f28516fc84a779c64fef706dfe8de4d8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f28516fc84a779c64fef706dfe8de4d8_JaffaCakes118
Size

86KB
MD5

f28516fc84a779c64fef706dfe8de4d8
SHA1

852e078a401ce1b32c2fb499da643318fe3c14c5
SHA256

4c57fedf369e54e8b78a8d206877515d25efdf7f746ebd5e6c7ba7dc65508838
SHA512

7d69d4f0215035573673c6e85e89552ec62b73aefe2fbee4740030e19e1d2093b03f8b04f1834c909419e86f7211d3f0417f1b3eebe62a2bb3eabf061c498ac1
SSDEEP

1536:nqy2WiuWIiTXCcZKp75hbmWOYS3n1sYhSf5sXVU9nMV29ixAzBaneVAPe9:nJiuWHXE5hbmWOYonBCBnY+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f28516fc84a779c64fef706dfe8de4d8_JaffaCakes118

Files

f28516fc84a779c64fef706dfe8de4d8_JaffaCakes118
.exe windows:5 windows x86 arch:x86

4e61c9c36e043099cdd20346174dfd2f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempFileNameW
LoadLibraryA
QueryPerformanceCounter
GetDriveTypeA
EnumUILanguagesW
GetCurrentProcessId
BindIoCompletionCallback
GetNamedPipeHandleStateA
GetTickCount
GetStartupInfoA
GetStringTypeExW
GetModuleHandleW
FindFirstVolumeMountPointW
VirtualAlloc
SetConsoleActiveScreenBuffer
GetSystemTimeAsFileTime
GetCurrentThreadId
InterlockedDecrement
SetEndOfFile
WriteProcessMemory
_lclose
DuplicateHandle

msasn1

ASN1_CloseEncoder2
ASN1BERDecObjectIdentifier
ASN1_CreateEncoder
ASN1BEREncObjectIdentifier
ASN1BERDecBitString2
ASN1BERDecMultibyteString
ASN1BERDecOpenType2
ASN1BERDecNotEndOfContents
ASN1BERDecSXVal
ASN1_GetEncoderOption
ASN1octetstring_cmp
ASN1BERDecFlush
ASN1_CloseEncoder
ASN1BERDecUTF8String
ASN1CEREncOctetString
ASN1_CloseDecoder
ASN1BEREncOctetString
ASN1BEREncRemoveZeroBits

msvcrt20

_j0
is_wctype
_atoldbl
_mbbtombc
?osfx@ostream@@QAEXXZ
_tcsncpy
_wfindnext
??_Gofstream@@UAEPAXI@Z
_wunlink
_mbsncoll
?xsgetn@streambuf@@UAEHPADH@Z
_ismbcalpha
__CxxLongjmpUnwind
??_Distream@@QAEXXZ
__p__mbctype
??6ostream@@QAEAAV0@G@Z
?put@ostream@@QAEAAV1@D@Z
_cgets

adsldpc

LdapModifyS
LdapGetSyntaxOfAttributeOnServer
ADSIGetObjectAttributes
LdapSearchExtS
LdapMsgFree
LdapControlFree
SchemaClose
BuildADsParentPathFromObjectInfo2
ADsCreateAttributeDefinition
FreeObjectInfo
ADSIGetNextRow
InitObjectInfo
ADsFreeColumn
ADSIExecuteSearch
LdapCompareExt
ADSIModifyRdn
ADsGetFirstRow
SchemaGetPropertyInfo

rtm

RtmRegisterForChangeNotification
RtmGetChangedDests
RtmReleaseNextHops
RtmDeregisterClient
RtmGetNetworkCount
RtmIsBestRoute
RtmReleaseRouteInfo
MgmGetMfe
RtmRegisterEntity
RtmGetMostSpecificDestination
RtmGetRegisteredEntities
RtmWriteAddressFamilyConfig
RtmLookupIPDestination

ifsutil

?CheckAndAdd@SPARSE_SET@@QAEEVBIG_INT@@PAE@Z
??0NUMBER_SET@@QAE@XZ
??0INTSTACK@@QAE@XZ
??0READ_WRITE_CACHE@@QAE@XZ
?Initialize@SECRUN@@QAEEPAVMEM@@PAVIO_DP_DRIVE@@VBIG_INT@@K@Z
?AddStart@NUMBER_SET@@QAEEVBIG_INT@@@Z
?Add@NUMBER_SET@@QAEEPBV1@@Z
?QueryParents@DIGRAPH@@QBEEKPAVNUMBER_SET@@@Z
??1DIGRAPH@@UAE@XZ
?QueryDriveName@MOUNT_POINT_MAP@@QAEEPAVWSTRING@@0@Z
?DosDriveNameToNtDriveName@IFS_SYSTEM@@SGEPBVWSTRING@@PAV2@@Z
??1LOG_IO_DP_DRIVE@@UAE@XZ
??0SPARSE_SET@@QAE@XZ
?QueryNumber@NUMBER_SET@@QBE?AVBIG_INT@@V2@@Z
?Initialize@DP_DRIVE@@QAEEPBVWSTRING@@0PAVMESSAGE@@EE@Z
?Verify@IO_DP_DRIVE@@QAEEVBIG_INT@@0PAVNUMBER_SET@@@Z
?IsEntryPresent@AUTOREG@@SGEPBVWSTRING@@@Z
?Pop@INTSTACK@@QAEXK@Z

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4e61c9c36e043099cdd20346174dfd2f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msasn1

msvcrt20

adsldpc

rtm

ifsutil

Sections

.text Size: 32KB - Virtual size: 31KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 17KB - Virtual size: 56KB

.rsrc Size: 21KB - Virtual size: 21KB

.reloc Size: 512B - Virtual size: 256B

.text
Size: 32KB - Virtual size: 31KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 17KB - Virtual size: 56KB

.rsrc
Size: 21KB - Virtual size: 21KB

.reloc
Size: 512B - Virtual size: 256B