7651b196711eb6ae4eb4fb4b325ddce6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

7651b196711eb6ae4eb4fb4b325ddce6_JaffaCakes118
Size

71KB
MD5

7651b196711eb6ae4eb4fb4b325ddce6
SHA1

0ae58ad7e4ddba80b04090526024a1bc8c6fd52f
SHA256

91e3d73b58199924070c3511273dcd88723e3feb02b05c43e23d070d28755c7f
SHA512

69445c70e785a47369adeb3fb9a91f2a9eb0b1950f3979d68d8865a11a499bc05a57eff10049d22c1f958007ed02004700602ccde8dacb1f3b979e77b6a52dfb
SSDEEP

1536:5Wl8iZMmLpn2neb4zQ5E+QL2Y+QyCdCNMaLAzqn1UxNgNm0XBrpc+ONUPyD:GLpnueb4N1ny5xAOINsBrpc+ONFD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7651b196711eb6ae4eb4fb4b325ddce6_JaffaCakes118

Files

7651b196711eb6ae4eb4fb4b325ddce6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2500e7ef9156d118949d33edddc80ce5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

vprintf
_heapchk
_mbscmp
??_E__non_rtti_object@@UAEPAXI@Z
??_7bad_cast@@6B@
_ismbbalpha
_acmdln
wprintf
ispunct
iswupper
_adj_fprem1
ldiv
_wcsicoll
?what@exception@@UBEPBDXZ
_atoldbl
$I10_OUTPUT
_fullpath
malloc
_kbhit
__set_app_type
__p__amblksiz
fclose
_tempnam
_adj_fdiv_m32
_getche
__lc_handle
_putws
is_wctype
__p___argv
__p__commode
__crtCompareStringA
log
wcslen
_ismbclower
_mbsrev
_seh_longjmp_unwind
_environ
_ismbbprint
??1__non_rtti_object@@UAE@XZ
__p__timezone
_wgetenv
tolower
atoi
wcsstr
_adj_fdiv_r
memcpy
pow
labs
_wcmdln
_fpieee_flt
_wcreat
_ftime
??4exception@@QAEAAV0@ABV0@@Z
_write
_beginthread
_getdiskfree
ldexp
_ultoa
__p__fmode
?_set_new_mode@@YAHH@Z
_winver
fgetc
??_7exception@@6B@
_putenv
_strnset
strcspn
_flsbuf
??_Gexception@@UAEPAXI@Z
strrchr
_ismbbalnum
_spawnlpe
__p__winver
_adj_fdiv_m32i
__toascii
strtod
_outpw
_utime
??4bad_cast@@QAEAAV0@ABV0@@Z
_adj_fptan
_eof
_i64tow
_j0
_adj_fdivr_m64
_read
bsearch
isspace
_execve
__p__pwctype
_mbstok
_adj_fdiv_m16i
_mbschr
?before@type_info@@QBEHABV1@@Z
getenv
_inpw

powrprof

IsPwrSuspendAllowed
GetCurrentPowerPolicies
LoadCurrentPwrScheme
ReadGlobalPwrPolicy
DeletePwrScheme
GetActivePwrScheme
ValidatePowerPolicies
IsPwrShutdownAllowed
MergeLegacyPwrScheme
CanUserWritePwrScheme
IsPwrHibernateAllowed
WritePwrScheme
ReadPwrScheme
SetSuspendState
GetPwrCapabilities
CallNtPowerInformation
SetActivePwrScheme
IsAdminOverrideActive
GetPwrDiskSpindownRange
WriteGlobalPwrPolicy
EnumPwrSchemes

