116b99f50673308d47cdaaa4e1185b01_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
116b99f50673308d47cdaaa4e1185b01_JaffaCakes118
Size 988KB
Sample240504-eg85eafe82
SHA256 3b659f63362a64bf58e398ed187d8a3862055e930c7e243a1e7b2b66863f20b1
MD5 116b99f50673308d47cdaaa4e1185b01
SHA1 39df788759fb7de6841eccbf20d7853d5499b549
SHA512 eb5beea2aa0830333d9ab61fe26ee07acaacca311baa554ddb462a2cae44d0525e76b8123c46d32d8044e15b2e6b15a7e2cc53402565b79529c185621140b676
SSDEEP 24576:+VHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:+V8hf6STw1ZlQauvzSq01ICe6zvm
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
116b99f50673308d47cdaaa4e1185b01_JaffaCakes118

File Explorer

116b99f50673308d47cdaaa4e1185b01_JaffaCakes118

.dll 988KB

116b99f50673308d47cdaaa4e1185b01_JaffaCakes118

IMPHASH a23d507241571c69f1f380438b3a251c
SHA256 3b659f63362a64bf58e398ed187d8a3862055e930c7e243a1e7b2b66863f20b1
MD5 116b99f50673308d47cdaaa4e1185b01
SHA1 39df788759fb7de6841eccbf20d7853d5499b549
SHA512 eb5beea2aa0830333d9ab61fe26ee07acaacca311baa554ddb462a2cae44d0525e76b8123c46d32d8044e15b2e6b15a7e2cc53402565b79529c185621140b676
SSDEEP 24576:+VHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:+V8hf6STw1ZlQauvzSq01ICe6zvm
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

936224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

dpamnlrd.pdb

AcceptSecurityContext AcquireCredentialsHandleA AcquireCredentialsHandleW AddCredentialsA AddCredentialsW AddSecurityPackageA AddSecurityPackageW ApplyControlToken ChangeAccountPasswordA ChangeAccountPasswordW CloseLsaPerformanceData CollectLsaPerformanceData CompleteAuthToken CredMarshalTargetInfo CredParseUserNameWithType CredUnmarshalTargetInfo DecryptMessage DeleteSecurityContext DeleteSecurityPackageA DeleteSecurityPackageW EncryptMessage EnumerateSecurityPackagesA EnumerateSecurityPackagesW ExportSecurityContext FreeContextBuffer FreeCredentialsHandle GetComputerObjectNameA GetComputerObjectNameW GetSecurityUserInfo GetUserNameExA GetUserNameExW ImpersonateSecurityContext ImportSecurityContextA ImportSecurityContextW InitSecurityInterfaceA InitSecurityInterfaceW InitializeSecurityContextA InitializeSecurityContextW LsaCallAuthenticationPackage LsaConnectUntrusted LsaDeregisterLogonProcess LsaEnumerateLogonSessions LsaFreeReturnBuffer LsaGetLogonSessionData LsaLogonUser LsaLookupAuthenticationPackage LsaRegisterLogonProcess LsaRegisterPolicyChangeNotification LsaUnregisterPolicyChangeNotification MakeSignature OpenLsaPerformanceData QueryContextAttributesA QueryContextAttributesW QueryCredentialsAttributesA QueryCredentialsAttributesW QuerySecurityContextToken QuerySecurityPackageInfoA QuerySecurityPackageInfoW RevertSecurityContext SaslAcceptSecurityContext SaslEnumerateProfilesA SaslEnumerateProfilesW SaslGetContextOption SaslGetProfilePackageA SaslGetProfilePackageW SaslIdentifyPackageA SaslIdentifyPackageW SaslInitializeSecurityContextA SaslInitializeSecurityContextW SaslSetContextOption SealMessage SeciAllocateAndSetCallFlags SeciAllocateAndSetIPAddress SeciFreeCallContext SecpFreeMemory SecpTranslateName SecpTranslateNameEx SetContextAttributesA SetContextAttributesW SetCredentialsAttributesA SetCredentialsAttributesW SspiCompareAuthIdentities SspiCopyAuthIdentity SspiDecryptAuthIdentity SspiEncodeAuthIdentityAsStrings SspiEncodeStringsAsAuthIdentity SspiEncryptAuthIdentity SspiExcludePackage SspiFreeAuthIdentity SspiGetTargetHostName SspiIsAuthIdentityEncrypted SspiLocalFree SspiMarshalAuthIdentity SspiPrepareForCredRead SspiPrepareForCredWrite SspiUnmarshalAuthIdentity SspiValidateAuthIdentity SspiZeroAuthIdentity TranslateNameA TranslateNameW UnsealMessage VerifySignature

Name

.text

Size

912KB

Virtual Size

911KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

324B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

976B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

360B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

318B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=241, id=145, productName=VS2008 SP1 build 30729, version=30729,

count=416, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=380, id=223, productName=VS2013 UPD2 build 30501, version=30501,

count=267, id=221, productName=VS2013 UPD3 build 30723, version=30723,

id=256, productName=VS2015 UPD2 build 23918, version=23918,

count=364, id=131, productName=VS2008 build 21022, version=21022,

count=419, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=123, id=257, productName=VS2015 UPD1 build 23506, version=23506,

count=260, id=203, productName=VS2012 build 50727, version=50727,

count=158, id=123, productName=VS2005 build 50727, version=50727,

count=452, id=203, productName=VS2012 UPD4 build 61030, version=61030,

count=201, id=223, productName=VS2013 UPD2 build 30501, version=30501,

count=433, id=202, productName=VS2012 UPD3 build 60610, version=60610,

count=136, id=202, productName=VS2012 UPD3 build 60610, version=60610,

count=121, id=202, productName=VS2012 UPD4 build 61030, version=61030,

116b99f50673308d47cdaaa4e1185b01_JaffaCakes118

comdlg32

advapi32

user32

kernel32

gdi32

generic