fe101e6f3bd80d19363a66ee1b67c864_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fe101e6f3bd80d19363a66ee1b67c864_JaffaCakes118
Size

40KB
MD5

fe101e6f3bd80d19363a66ee1b67c864
SHA1

f44e5fa8a688b696dfab8ce66d58040a9e8f60dc
SHA256

2e9d98ed27d45d97de9946151a58491d10a1677a38ef0dad714c550e839e819f
SHA512

138ef7ec2a12ff0fcc21f4ee18bbf5acd78ad70bbabc7ff48f944dd0ed97a400102b4ac0bfdb9e2730a21f1e60c9e00d71017f2289d1c16e388bc80b461f13a9
SSDEEP

768:xGLnvs2Jm3YKaOMYhDrTFZGnyOjoinKBgE7wTvCV/wNQFd8BVx:sLEam3YKaOfDrT6ny6K+TvCiNudS/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fe101e6f3bd80d19363a66ee1b67c864_JaffaCakes118

Files

fe101e6f3bd80d19363a66ee1b67c864_JaffaCakes118
.exe windows:4 windows x86 arch:x86

490c9c5359acb580be289e9d71af083d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

FreeSid
IsValidSid
LsaOpenPolicy
GetSidSubAuthority
SystemFunction040
InitializeSecurityDescriptor
LsaQueryTrustedDomainInfoByName
GetSidSubAuthorityCount
CryptAcquireContextW
LsaSetForestTrustInformation
ImpersonateAnonymousToken
QueryServiceStatus
GetExplicitEntriesFromAclW
LsaClose
BuildTrusteeWithObjectsAndSidW
GetLengthSid
RegCreateKeyExW
RegQueryValueExW
AllocateAndInitializeSid
SetNamedSecurityInfoW
GetSidLengthRequired
LsaQueryForestTrustInformation
GetSecurityDescriptorDacl
LsaCreateTrustedDomainEx
LsaRetrievePrivateData
LsaOpenTrustedDomainByName
RegOpenKeyExW
LsaFreeMemory
GetSecurityDescriptorControl
LsaOpenTrustedDomain
SystemFunction041
GetSecurityDescriptorLength
OpenSCManagerW
EqualPrefixSid
EqualSid
RegDeleteKeyW
InitializeAcl
LogonUserW
CryptReleaseContext
BuildTrusteeWithSidW
GetNamedSecurityInfoW
CloseServiceHandle
LsaNtStatusToWinError
LsaDelete
SetEntriesInAclW
OpenServiceW
RegCloseKey
MakeSelfRelativeSD
LsaLookupSids
GetSidIdentifierAuthority
RegSetValueExW
CryptGenRandom
ImpersonateLoggedOnUser
LsaQueryTrustedDomainInfo
RevertToSelf
LsaSetTrustedDomainInfoByName
LsaQueryInformationPolicy

user32

FrameRect
LoadCursorW
DialogBoxParamW
MessageBeep
MoveWindow
SetDlgItemTextW
SetScrollPos
SetWindowLongW
ScrollWindow
DefWindowProcW
IsDlgButtonChecked
SendMessageW
CreateWindowExW
ScreenToClient
LoadStringW
MessageBoxW
GetDlgItemTextW
EnableWindow
GetSysColor
GetWindowLongW
DestroyIcon
DrawIcon
GetScrollInfo
IsWindowEnabled
GetParent
MessageBoxA
SetScrollRange
GetDlgItem
CheckRadioButton
FindWindowExW
GetSystemMetrics
ShowWindow
RegisterWindowMessageW
MapWindowPoints
GetDC
DrawFocusRect
GetClientRect
GetWindowTextW
MapDialogRect
SetForegroundWindow
SystemParametersInfoW
GetWindow
OffsetRect
GetWindowThreadProcessId
GetDesktopWindow
BeginPaint
SendDlgItemMessageW
SetWindowTextW
DestroyWindow
GetWindowTextLengthW
LoadBitmapW
IsWindow
SetCursor
ReleaseDC
GetDlgCtrlID
SetWindowPos
GetSysColorBrush
EndDialog
UpdateWindow
PostMessageW
SetScrollInfo
SetWindowContextHelpId
WinHelpW
EndPaint
GetWindowRect
InflateRect
SetFocus
RegisterClipboardFormatW
CallWindowProcW
LoadIconW
CheckDlgButton
wsprintfW
RegisterClassW

cabview

DllGetClassObject

dsprop

ADsPropGetInitInfo
ADsPropCreateNotifyObj
FindSheet
ADsPropShowErrorDialog
ADsPropSetHwndWithTitle
ADsPropSetHwnd
ADsPropSendErrorMessage