msasn1

ASN1BEREncEndOfContents
ASN1BERDecZeroChar16String
ASN1uint32_uoctets
ASN1BERDecOpenType
ASN1objectidentifier2_cmp
ASN1utf8string_free
ASN1_CreateEncoder
ASN1_CloseDecoder
ASN1EncSetError
ASN1BEREncChar32String
ASN1BEREncOpenType
ASN1BERDecEndOfContents
ASN1CEREncNewBlkElement
ASN1CEREncMultibyteString
ASN1BERDecSXVal
ASN1BERDecTag
ASN1BERDecDouble
ASN1BERDecChar32String
ASN1BEREncObjectIdentifier2
ASN1intx_sub
ASN1utctime_cmp
ASN1intx_free
ASN1CEREncEndBlk
ASN1BERDecOctetString
ASN1BEREncRemoveZeroBits
ASN1CEREncBitString
ASN1BERDotVal2Eoid
ASN1BERDecBool
ASN1BEREncUTF8String
ASN1CEREncCharString
ASN1CEREncFlushBlkElement
ASN1char16string_free
ASN1CEREncChar32String
ASN1BEREncExplicitTag
ASN1BERDecZeroMultibyteString
ASN1BEREncBool
ASN1_CloseEncoder
ASN1BERDecNull
ASN1BEREncMultibyteString
ASN1BERDecExplicitTag
ASN1BERDecEoid
ASN1BERDecBitString
ASN1BEREoid_free
ASN1BERDecU8Val
ASN1BEREncZeroMultibyteString
ASN1BERDecU32Val
ASN1BERDecS8Val
ASN1BERDecMultibyteString
ASN1BERDecLength
ASN1_Encode
ASN1Free
ASN1char32string_cmp
ASN1BERDecS16Val
ASN1CEREncChar16String
ASN1BERDecBitString2
ASN1BERDecSkip
ASN1BERDecZeroChar32String
ASN1generalizedtime_cmp
ASN1_SetDecoderOption
ASN1_CreateDecoderEx
ASN1BERDecGeneralizedTime
ASN1BEREncObjectIdentifier
ASN1BERDecObjectIdentifier2

rasapi32

RasEditPhonebookEntryA
RasSetSharedAutoDial
RasGetAutodialEnableW
RasGetSubEntryHandleA
UnInitializeRAS
RasGetCredentialsW
RasGetSubEntryPropertiesA
RasSetAutodialParamA
RasAutoDialSharedConnection
RasGetErrorStringW
DwCloneEntry
RasEditPhonebookEntryW
RasGetCredentialsA
RasSetAutodialParamW
RasGetConnectionStatistics
RasGetConnectStatusW
RasGetEapUserDataW
RasSetOldPassword
RasGetEntryHrasconnW
RasValidateEntryNameA
RasSetEntryDialParamsA
RasGetCountryInfoW
RasGetSubEntryPropertiesW
RasHangUpA
RasRenameEntryA
RasClearLinkStatistics
RasGetAutodialAddressA
RasAutodialEntryToNetwork
RasSetAutodialEnableW
RasEnumAutodialAddressesW
RasFreeEapUserIdentityW
RasDialA
RasQueryRedialOnLinkFailure
RasSetEntryPropertiesA
RasGetEntryPropertiesW
RasQuerySharedAutoDial
RasEnumDevicesA
RasEnumDevicesW
RasIsSharedConnection
RasSetCustomAuthDataA
RasGetAutodialParamA
RasGetEntryDialParamsW
RasGetEntryDialParamsA
RasSetEntryDialParamsW
RasConnectionNotificationW
RasClearConnectionStatistics
RasQuerySharedConnection
RasAutodialAddressToNetwork
RasRenameEntryW
RasGetCountryInfoA
RasGetAutodialAddressW
RasGetAutodialEnableA
RasCreatePhonebookEntryW
RasEnumConnectionsW
DwEnumEntryDetails
RasEnumEntriesW
RasSetEapUserDataA
RasGetEntryPropertiesA
RasInvokeEapUI
RasGetEapUserIdentityA
RasSetSubEntryPropertiesA
RasDeleteEntryA
RasValidateEntryNameW
RasHangUpW
RasGetSubEntryHandleW
RasGetLinkStatistics
RasGetHport
RasEnumAutodialAddressesA
RasSetAutodialAddressW
RasGetEapUserIdentityW
RasSetCustomAuthDataW

