089204eee8ae33f0301b90c43c55aef4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

089204eee8ae33f0301b90c43c55aef4_JaffaCakes118
Size

2.4MB
MD5

089204eee8ae33f0301b90c43c55aef4
SHA1

df37b6f63cc195201236bda15abbc1dd992a42fe
SHA256

cd75848fd2d7348e373f05228935424fb82e5c0ce5ef3d506211c80d576b91a4
SHA512

68d2d06afa9e34853f1856d479978462f12a44f857d7b3c0c3a01cf834677ec03d2052e4dc6d2c0f77cb893628301550b219a6131b96b678d91ad9380633de50
SSDEEP

49152:db5TCWjlZMVQSz6FsoaT9oLtXesDUIx6SXglgydfIIluPod:dxCoPQQSmFZaBItxUGs/aIAPod

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
089204eee8ae33f0301b90c43c55aef4_JaffaCakes118

Files

089204eee8ae33f0301b90c43c55aef4_JaffaCakes118
.exe windows:5 windows x86 arch:x86

060710b22a61d83fd32971a6b2d4c6ff

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

winscard.pdb

Imports

msvcrt

wcsrchr
time
_except_handler3
memmove
wcschr
_c_exit
_exit
_XcptFilter
_cexit
_wcsicmp
exit
__initenv
__getmainargs
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
wcslen
wcsncmp
_wtol
wcscpy
_itow
_wcsnicmp
wcscat
_initterm
wcsncpy
wcscspn
_ultow

advapi32

RegOpenKeyW
ConvertSidToStringSidW
LsaStorePrivateData
LsaLookupNames
LsaQueryInformationPolicy
OpenThreadToken
RegNotifyChangeKeyValue
InitializeSecurityDescriptor
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus
SystemFunction029
SystemFunction005
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
SetSecurityDescriptorOwner
GetSecurityDescriptorDacl
GetLengthSid
CopySid
InitializeAcl
AddAce
SetSecurityDescriptorDacl
LsaOpenPolicy
LsaLookupSids
LsaFreeMemory
LsaClose
ImpersonateLoggedOnUser
CreateProcessAsUserW
GetTokenInformation
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
InitiateSystemShutdownW
RevertToSelf

kernel32

TerminateProcess
SetProcessShutdownParameters
lstrcmpiW
FormatMessageW
ExitThread
ReleaseMutex
DelayLoadFailureHook
RaiseException
GetExitCodeThread
SetErrorMode
SetUnhandledExceptionFilter
LoadLibraryA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcess
UnhandledExceptionFilter
GetModuleHandleA
CreateMutexW
LocalAlloc
LocalFree
Sleep
LeaveCriticalSection
EnterCriticalSection
SetLastError
CloseHandle
CreateThread
GetLastError
CreateProcessW
ExpandEnvironmentStringsW
InitializeCriticalSection
HeapAlloc
HeapFree
SetConsoleCtrlHandler
WaitForSingleObject
HeapCreate
FreeLibrary
GetProcAddress
InterlockedCompareExchange
CreateNamedPipeW
ReadFile
CancelIo
GetOverlappedResult
WaitForMultipleObjects
ConnectNamedPipe
TransactNamedPipe
WriteFile
GetTickCount
GetSystemTimeAsFileTime
GetModuleHandleW
GetComputerNameW
CreateEventW
SetEvent
ResetEvent
DeviceIoControl
CreateFileW
ResumeThread
GetCurrentProcessId
LoadLibraryW
GetDriveTypeW
OpenEventW
GetCurrentThread

user32

wsprintfW
BroadcastSystemMessageW
MessageBoxW
LoadStringW
RegisterServicesProcess

