JaffaCakes118_d0880ec1ab1627d23202ee86d33b7356

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_d0880ec1ab1627d23202ee86d33b7356
Size 625KB
Sample250109-x8ptysymhs
SHA256 3a6316319ad822be021d48242dfece7f9b8668bae7d19db466b7d514eeae41af
MD5 d0880ec1ab1627d23202ee86d33b7356
SHA1 a8dae933bdf12ccdd8f1c763d3be932186fe8966
SHA512 1d833b5f77b8cbb66224effe69daaa78e2b3fcfd2bde89c6d3bced4dcef83687b1cbeacd22f0055003ed0935a3cc83972f5b16a1fc476a896beae7d620c50549
SSDEEP 12288:bVt+w8wyv/566WoJMOYeRqmyfq5M7I4XbDhyGdPiMbSLJj2xshdFSRO:ht+w5yJDJGeRMhjdudaKh
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_d0880ec1ab1627d23202ee86d33b7356

File Explorer

JaffaCakes118_d0880ec1ab1627d23202ee86d33b7356

.exe 625KB

JaffaCakes118_d0880ec1ab1627d23202ee86d33b7356

IMPHASH 392b4d61b1d1dadc1f06444df258188a
SHA256 3a6316319ad822be021d48242dfece7f9b8668bae7d19db466b7d514eeae41af
MD5 d0880ec1ab1627d23202ee86d33b7356
SHA1 a8dae933bdf12ccdd8f1c763d3be932186fe8966
SHA512 1d833b5f77b8cbb66224effe69daaa78e2b3fcfd2bde89c6d3bced4dcef83687b1cbeacd22f0055003ed0935a3cc83972f5b16a1fc476a896beae7d620c50549
SSDEEP 12288:bVt+w8wyv/566WoJMOYeRqmyfq5M7I4XbDhyGdPiMbSLJj2xshdFSRO:ht+w5yJDJGeRMhjdudaKh
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

92864

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

cmd.pdb

msvcrt

__dllonexit _unlock _lock _initterm wcsspn _tell _except_handler4_common __setusermatherr __p__fmode _cexit _exit __set_app_type __getmainargs _amsg_exit __p__commode _XcptFilter calloc free _purecall __CxxFrameHandler3 ?terminate@@YAXXZ _wcslwr _controlfp _dup2 memcmp _local_unwind4 _dup ??1type_info@@UAE@XZ _close _open_osfhandle swscanf _ultoa _pipe memmove wcsncmp _setmode exit _getch iswspace wcschr iswxdigit _setjmp3 time srand _wtol fflush wcsstr iswalpha wcstoul ??3@YAXPAX@Z _errno ??_V@YAXPAX@Z printf memcpy_s _onexit fgets qsort rand _pclose fprintf wcsrchr ferror realloc towlower setlocale towupper _wcsupr feof _wpopen _wcsnicmp _get_osfhandle longjmp iswdigit wcstol _vsnwprintf _wcsicmp __iob_func malloc _callnewh ??0exception@@QAE@ABQBD@Z ??0exception@@QAE@ABQBDH@Z ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ?what@exception@@UBEPBDXZ _CxxThrowException memcpy memset

ntdll

NtOpenProcessToken NtQueryInformationToken NtClose NtOpenThreadToken NtFsControlFile RtlDosPathNameToNtPathName_U RtlFindLeastSignificantBit RtlFreeHeap RtlReleaseRelativeName NtOpenFile RtlDosPathNameToRelativeNtPathName_U_WithStatus NtSetInformationFile NtQueryVolumeInformationFile NtSetInformationProcess NtQueryInformationProcess RtlNtStatusToDosError NtCancelSynchronousIoFile RtlCreateUnicodeStringFromAsciiz RtlFreeUnicodeString

api-ms-win-core-kernel32-legacy-l1-1-0

GetConsoleWindow CopyFileW

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress GetModuleFileNameA LoadLibraryExW GetModuleHandleW GetModuleHandleExW GetModuleFileNameW