adsldpc

LdapCrackUserDNtoNTLMUser2
ADsCloseSearchHandle
ADsGetObjectAttributes
ADsEnumAttributes
ADSIGetColumn
?GetNextToken@CLexer@@QAEJPAGPAK@Z
BuildADsPathFromLDAPPath2
ADsDeleteDSObject
ADsObject
ADsGetLastError
ADsExecuteSearch
ADsWriteAttributeDefinition
ADsGetPreviousRow
ADsSetLastError
ADsCreateDSObject
LdapGetSchemaObjectCount
ADsDecodeBinaryData
ADsGetFirstRow
LdapParsePageControl
ADsSetObjectAttributes
LdapModifyS
LdapGetNextPageS
SchemaGetPropertyInfo
ADsDeleteClassDefinition
ADSIExecuteSearch
?SetAtDisabler@CLexer@@QAEXH@Z
LdapNextAttribute
ADsCreateDSObjectExt
AdsTypeToLdapTypeCopyDNWithString
ADSIGetNextRow
ADsAbandonSearch
LdapMakeSchemaCacheObsolete
LdapDeleteExtS
AdsTypeFreeAdsObjects
SchemaOpen
InitObjectInfo
ADSISetSearchPreference
ADsFreeColumn
UnMarshallLDAPToLDAPSynID
ReadServerSupportsIsADControl
ADsWriteClassDefinition
ADSIFreeColumn
ConvertSidToU2Trustee
LdapcSetStickyServer
LdapGetValuesLen
BuildADsParentPathFromObjectInfo2
LdapValueFree
ADsDeleteAttributeDefinition
SchemaClose
AdsTypeToLdapTypeCopyConstruct
ADSIAbandonSearch
LdapTypeFreeLdapObjects
??1CLexer@@QAE@XZ
LdapFirstEntry
LdapSearchST
LdapSearchS
AdsTypeToLdapTypeCopyDNWithBinary
LdapTypeCopyConstruct
ADsCreateAttributeDefinition
ADsGetColumn
LdapRenameExtS
BuildADsParentPath
ADsGetNextRow
LdapParseResult
AdsTypeToLdapTypeCopyGeneralizedTime
BuildADsPathFromParent
ADSIGetNextColumnName
LdapOpenObject2
GetDefaultServer
LdapSearchInitPage
SchemaGetObjectCount
SortAndRemoveDuplicateOIDs
BuildADsParentPathFromObjectInfo
ConvertSidToString
BuildLDAPPathFromADsPath
LdapModifyExtS
LdapModDnS
ADSICloseDSObject
LdapTypeToAdsTypeCopyConstruct
GetDisplayName
LdapSearch
LdapGetSyntaxOfAttributeOnServer
GetLDAPTypeName
LdapCompareExt
ADSICreateDSObject
LdapGetValues
PathName
ADSIGetFirstRow
LdapGetDn
SchemaGetClassInfoByIndex
BerBvFree
FreeObjectInfo
ConvertU2TrusteeToSid
LdapAddS
ADSICloseSearchHandle
?SetExclaimnationDisabler@CLexer@@QAEXH@Z
ADSIGetPreviousRow
FreeADsStr
SchemaGetSyntaxOfAttribute
LdapGetSubSchemaSubEntryPath
ChangeSeparator
LdapAttributeFree
LdapReadAttributeFast
AllocADsMem
SchemaGetClassInfo
LdapTypeBinaryToString