rpcrt4

RpcServerRegisterAuthInfoW
RpcBindingFree
RpcEpResolveBinding
RpcBindingFromStringBindingW
RpcStringBindingComposeW
NdrClientCall2
RpcAsyncCompleteCall
RpcAsyncInitializeHandle
NdrAsyncServerCall
NdrAsyncClientCall
RpcMgmtStopServerListening
RpcMgmtWaitServerListen
NdrServerCall2
I_RpcBindingIsClientLocal
RpcRevertToSelf
I_RpcMapWin32Status
RpcImpersonateClient
RpcStringBindingParseW
RpcStringFreeW
RpcBindingToStringBindingW
RpcServerRegisterIfEx
RpcServerUseProtseqEpW
RpcServerRegisterIf
RpcServerListen
RpcServerUnregisterIf

ntdll

RtlCreateAcl
NtCreateKey
NtQueryValueKey
NtSetValueKey
NtDeleteValueKey
NtEnumerateKey
NtQuerySecurityObject
RtlFreeHeap
NtOpenKey
NtDeleteKey
RtlSetControlSecurityDescriptor
RtlValidSecurityDescriptor
RtlLengthSecurityDescriptor
NtPrivilegeObjectAuditAlarm
NtPrivilegeCheck
NtOpenThreadToken
NtAccessCheckAndAuditAlarm
NtSetInformationThread
NtAdjustPrivilegesToken
NtDuplicateToken
NtOpenProcessToken
NtQueryInformationToken
RtlQuerySecurityObject
RtlAddAccessAllowedAce
RtlValidRelativeSecurityDescriptor
RtlMapGenericMask
RtlCopyUnicodeString
NtSetInformationFile
NtQueryInformationFile
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
NtWaitForSingleObject
NtQueryDirectoryFile
NtDeleteFile
NtSetInformationProcess
NtSetEvent
RtlGetAce
RtlQueryInformationAcl
RtlGetDaclSecurityDescriptor
RtlAllocateHeap
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlConvertSharedToExclusive
RtlConvertExclusiveToShared
RtlRegisterWait
RtlGetNtProductType
RtlEqualUnicodeString
RtlLengthSid
RtlCopySid
RtlUnicodeStringToAnsiString
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlNewSecurityObject
RtlAddAce
RtlSetOwnerSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetSaclSecurityDescriptor
RtlSubAuthorityCountSid
NtOpenDirectoryObject
NtQueryDirectoryObject
RtlCompareUnicodeString
NtLoadDriver
NtUnloadDriver
RtlExpandEnvironmentStrings_U
RtlAdjustPrivilege
NtFlushKey
NtOpenFile
RtlDosPathNameToNtPathName_U
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
RtlFreeUnicodeString
RtlAreAllAccessesGranted
NtDeleteObjectAuditAlarm
NtCloseObjectAuditAlarm
RtlQueueWorkItem
RtlCopyLuid
RtlDeregisterWait
RtlReleaseResource
RtlAcquireResourceExclusive
RtlAcquireResourceShared
RtlInitializeResource
RtlDeleteSecurityObject
NtInitializeRegistry
NtQueryKey
NtClose
RtlInitUnicodeString
NtSetSystemEnvironmentValue
RtlNtStatusToDosError
NtShutdownSystem
RtlSetSecurityObject
RtlMakeSelfRelativeSD
RtlInitializeSid
RtlLengthRequiredSid
RtlSubAuthoritySid
NtSetSecurityObject

userenv

UnloadUserProfile
CreateEnvironmentBlock
LoadUserProfileW
DestroyEnvironmentBlock

scesrv

ScesrvInitializeServer
ScesrvTerminateServer

Sections

.text
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2.2MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

060710b22a61d83fd32971a6b2d4c6ff

Headers

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

user32

rpcrt4

ntdll

userenv

scesrv

Sections

.text Size: 84KB - Virtual size: 84KB

.data Size: 2.2MB - Virtual size: 4.5MB

.rsrc Size: 34KB - Virtual size: 33KB

.reloc Size: 19KB - Virtual size: 19KB

.text
Size: 84KB - Virtual size: 84KB

.data
Size: 2.2MB - Virtual size: 4.5MB

.rsrc
Size: 34KB - Virtual size: 33KB

.reloc
Size: 19KB - Virtual size: 19KB