api-ms-win-core-synch-l1-1-0

WaitForSingleObject TryAcquireSRWLockExclusive CreateSemaphoreExW CreateMutexExW OpenSemaphoreW AcquireSRWLockShared ReleaseSRWLockShared InitializeCriticalSection EnterCriticalSection ReleaseSemaphore ReleaseSRWLockExclusive LeaveCriticalSection ReleaseMutex WaitForSingleObjectEx

api-ms-win-core-heap-l1-1-0

HeapAlloc HeapSetInformation HeapReAlloc GetProcessHeap HeapSize HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetLastError GetLastError SetErrorMode UnhandledExceptionFilter SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW GetCurrentThreadId CreateProcessW CreateProcessAsUserW UpdateProcThreadAttribute InitializeProcThreadAttributeList GetExitCodeProcess TerminateProcess GetCurrentProcessId GetCurrentProcess DeleteProcThreadAttributeList OpenThread ResumeThread

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW FormatMessageW SetThreadLocale GetACP GetThreadLocale GetUserDefaultLCID GetCPInfo

api-ms-win-core-debug-l1-1-0

OutputDebugStringW IsDebuggerPresent DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle

api-ms-win-core-memory-l1-1-0

VirtualFree VirtualAlloc VirtualQuery ReadProcessMemory

api-ms-win-core-console-l1-1-0

ReadConsoleW WriteConsoleW GetConsoleMode SetConsoleMode SetConsoleCtrlHandler GetConsoleOutputCP

api-ms-win-core-file-l1-1-0

ReadFile GetFileAttributesW GetFileSize SetFilePointer GetFullPathNameW GetVolumePathNameW CreateFileW WriteFile SetFilePointerEx FindFirstFileExW GetDiskFreeSpaceExW FileTimeToLocalFileTime CompareFileTime RemoveDirectoryW FindFirstFileW GetFileType FindNextFileW FindClose GetVolumeInformationW SetFileTime DeleteFileW SetEndOfFile SetFileAttributesW CreateDirectoryW GetDriveTypeW FlushFileBuffers GetFileAttributesExW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte MultiByteToWideChar

api-ms-win-core-processenvironment-l1-1-0

SetEnvironmentStringsW GetStdHandle SetEnvironmentVariableW GetCurrentDirectoryW FreeEnvironmentStringsW ExpandEnvironmentStringsW GetEnvironmentVariableW GetEnvironmentStringsW SetCurrentDirectoryW SearchPathW GetCommandLineW

api-ms-win-core-console-l2-1-0

SetConsoleTextAttribute GetConsoleScreenBufferInfo FillConsoleOutputAttribute FlushConsoleInputBuffer FillConsoleOutputCharacterW SetConsoleCursorPosition ScrollConsoleScreenBufferW

api-ms-win-security-base-l1-1-0

RevertToSelf GetSecurityDescriptorOwner GetFileSecurityW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetSystemTime GetTickCount SetLocalTime GetLocalTime GetVersion GetWindowsDirectoryW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime SystemTimeToFileTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW GetDateFormatW

api-ms-win-core-systemtopology-l1-1-0

GetNumaHighestNodeNumber GetNumaNodeProcessorMaskEx

api-ms-win-core-console-l2-2-0

SetConsoleTitleW GetConsoleTitleW

api-ms-win-core-processenvironment-l1-2-0

NeedCurrentDirectoryForExePathW

api-ms-win-core-registry-l1-1-0

RegSetValueExW RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegCloseKey RegDeleteValueW RegDeleteKeyExW RegEnumKeyExW

api-ms-win-core-file-l2-1-0

CreateSymbolicLinkW GetFileInformationByHandleEx MoveFileExW MoveFileWithProgressW CreateHardLinkW

api-ms-win-core-heap-l2-1-0

GlobalFree GlobalAlloc LocalFree

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize

api-ms-win-core-processtopology-l1-1-0

GetThreadGroupAffinity

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW lstrcmpiW

api-ms-win-core-processtopology-obsolete-l1-1-0

SetProcessAffinityMask

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Name

.text

Size

176KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

404KB

Virtual Size

996KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_d0880ec1ab1627d23202ee86d33b7356

msvcrt

ntdll

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-systemtopology-l1-1-0

api-ms-win-core-console-l2-2-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-processtopology-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-processtopology-obsolete-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

generic