kernel32

GetCompressedFileSizeA
lstrcmpW
GetConsoleTitleA
GetConsoleTitleW
CloseHandle
CreateFileA
GetACP
GetConsoleWindow
GetSystemTime
GetLocalTime
GetCurrentThreadId
ReadFile
GetStartupInfoW
WriteFile
GetCommandLineW
lstrcmpA
GetFileAttributesW
GetCurrentProcess
AddAtomA
GetCommandLineA
AddConsoleAliasW
GetFileAttributesA
GetCurrentThread
GetCompressedFileSizeW
GetModuleHandleA
lstrlenA
GetVersion
GetCurrentProcessId
VirtualFree
AddConsoleAliasA
VirtualAlloc
CopyFileA
lstrlenW

user32

GetForegroundWindow
DdeCreateStringHandleA
FindWindowW
RemoveMenu
GetSysColorBrush
SetMessageQueue
ImpersonateDdeClientWindow
MenuWindowProcA
GetMenu
CliImmSetHotKey
CreateWindowExA
GetDesktopWindow
CharToOemBuffA
SetWindowsHookW
IsChild
GetWindowTextW
PrivateExtractIconExA
RealGetWindowClassA
DdeAddData
GetProcessDefaultLayout
GetWindowTextLengthA
FindWindowA
EnumDisplaySettingsA
GetWindowTextA
CopyAcceleratorTableW
DefFrameProcW
InvertRect
GetClientRect
ScreenToClient
GetClipboardOwner
GetWindowRect
PrivateExtractIconsA

pngfilt

DllCanUnloadNow
DllGetClassObject

tapi32

lineSetStatusMessages
lineGetCountryA
lineDeallocateCall
lineGetQueueInfo
lineMakeCallA
lineGatherDigitsA
lineGetNumRings
phoneGetButtonInfo
lineAnswer
lineGetAgentGroupListA
phoneNegotiateExtVersion
lineGetCountry
TAPIWndProc
MMCGetPhoneInfo
tapiRequestMediaCallA
MMCGetAvailableProviders
phoneGetDisplay
lineGetConfRelatedCalls
lineSetCurrentLocation
lineProxyResponse
phoneNegotiateAPIVersion
lineSetAgentSessionState
lineSetAppSpecific
lineGetIDW
lineInitialize
lineCompleteCall
phoneGetLamp
lineSetTerminal
MMCGetLineInfo
tapiRequestDrop
lineOpen
lineCompleteTransfer
lineSwapHold
phoneSetVolume
lineGetLineDevStatusW
lineConfigDialogEditW
lineGetID
lineMakeCall
phoneInitializeExA
phoneGetDevCapsA
phoneGetIconA
lineNegotiateExtVersion
lineRedirect
phoneConfigDialogA
lineSetTollList
lineBlindTransfer
lineGetTranslateCaps
lineSetQueueMeasurementPeriod
lineForward
phoneGetStatusMessages
tapiGetLocationInfoW
phoneInitializeExW
lineAgentSpecific
tapiGetLocationInfo
lineGetAgentActivityListW
phoneGetStatusA
lineUnparkW
lineSetTollListA
MMCAddProvider
lineGetGroupListA
lineGetAppPriorityA
internalConfig
lineSetupConferenceW
lineSetCallData
phoneSetLamp
lineDrop
lineSetupConferenceA
lineGetDevCaps
lineGetIconA
lineGetNewCalls
phoneGetHookSwitch
lineHandoff
lineParkW
lineGetRequest
lineAddProviderW
lineSetAppPriorityA
lineSetAgentGroup
lineGetCallInfoW
lineSendUserUserInfo
lineAccept
lineGetAppPriorityW
lineGetDevConfigA
lineGetAgentCapsW
internalNewLocationW
lineTranslateDialog
phoneGetIDA
MMCGetServerConfig
lineSetCallQualityOfService
lineGetIDA
lineSetMediaControl
lineSetAgentMeasurementPeriod
phoneGetDevCapsW
lineMakeCallW
lineSetupTransfer
lineSetupConference
TUISPIDLLCallback
lineGetQueueListA
lineRemoveFromConference
lineSetupTransferW
lineAddToConference
lineGetAddressCapsW
MMCSetLineInfo
lineGetAddressIDA