ntdll

NtQuerySystemTime
RtlSubAuthoritySid
RtlInitUnicodeString
RtlSubAuthorityCountSid
RtlNtStatusToDosError
RtlIdentifierAuthoritySid

credui

CredUIInitControls
CredUIParseUserNameW

cmdial32

AutoDialFunc

netapi32

NetpParmsSetUserProperty
DsMergeForestTrustInformationW
DsGetForestTrustInformationW
NetpNtStatusToApiStatus
I_NetPathType
NetApiBufferFree
NetUserModalsGet
DsGetDcNameW
DsEnumerateDomainTrustsW
NetpParmsQueryUserProperty
I_NetLogonControl2
NetpParmsUserPropertyFree

shell32

SHGetFolderPathW

shlwapi

PathAppendW
PathIsUNCServerShareW

clb

ClbAddData

ole32

CoGetInterfaceAndReleaseStream
StringFromCLSID
CoMarshalInterThreadInterfaceInStream
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
ReleaseStgMedium
StringFromIID

crypt32

CertOpenStore
CertGetNameStringW
CertDuplicateCertificateContext
CertFindCertificateInStore
CertAddCertificateContextToStore
CryptDecodeObject
CertControlStore
CryptFindOIDInfo
CertEnumSystemStore
CertFreeCertificateContext
CertDuplicateStore
CertSaveStore
CertDeleteCertificateFromStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CryptQueryObject
CertCloseStore
CertGetCertificateContextProperty

cryptui

CryptUIDlgViewCertificateW
CryptUIDlgSelectCertificateW

kernel32

CloseHandle
FreeLibrary
GetSystemTimeAsFileTime
OpenThread
WideCharToMultiByte
MultiByteToWideChar
SetLastError
GetDateFormatW
SystemTimeToTzSpecificLocalTime
UnhandledExceptionFilter
lstrcmpW
QueryPerformanceCounter
GetLastError
GetFileSize
GetTickCount
GetTimeFormatW
LoadLibraryExW
lstrcmpiW
GetCurrentProcessId
ReadFile
InterlockedDecrement
GetProcAddress
DisableThreadLibraryCalls
GetCurrentThreadId
GlobalUnlock
GetModuleHandleW
lstrlenW
IsBadReadPtr
FileTimeToSystemTime
IsBadWritePtr
TerminateProcess
SystemTimeToFileTime
GetSystemDirectoryW
VirtualAlloc
FormatMessageW
GetSystemTime
InterlockedIncrement
lstrlenA
DnsHostnameToComputerNameW
GlobalAlloc
SetUnhandledExceptionFilter
Sleep
lstrcpynW
TzSpecificLocalTimeToSystemTime
FileTimeToLocalFileTime
LocalFree
GetCurrentProcess
GetWindowsDirectoryW
LoadLibraryW
WriteFile
GetModuleFileNameW
CreateFileW
LocalAlloc
GlobalLock
CreateDirectoryW

gdi32

CreateFontIndirectW
GetDeviceCaps
GetTextExtentPoint32W
SetTextColor
CreatePatternBrush
DeleteObject
CreateBitmap
SetBkColor

msvcrt

_wcsnicmp
swscanf
malloc
wcschr
isdigit
wcstok
wcsncpy
_purecall
_wtoi
_wtol
wcspbrk
wcsrchr
_onexit
iswspace
iswdigit
__dllonexit
printf
wcscpy
swprintf
strchr
__CxxFrameHandler
vswprintf
isalnum
srand
_vsnwprintf
mbstowcs
_except_handler3
rand
wcscmp
wcstoul
_adjust_fdiv
wcslen
wcscat
_wcsicmp
iswxdigit
_wcsupr
memmove
wcsncat
_initterm
wcsstr
time
free

dnsapi

DnsNameCompareEx_W

ntdsapi

DsBindW
DsCrackNamesW
DsFreeNameResultW
DsCrackSpn3W
DsIsMangledDnW
DsUnBindW

Sections

.text
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

490c9c5359acb580be289e9d71af083d

Headers

File Characteristics

Imports

advapi32

user32

cabview

dsprop

ntdll

credui

cmdial32

netapi32

shell32

shlwapi

clb

ole32

crypt32

cryptui

kernel32

gdi32

msvcrt

dnsapi

ntdsapi

Sections

.text Size: 512B - Virtual size: 420B

.rsrc Size: 21KB - Virtual size: 20KB

.idata Size: 9KB - Virtual size: 9KB

.data Size: - Virtual size: 160KB

.rdata Size: 8KB - Virtual size: 7KB

.text
Size: 512B - Virtual size: 420B

.rsrc
Size: 21KB - Virtual size: 20KB

.idata
Size: 9KB - Virtual size: 9KB

.data
Size: - Virtual size: 160KB

.rdata
Size: 8KB - Virtual size: 7KB