21dfbf11c6fb2f4b80719bdf3c277f59_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

21dfbf11c6fb2f4b80719bdf3c277f59_JaffaCakes118
Size

135KB
MD5

21dfbf11c6fb2f4b80719bdf3c277f59
SHA1

002e4a17a6a6f06669cfe0414a8fa3abeaf37825
SHA256

50b9c0625a90322cfc9a135eb500749b939af8f27df294f3f0c224e43d2d2c3d
SHA512

5dc464789a999c23e57c35866c134138f5f99975ec935f6fd4a4bb7d283037cee2f38151fb15d074bc1387f9ce860c6ae0a94fa543945c7340f1af68e120be76
SSDEEP

3072:MQcZKTdaGb5zmYIUTh8E47IyLIMfGVuYpyoij:JcZKTdamzmtUP4MYfGfij

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
21dfbf11c6fb2f4b80719bdf3c277f59_JaffaCakes118

Files

21dfbf11c6fb2f4b80719bdf3c277f59_JaffaCakes118
.exe windows:5 windows x86 arch:x86

d433a4970d91448564f78a87480c751f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

??2@YAPAXI@Z
exit
_vsnwprintf
wcslen
_wcsrev
__p___initenv
_exit
_XcptFilter
__setusermatherr
__getmainargs
_initterm
__p__fmode
_adjust_fdiv
__p__commode
_controlfp
__set_app_type
_except_handler3
_ultow
_purecall
_wcsnicmp
_wtol
wcsspn
_vsnprintf
wcsncpy
wcsrchr
_wcsicmp
rand
wcschr
memmove
wcspbrk
_itow
??3@YAXPAX@Z

advapi32

RegDeleteValueW
RegConnectRegistryW
RegEnumKeyExW
RegOpenKeyExA
DuplicateToken
GetSecurityDescriptorDacl
InitializeAcl
AddAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCreateKeyExW
ConvertSidToStringSidW
GetUserNameW
LookupAccountSidW
LsaStorePrivateData
LsaRetrievePrivateData
GetKernelObjectSecurity
AllocateAndInitializeSid
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptGenKey
CryptAcquireContextW
RegOpenKeyExW
RegQueryValueExW
SetFileSecurityW
RegSetValueExW
RegCloseKey
RegisterEventSourceW
DeregisterEventSource
GetSidSubAuthority
GetSidSubAuthorityCount
IsValidSid
GetSecurityDescriptorOwner
GetFileSecurityW
OpenProcessToken
CopySid
GetTokenInformation
ReportEventW
CryptDestroyKey
LookupAccountNameW
FreeSid
ImpersonateLoggedOnUser
RevertToSelf
LogonUserW
CreateProcessAsUserW
GetSidIdentifierAuthority
CryptGetHashParam
CryptReleaseContext
OpenThreadToken
LsaClose
CryptHashData
LsaFreeMemory
LsaQueryInformationPolicy
GetLengthSid
CryptCreateHash
CryptSignHashW
CryptDestroyHash
LsaOpenPolicy
LsaAddAccountRights

