0Ji1bTLr+nE5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4126113dbf1b012d1cc2df9753c16036_JaffaCakes118

Files

4126113dbf1b012d1cc2df9753c16036_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6c08a5f9e1bca3e85e0a886011dd5095

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

msmsgs.pdb

Imports

kernel32

FileTimeToLocalFileTime
FileTimeToSystemTime
FindFirstFileA
FreeLibrary
GetCommModemStatus
GetCommState
GetCommTimeouts
GetCommandLineW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentVariableA
GetExitCodeProcess
GetFileSizeEx
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetOverlappedResult
GetProcAddress
GetProcessTimes
GetSystemDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempFileNameW
GetTempPathA
GetThreadContext
GetThreadPriority
GetThreadSelectorEntry
GetThreadTimes
HeapAlloc
HeapDestroy
HeapFree
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchangeAdd
InterlockedIncrement
IsBadCodePtr
IsBadWritePtr
LeaveCriticalSection
LoadLibraryA
LoadResource
LocalFree
LockResource
FileTimeToDosDateTime
OpenEventW
OpenFileMappingW
OpenProcess
OutputDebugStringA
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
ReleaseSemaphore
ResetEvent
RtlUnwind
SetCommMask
SetCommState
SetCommTimeouts
SetEnvironmentVariableA
SetErrorMode
SetEvent
SetFilePointer
SetThreadContext
SetUnhandledExceptionFilter
SizeofResource
SleepEx
SuspendThread
SwitchToFiber
TerminateThread
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualAllocEx
VirtualFree
VirtualProtect
VirtualProtectEx
VirtualQueryEx
WaitCommEvent
WaitForMultipleObjects
WaitForSingleObjectEx
WaitNamedPipeW
WriteFile
WriteProcessMemory
ExitProcess
EnterCriticalSection
DuplicateHandle
DisableThreadLibraryCalls
DeviceIoControl
DeleteFileA
DeleteFiber
DebugBreak
DebugActiveProcess
CreateThread
CreateSemaphoreA
CreateRemoteThread
CreateNamedPipeW
CreateFileMappingA
CreateFileA
CreateEventA
CreateDirectoryW
ContinueDebugEvent
ConnectNamedPipe
ClearCommError
MapViewOfFile
CancelIo

winmm

waveOutGetVolume
waveInOpen
mmsystemGetVersion
midiStreamRestart
midiOutClose
midiInUnprepareHeader
midiInReset
mciFreeCommandResource
joyGetThreshold
aux32Message
mmioWrite

version

GetFileVersionInfoSizeW
VerQueryValueA
VerFindFileA
GetFileVersionInfoW

rpcrt4

RpcIfIdVectorFree
RpcServerInqIf
RpcErrorGetNumberOfRecords
RpcSsDestroyClientContext
RpcSsGetContextBinding
RpcAsyncRegisterInfo
RpcAsyncCancelCall
NdrpReleaseTypeGenCookie
NdrXmitOrRepAsFree
NdrSimpleTypeUnmarshall
NdrSimpleStructUnmarshall
NdrServerCall2
NdrRpcSsEnableAllocate
NdrPointerMarshall
NdrMesSimpleTypeDecode
NdrFullPointerXlatFree
NdrFixedArrayMemorySize
RpcSmDisableAllocate
CStdStubBuffer_Disconnect
CStdStubBuffer_QueryInterface
I_RpcReceive
NdrFixedArrayFree
NdrEncapsulatedUnionBufferSize
NdrConformantVaryingStructMemorySize

msvcrt

_stricmp
_strnicmp
_vsnwprintf
_wcslwr
_wcsnicmp
_wcsupr
_wctime
_wgetenv
_wrename
_write
_wsetlocale
_wstrtime
_wtmpnam
_wtol
atoi
atol
ceil
feof
fgets
fprintf
fseek
ftell
isleadbyte
isprint
isspace
iswalnum
iswalpha
iswdigit
iswprint
iswspace
iswupper
ldexp
malloc
memcpy
memmove
printf
qsort
realloc
sscanf
strchr
strcpy
strcspn
_spawnlp
strncmp
strstr
strtoul
swscanf
towlower
towupper
wcsncmp
wcsncpy
wcsrchr
wctomb
_itow
_ismbcsymbol
_ismbcspace
_isatty
_iob
_initterm
_heapused
_getche
_fileno
_execl
_errno
_atoi64
_amsg_exit
__pioinfo
_spawnl
_snwprintf
_snprintf
_setsystime
__doserrno
__dllonexit
__badioinfo
__CxxFrameHandler
_XcptFilter
_purecall
_popen
_onexit
_memicmp
_lrotl
strncat
_lseeki64

msvbvm60

GetMem2
rtcNPer
rtcMIRR
rtcFilter
__vbaVarIdiv
__vbaStrLike
__vbaLateMemStAd
__vbaFreeVarList
__vbaFileSeek
Zombie_Invoke
VBDllCanUnloadNow
PutMem8

advapi32

RegSetValueExW
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueW
RegCreateKeyExW
OpenThreadToken
OpenProcessToken
LsaRetrievePrivateData
InitializeSecurityDescriptor
InitializeAcl
GetUserNameW
GetLengthSid
FreeSid
CryptSetProvParam
CheckTokenMembership
AreAnyAccessesGranted
AllocateAndInitializeSid
AdjustTokenPrivileges
AddAccessDeniedAce
AddAccessAllowedAce
SetSecurityDescriptorDacl

shell32

SHGetFolderPathW
DragAcceptFiles

ntdll

RtlpNtSetValueKey
RtlExtendedMagicDivide
RtlDestroyEnvironment
NtQueryInformationToken
ZwShutdownSystem

user32

GetMessageA
GetMouseMovePointsEx
GetScrollBarInfo
GetScrollInfo
GetScrollRange
GetUserObjectSecurity
IntersectRect
InvertRect
PostQuitMessage
RegisterClassA
SendInput
SetCursor
SetLastErrorEx
SetMessageExtraInfo
AllowSetForegroundWindow
ShowWindow
UpdateWindow
CharNextExA
CreateWindowExA
DdeClientTransaction
DdeFreeDataHandle
DdeImpersonateClient
DdeUnaccessData
DefWindowProcA
DispatchMessageA
EnumClipboardFormats
FlashWindowEx
GetDoubleClickTime
GetInputState
GetKeyState
SetMessageQueue

Exports

Exports

AShutDown
CryptAllocFunc
DeleteTempFileOnShutdown
GetIndexInfo

Sections

.text
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6c08a5f9e1bca3e85e0a886011dd5095

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

winmm

version

rpcrt4

msvcrt

msvbvm60

advapi32

shell32

ntdll

user32

Exports

Exports

Sections

.text Size: 54KB - Virtual size: 54KB

.rdata Size: 95KB - Virtual size: 95KB

.data Size: 15KB - Virtual size: 15KB

.rsrc Size: 2KB - Virtual size: 1KB

.text
Size: 54KB - Virtual size: 54KB

.rdata
Size: 95KB - Virtual size: 95KB

.data
Size: 15KB - Virtual size: 15KB

.rsrc
Size: 2KB - Virtual size: 1KB