223cddbe0b9efc285387a80599d6ddf3_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

223cddbe0b9efc285387a80599d6ddf3_JaffaCakes118
Size

2.4MB
MD5

223cddbe0b9efc285387a80599d6ddf3
SHA1

96e81945debfd4e95ecdfdfdbf9a87ebc3a59357
SHA256

0dbec1432381fd2474dd059797206d96ca8f661ea0c3fed71482acb29bb4b90c
SHA512

a159f1ba42c9fd4cd11f331655e16d197cc5998e2b521b5d23ec154cd2302b071bd499400d5f6eaa7e182dcd54ce44059dc0cff611e6c5b3554c5403fa80a77d
SSDEEP

49152:X6zxO1gidRe0iYE6gmSi4sE7ym501NuWhCiVR:qw1LlG50zuWh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
223cddbe0b9efc285387a80599d6ddf3_JaffaCakes118

Files

223cddbe0b9efc285387a80599d6ddf3_JaffaCakes118
.dll windows:6 windows x64 arch:x64

70940e3c7a6c813baaad30638e681cb5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemTimeAsFileTime
SystemTimeToFileTime
LocalFree
LocalAlloc
LoadLibraryExW
GetProcAddress
GetModuleHandleA
GetModuleFileNameW
GetTickCount
CreateThread
Sleep
CreateMutexA
WaitForSingleObject
ReleaseMutex
GetLastError
CloseHandle
SetFileTime
ReadFile
GetFileSize
GetFileAttributesExA
CreateFileW
CreateFileA
CreateDirectoryA
GetCurrentThreadId
InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

advapi32

AbortSystemShutdownW
GetTrusteeFormW
GetTrusteeTypeW
GetTrusteeNameW
BuildTrusteeWithObjectsAndSidA
LookupSecurityDescriptorPartsW
FreeInheritedFromArray
GetInheritanceSourceW
SetSecurityInfo
GetSecurityInfo
GetExplicitEntriesFromAclA
CredFree
CredEnumerateA
CredWriteA
CredWriteW
ConvertSecurityDescriptorToStringSecurityDescriptorW
SaferiIsExecutableFileType
SaferRecordEventLogEntry
SaferGetLevelInformation
SaferIdentifyLevel
SaferCloseLevel
SaferCreateLevel
SaferGetPolicyInformation
AddAccessAllowedAce
AddAccessAllowedAceEx
AddAce
AreAnyAccessesGranted
CopySid
CreateWellKnownSid
GetFileSecurityW
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
InitializeAcl
InitializeSid
IsValidAcl
IsValidSid
IsWellKnownSid
SetSecurityDescriptorDacl
FileEncryptionStatusA
ClearEventLogA
BackupEventLogA
CloseEventLog
DeregisterEventSource
OpenEventLogA
RegisterEventSourceA
RegisterEventSourceW
OpenBackupEventLogA
ReportEventW
GetEventLogInformation
AccessCheckByTypeAndAuditAlarmA
SetFileSecurityA
GetFileSecurityA
LookupAccountNameW
LookupPrivilegeValueA
LookupPrivilegeValueW
LookupPrivilegeNameW
GetUserNameW
GetCurrentHwProfileW
CloseTrace
CloseServiceHandle
ControlService
CreateServiceA
CreateServiceW
DeleteService
EnumDependentServicesW
GetServiceKeyNameW
GetServiceDisplayNameA
LockServiceDatabase
NotifyBootConfigStatus
OpenSCManagerA
OpenSCManagerW
OpenServiceA
QueryServiceLockStatusA
SetServiceObjectSecurity
StartServiceW
UnlockServiceDatabase
LsaFreeMemory
LsaClose
LsaOpenPolicy
LsaLookupNames2
LsaLookupSids
LsaRemoveAccountRights
LsaOpenTrustedDomainByName
LsaDeleteTrustedDomain
LsaCreateTrustedDomainEx
StartTraceW
StopTraceW
QueryTraceW
FlushTraceA
QueryAllTracesW
OpenTraceW
OpenTraceA

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z

vcruntime140

__std_type_info_destroy_list
strchr
strrchr
strstr
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memchr
memcmp
memcpy
memmove
memset
__C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

strerror
system
exit
_initterm_e
abort
_invalid_parameter_noinfo_noreturn
signal
_initterm
_cexit
_errno
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment

api-ms-win-crt-string-l1-1-0

isxdigit
isspace
_strdup
tolower
strncmp
strncat
strncpy
_wcsnicmp
wcsncpy
islower
wcsncat

api-ms-win-crt-heap-l1-1-0

calloc
realloc
malloc
free
_callnewh

api-ms-win-crt-convert-l1-1-0

_ultoa
_ltow
_ultow
_ltoa
_itow
atoi
_itoa
strtoul

api-ms-win-crt-utility-l1-1-0

rand
srand

api-ms-win-crt-stdio-l1-1-0

_fileno
fopen
fread
fseek
ftell
_setmode
getchar
fwrite
__stdio_common_vfprintf
feof
fclose
_write
fflush
puts
__acrt_iob_func
__stdio_common_vsprintf

api-ms-win-crt-filesystem-l1-1-0

_fstat64i32
remove

api-ms-win-crt-math-l1-1-0

floorf
cosf
acosf
frexp
sqrtf
log10

api-ms-win-crt-time-l1-1-0

_localtime64
strftime
_time64
_mktime64

Exports

Exports

contact_b
dictionary_set
initPosition
rotation
strLength
swap

Sections

.text
Size: 351KB - Virtual size: 351KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

70940e3c7a6c813baaad30638e681cb5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

Exports

Exports

Sections

.text Size: 351KB - Virtual size: 351KB

.rdata Size: 2.0MB - Virtual size: 2.0MB

.data Size: 15KB - Virtual size: 81KB

.pdata Size: 6KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 416B

.text
Size: 351KB - Virtual size: 351KB

.rdata
Size: 2.0MB - Virtual size: 2.0MB

.data
Size: 15KB - Virtual size: 81KB

.pdata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 416B