kernel32

CreateMutexW
OpenEventW
LocalFree
CloseHandle
ReleaseMutex
InterlockedExchange
GetSystemPowerStatus
SetEvent
DeleteAtom
GetModuleHandleW
SetConsoleCtrlHandler
CreateEventW
CreateThread
WaitForMultipleObjects
WaitForSingleObject
lstrcmpiA
GetLastError
SystemTimeToFileTime
GetCurrentProcess
GetFileInformationByHandle
FormatMessageW
GetVersion
GetLocalTime
GetSystemTime
SetFileAttributesW
lstrcpynW
GetFileSize
DeleteFileW
GetFileType
EnterCriticalSection
GetStartupInfoW
SetLastError
GetEnvironmentVariableW
GetFullPathNameW
GetComputerNameExW
GetDriveTypeW
LoadLibraryExW
CreateDirectoryW
FormatMessageA
GetLocaleInfoW
IsBadWritePtr
MultiByteToWideChar
GetUserDefaultLCID
TlsGetValue
TlsSetValue
GetVersionExW
GetVolumeInformationW
GetSystemTimeAsFileTime
FindNextChangeNotification
CreateProcessW
SetEnvironmentVariableW
SearchPathW
GetExitCodeProcess
TerminateProcess
GetTickCount
InterlockedIncrement
InterlockedDecrement
SetThreadPriority
lstrcmpiW
GetCurrentThread
GetComputerNameW
FreeLibrary
LocalReAlloc
LoadLibraryW
WriteFile
ReadFile
SetFilePointer
CreateFileW
GetFileAttributesW
ExpandEnvironmentStringsW
InitializeCriticalSection
LeaveCriticalSection
SetCurrentDirectoryW
ResetEvent
FindFirstFileW
lstrlenW
LocalAlloc
SetEndOfFile
GetTimeFormatW
GetDateFormatW
TlsFree
FileTimeToLocalFileTime
DeleteCriticalSection
TlsAlloc
CompareFileTime
FindClose
FindNextFileW
FindFirstChangeNotificationW
OpenProcess
FileTimeToSystemTime
GetProcAddress
LocalFileTimeToFileTime
GetCurrentDirectoryW
CreateWaitableTimerW
FindCloseChangeNotification
CancelWaitableTimer
SetWaitableTimer
Sleep

gdi32

GetStockObject

user32

DefWindowProcW
PostQuitMessage
DestroyWindow
CloseDesktop
RegisterWindowMessageW
LoadCursorW
RegisterClassW
CreateWindowExW
ShowWindow
SetUserObjectSecurity
CreateDesktopW
CreateWindowStationW
MessageBoxW
CloseWindowStation
SetProcessWindowStation
GetWindowThreadProcessId
TranslateMessage
EnumThreadWindows
SendMessageW
EnumWindows
LoadStringA
MessageBoxA
PostMessageW
LoadStringW
UpdateWindow
GetMessageW
DispatchMessageW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

netapi32

NetApiBufferFree
NetUserGetInfo
DsGetDcNameW

secur32

GetUserNameExW

ntdsapi

DsCrackNamesW
DsUnBindW
DsFreeNameResultW
DsBindW

shlwapi

PathFindExtensionW

shell32

FindExecutableW
SHChangeNotify

ntdll

RtlAddAce
RtlSetSaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSubAuthorityCountSid
RtlNewSecurityObject
RtlDeleteSecurityObject
RtlSetOwnerSecurityDescriptor
RtlAddAccessAllowedAce
RtlCopySid
NtOpenThreadToken
NtAccessCheck
RtlNtStatusToDosError
NtDuplicateToken
NtOpenProcessToken
NtQuerySystemInformation
RtlSetDaclSecurityDescriptor
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlSetGroupSecurityDescriptor
RtlLengthSid
RtlCreateAcl
NtSetInformationThread
NtClose
NtDuplicateObject

rpcrt4

RpcBindingVectorFree
RpcRevertToSelf
RpcEpRegisterW
UuidCreate
RpcServerInqBindings
RpcServerUseProtseqEpW
RpcServerUseProtseqW
RpcEpUnregister
RpcServerUnregisterIf
RpcServerRegisterAuthInfoW
RpcImpersonateClient
NdrServerCall2
RpcServerRegisterIfEx

userenv

LoadUserProfileW
CreateEnvironmentBlock
DestroyEnvironmentBlock
UnloadUserProfile

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance

Sections

.text
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d433a4970d91448564f78a87480c751f

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

gdi32

user32

version

netapi32

secur32

ntdsapi

shlwapi

shell32

ntdll

rpcrt4

userenv

ole32

Sections

.text Size: 103KB - Virtual size: 103KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 28KB - Virtual size: 32KB

.text
Size: 103KB - Virtual size: 103KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 28KB - Virtual size: 32KB