25a8e779bf39aedb180375f50755116a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

25a8e779bf39aedb180375f50755116a_JaffaCakes118
Size

984KB
MD5

25a8e779bf39aedb180375f50755116a
SHA1

977385c8d5b5a1d4f548b7066ef940f5ee202446
SHA256

35765608731d3f78c37c14bfbf8ce22d4e81a030807800a143bc8c88df63e7cc
SHA512

21e4a585461e1ed982b81329a6acff04dfe61b2056e732df0dc1a51ffed599f93666058d790ea375967e2f0cf051c6b7be7cfed1c98568e8593633fef3d98767
SSDEEP

24576:mLaRa2cTjs8fkZZ7TRpekYIR6LWcW91b3Rbq2qM2d:aCoI8fiz7ciTRNqMK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
25a8e779bf39aedb180375f50755116a_JaffaCakes118

Files

25a8e779bf39aedb180375f50755116a_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

4dd2c12ea3a58c5f4a2015abc451ada3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

EqualSid
GetSidSubAuthority
InitializeSid
LookupAccountSidA
GetTokenInformation
OpenProcessToken
OpenThreadToken
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
RegCloseKey
RegQueryValueExA
RegOpenKeyExA

user32

GetActiveWindow
GetCapture
GetClipboardOwner
GetClipboardViewer
GetDesktopWindow
GetFocus
GetInputState
GetMessagePos
GetMessageTime
GetOpenClipboardWindow
GetProcessWindowStation
GetCaretPos
GetCursorPos
MessageBoxA

kernel32

CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
IsBadWritePtr
IsBadReadPtr
FreeLibrary
GetProcAddress
LoadLibraryA
GetLastError
CloseHandle
GetCurrentProcess
GetCurrentThread
GetDriveTypeA
GetFullPathNameA
DeleteFileA
SetErrorMode
GetFileType
CreateFileA
ReadFile
WriteFile
FlushFileBuffers
SetFilePointer
SetFileTime
SetEndOfFile
GetFileSize
CreateDirectoryA
GetFileAttributesA
GetWindowsDirectoryA
GetVersionExA
GlobalFree
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualLock
VirtualUnlock
GetSystemInfo
WaitForSingleObject
Sleep
QueryPerformanceCounter
DisableThreadLibraryCalls
GetModuleHandleA
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
GetStartupInfoA
GetProcessWorkingSetSize
GetProcessTimes
GetThreadTimes
GlobalMemoryStatus
GetTickCount
GetProcessHeap
GetCurrentProcessId
DeviceIoControl
HeapFree
HeapAlloc
MultiByteToWideChar
WideCharToMultiByte
ExitThread
CreateThread
GetSystemTimeAsFileTime
HeapReAlloc
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
ExitProcess
GetStdHandle
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
LCMapStringA
LCMapStringW
GetTimeZoneInformation
HeapSize
SetHandleCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
RtlUnwind
GetStringTypeA
GetStringTypeW
SetEnvironmentVariableA

Exports

Exports

DllRegisterServer
cryptAddCertExtension
cryptAddPrivateKey
cryptAddPublicKey
cryptAddRandom
cryptAlgoFromString
cryptAsyncCancel
cryptAsyncQuery
cryptCAAddItem
cryptCACertManagement
cryptCADeleteItem
cryptCAGetItem
cryptCheckCert
cryptCheckSignature
cryptCheckSignatureEx
cryptCreateCert
cryptCreateContext
cryptCreateEnvelope
cryptCreateSession
cryptCreateSignature
cryptCreateSignatureEx
cryptDecrypt
cryptDeleteAttribute
cryptDeleteCertExtension
cryptDeleteKey
cryptDestroyCert
cryptDestroyContext
cryptDestroyEnvelope
cryptDestroyObject
cryptDestroySession
cryptDeviceClose
cryptDeviceCreateContext
cryptDeviceOpen
cryptDeviceQueryCapability
cryptEncrypt
cryptEnd
cryptExportCert
cryptExportKey
cryptExportKeyEx
cryptFlushData
cryptGenerateKey
cryptGenerateKeyAsync
cryptGetAttribute
cryptGetAttributeString
cryptGetCertExtension
cryptGetKey
cryptGetPrivateKey
cryptGetPublicKey
cryptImportCert
cryptImportKey
cryptImportKeyEx
cryptInit
cryptKeysetClose
cryptKeysetOpen
cryptLogin
cryptLogout
cryptPopData
cryptPushData
cryptQueryCapability
cryptQueryObject
cryptSetAlgoList
cryptSetAttribute
cryptSetAttributeString
cryptSignCert

Sections

.text
Size: 748KB - Virtual size: 744KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 184KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4dd2c12ea3a58c5f4a2015abc451ada3

Headers

File Characteristics

Imports

advapi32

user32

kernel32

Exports

Exports

Sections

.text Size: 748KB - Virtual size: 744KB

.rdata Size: 184KB - Virtual size: 182KB

.data Size: 16KB - Virtual size: 23KB

.rsrc Size: 4KB - Virtual size: 800B

.reloc Size: 28KB - Virtual size: 25KB

.text
Size: 748KB - Virtual size: 744KB

.rdata
Size: 184KB - Virtual size: 182KB

.data
Size: 16KB - Virtual size: 23KB

.rsrc
Size: 4KB - Virtual size: 800B

.reloc
Size: 28KB - Virtual size: 25KB