aa97726c96275f57ca686d1e95dfdfd9_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

aa97726c96275f57ca686d1e95dfdfd9_JaffaCakes118
Size

944KB
MD5

aa97726c96275f57ca686d1e95dfdfd9
SHA1

d2424394c6398a3ea7b69deac9dd41a30091905d
SHA256

d87fbd8fc181f8b1f65f87bf1c20ea1e9862d5d9bd8dd7abcb53966cfe2c38e3
SHA512

a596e347615867a6f6514bf2889af9bc725a8eebb90056c3dea39347ecfb8a8b090e3e5b2334361a239fd564352b54196295fb0108ba03847f89ea1d0d55f7e1
SSDEEP

24576:JKfE4IeyDiRhMnFKO2pS9BDrFYA7CKW5:o3yDiRhYF22B57i5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
aa97726c96275f57ca686d1e95dfdfd9_JaffaCakes118

Files

aa97726c96275f57ca686d1e95dfdfd9_JaffaCakes118
.dll windows:5 windows x64 arch:x64

0c306a16ce5597b6bcfd8bd8b19841ed

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

opengl32

glMap2f

kernel32

ConvertDefaultLocale
FindFirstVolumeMountPointW
FreeEnvironmentStringsA
ClearCommBreak
ReadConsoleOutputA
GetBinaryTypeA

shlwapi

PathIsUNCServerShareW
SHQueryInfoKeyW
StrDupA
PathSkipRootW
UrlCombineW

advapi32

SetTokenInformation
SetServiceObjectSecurity
OpenSCManagerW
AbortSystemShutdownA
CreateServiceA

iphlpapi

GetTcpStatistics
GetRTTAndHopCount
UnenableRouter

avifil32

AVIFileExit

msvfw32

ICDecompress

msvcrt

fputc

ole32

CoGetCurrentLogicalThreadId

netapi32

DsEnumerateDomainTrustsW
NetGroupAddUser

shell32

SHPathPrepareForWriteW

gdi32

GetStretchBltMode
SetMiterLimit
CloseFigure
SetPixelV
SetPaletteEntries
DeleteDC
CopyMetaFileW

wininet

GetUrlCacheEntryInfoA

setupapi

SetupDiGetDriverInfoDetailW
SetupDiDestroyClassImageList

winscard

SCardReleaseContext

rpcrt4

RpcBindingInqAuthInfoExW
NdrServerCall2

wintrust

CryptCATHandleFromStore
CryptCATGetCatAttrInfo

user32

ReplyMessage
VkKeyScanA
EnumDisplayDevicesA
AnyPopup
CallWindowProcA

winmm

waveOutGetVolume
midiOutCachePatches

Exports

Exports

SqmAddToAverage
SqmAddToStream
SqmAddToStreamDWord
SqmAddToStreamDWord64
SqmAddToStreamString
SqmAddToStreamV
SqmCheckEscalationAddToStreamDWord
SqmCheckEscalationAddToStreamDWord64
SqmCheckEscalationAddToStreamString
SqmCheckEscalationSetDWord
SqmCheckEscalationSetDWord64
SqmCheckEscalationSetString
SqmCleanup
SqmClearFlags
SqmCreateNewId
SqmEndSession
SqmFlushSession
SqmGetEnabled
SqmGetEscalationRuleStatus
SqmGetFlags
SqmGetInstrumentationProperty
SqmGetMachineId
SqmGetSession
SqmGetSessionStartTime
SqmGetUserId
SqmIncrement
SqmIsWindowsOptedIn
SqmLoadEscalationManifest
SqmReadSharedMachineId
SqmReadSharedUserId
SqmSet
SqmSetAppId
SqmSetAppVersion
SqmSetBits
SqmSetBool
SqmSetCurrentTimeAsUploadTime
SqmSetDWord64
SqmSetEnabled
SqmSetEscalationInfo
SqmSetFlags
SqmSetIfMax
SqmSetIfMin
SqmSetMachineId
SqmSetString
SqmSetUserId
SqmStartSession
SqmStartUpload
SqmSysprepCleanup
SqmSysprepGeneralize
SqmSysprepSpecialize
SqmTimerAccumulate
SqmTimerAddToAverage
SqmTimerRecord
SqmTimerStart
SqmUnattendedSetup
SqmUnloadEscalationManifest
SqmWaitForUploadComplete
SqmWriteSharedMachineId
SqmWriteSharedUserId

Sections

.text
Size: 508KB - Virtual size: 504KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 4KB - Virtual size: 932B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 208KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0c306a16ce5597b6bcfd8bd8b19841ed

Headers

DLL Characteristics

File Characteristics

Imports

opengl32

kernel32

shlwapi

advapi32

iphlpapi

avifil32

msvfw32

msvcrt

ole32

netapi32

shell32

gdi32

wininet

setupapi

winscard

rpcrt4

wintrust

user32

winmm

Exports

Exports

Sections

.text Size: 508KB - Virtual size: 504KB

.rdata Size: 60KB - Virtual size: 56KB

.data Size: 56KB - Virtual size: 54KB

.pdata Size: 4KB - Virtual size: 312B

.rsrc Size: 12KB - Virtual size: 11KB

.reloc Size: 4KB - Virtual size: 2KB

Size: 28KB - Virtual size: 27KB

Size: 4KB - Virtual size: 1KB

Size: 4KB - Virtual size: 932B

Size: 208KB - Virtual size: 205KB

Size: 28KB - Virtual size: 27KB

Size: 4KB - Virtual size: 1KB

Size: 8KB - Virtual size: 4KB

Size: 4KB - Virtual size: 1KB

Size: 4KB - Virtual size: 2KB

Size: 4KB - Virtual size: 1KB

.text
Size: 508KB - Virtual size: 504KB

.rdata
Size: 60KB - Virtual size: 56KB

.data
Size: 56KB - Virtual size: 54KB

.pdata
Size: 4KB - Virtual size: 312B

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 4KB - Virtual size: 2KB