rastls

RasEapGetInfo
RasEapInvokeConfigUI
RasEapGetIdentity
DllRegisterServer
DllUnregisterServer
DllGetClassObject
DllCanUnloadNow
RasEapFreeMemory
RasEapInvokeInteractiveUI

msvbvm60

__vbaBoolErrVar
__vbaVargParmRef
__vbaVarMul
rtcRightCharBstr
__vbaFreeVarList
__vbaExceptHandler
__vbaAryVarVarg
__vbaExitEachAry
rtcSqr
__vbaStrTextCmp
__vbaR8IntI4
__vbaOnGoCheck
__vbaStrCompVar
rtcEnvironBstr
__vbaVarTextTstLt
__vbaVarCat
__vbaVarTextLike
__vbaVarLateMemCallSt
__vbaGenerateBoundsError
__vbaAryConstruct
__vbaCyAbs
rtcCommandVar
ThunRTMain
__vbaCyAdd
__vbaStrI2
__vbaForEachCollAd
rtcGetDayOfMonth
rtcStrFromVar
rtcSetTimeBstr
__vbaI2I4
rtcIsObject
rtcVarBstrFromAnsi
__vbaLateIdCall
_CIcos
rtcSwitch
__vbaNameFile
SetMemNewObj
rtcEndOfFile
Zombie_GetIDsOfNames
__vbaLateIdNamedCall
DllUnregisterServer
__vbaStrCy
__vbaRecDestructAnsi
rtcDatePart
__vbaR4ErrVar
rtcIsNumeric
__vbaRecAssign
__vbaUnkVar
__vbaAryConstruct2
rtcFV
EbGetErrorInfo
rtcFreeFile
__vbaCyMul
rtcWeekdayName
_adj_fdivr_m16i
__vbaAryRebase1Var
__vbaFreeVar
rtI2FromErrVar
__vbaVarTstLt
EbResetProjectNormal
__vbaVarTextCmpLe

wmi

WmiCloseBlock
WmiDevInstToInstanceNameA
StartTraceA
RegisterTraceGuidsW
EnableTrace
WmiMofEnumerateResourcesW
WmiOpenBlock
ControlTraceW
TraceEvent
WmiSetSingleInstanceW
WmiDevInstToInstanceNameW
WmiFreeBuffer
ProcessTrace
RegisterTraceGuidsA
WmiExecuteMethodA
WmiNotificationRegistrationA
WmiMofEnumerateResourcesA
WmiNotificationRegistrationW
CloseTrace
WmiQueryGuidInformation
SetTraceCallback
WmiQueryAllDataW
WmiSetSingleItemA
QueryAllTracesW
WmiFileHandleToInstanceNameA
UnregisterTraceGuids
StartTraceW
GetTraceEnableLevel
WmiQueryAllDataA
ControlTraceA
TraceEventInstance
WmiQuerySingleInstanceA
WmiSetSingleInstanceA
WmiEnumerateGuids
RemoveTraceCallback
GetTraceLoggerHandle
OpenTraceW
WmiQuerySingleInstanceW
CreateTraceInstanceId
GetTraceEnableFlags
QueryAllTracesA
OpenTraceA
WmiFileHandleToInstanceNameW
WmiSetSingleItemW
WmiExecuteMethodW

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2500e7ef9156d118949d33edddc80ce5

Headers

File Characteristics

Imports

msvcrt

powrprof

msasn1

rasapi32

adsldpc

kernel32

user32

pngfilt

tapi32

rastls

msvbvm60

wmi

Sections

.text Size: 22KB - Virtual size: 21KB

.rdata Size: 31KB - Virtual size: 31KB

.data Size: 16KB - Virtual size: 16KB

.text
Size: 22KB - Virtual size: 21KB

.rdata
Size: 31KB - Virtual size: 31KB

.data
Size: 16KB - Virtual size: 16KB