2b2857662c901bf551328d4d2b6a1ada_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2b2857662c901bf551328d4d2b6a1ada_JaffaCakes118
Size

329KB
MD5

2b2857662c901bf551328d4d2b6a1ada
SHA1

686f9d80f9afbafad2254e0433438061d4d4086b
SHA256

10a48b1eab7ae9abbe22cc4cc48d439b6e34d5a5fd251f05a07a8bb86ad8e8d5
SHA512

a03b6c413182c9f3aa31ad311072a3f1145d59fad526cc7975f3454e983e538a647e8ec77eaafe5693be368b9ff3ac66bff2ccf7e45fb482a324675e373119cd
SSDEEP

6144:LBnogiu+ssyyWRGD73RNuIxirYPpgxmXEvj7Px430glenmTArlBBFKU:Ly6sypRGfRNlZMSEvj7x430glImUrlBH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b2857662c901bf551328d4d2b6a1ada_JaffaCakes118

Files

2b2857662c901bf551328d4d2b6a1ada_JaffaCakes118
.exe windows:5 windows x86 arch:x86

16e402bbd9d03429ea81a65e433b0f61

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExW
OpenSCManagerW
CryptAcquireContextW
CryptSetProvParam
QueryServiceStatus
CloseServiceHandle
AllocateAndInitializeSid
LookupAccountSidW
CryptGetHashParam
CryptDestroyHash
RegOpenKeyW
CryptGetProvParam
ReportEventW
RegQueryInfoKeyW
RegEnumKeyExW
RegConnectRegistryW
CryptReleaseContext
FreeSid
TraceEvent
SystemFunction006
GetTraceLoggerHandle
RegCreateKeyExW
OpenProcessToken
RegisterTraceGuidsW
OpenThreadToken
QueryServiceConfigW
SetThreadToken
SystemFunction007
GetTokenInformation
RegisterEventSourceW
RegOpenKeyExW
RegDeleteValueW
CryptCreateHash
RegSetValueExW
CredUnmarshalCredentialW
RegNotifyChangeKeyValue
OpenServiceW
DeregisterEventSource
CryptHashData
CredFree
RevertToSelf

secur32

LsaFreeReturnBuffer
LsaGetLogonSessionData
FreeContextBuffer
CredMarshalTargetInfo
CredUnmarshalTargetInfo

ntdll

RtlLeaveCriticalSection
RtlOemStringToUnicodeString
RtlTimeToTimeFields
RtlFreeSid
RtlDeleteCriticalSection
RtlAppendUnicodeStringToString
DbgPrint
RtlVerifyVersionInfo
RtlInitializeGenericTableAvl
RtlCompareMemory
RtlInitializeCriticalSection
RtlCreateAcl
RtlCreateTimer
NtAllocateLocallyUniqueId
RtlConvertSidToUnicodeString
NtQuerySystemTime
RtlUniform
RtlInsertElementGenericTable
RtlEraseUnicodeString
NtDuplicateObject
RtlAcquireResourceShared
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
RtlLengthSid
NtOpenThreadToken
RtlRegisterWait
RtlCreateTimerQueue
RtlGetElementGenericTable
RtlInitializeResource
RtlDeleteElementGenericTable
NtWaitForSingleObject
RtlPrefixUnicodeString
RtlAcquireResourceExclusive
VerSetConditionMask
RtlAddAccessAllowedAce
RtlCopyLuid
RtlCompareUnicodeString
NtOpenEvent
RtlUnicodeStringToAnsiString
RtlIntegerToUnicodeString
RtlNtStatusToDosError
NtQueryInformationToken
RtlLookupElementGenericTable
RtlSubAuthoritySid
RtlInitAnsiString
RtlSubAuthorityCountSid
RtlDeleteTimerQueue
RtlEqualSid
RtlLookupElementGenericTableAvl
RtlCreateSecurityDescriptor
RtlConvertSharedToExclusive
RtlUpcaseUnicodeString
RtlLengthRequiredSid
RtlInitUnicodeString
NtSetSecurityObject
RtlInsertElementGenericTableAvl
RtlCopyUnicodeString
RtlCopySid
RtlEqualUnicodeString
RtlEqualDomainName
RtlRunDecodeUnicodeString
RtlDowncaseUnicodeString
NtAllocateVirtualMemory
NtOpenProcessToken
RtlDeleteResource
RtlFreeAnsiString
NtQuerySystemInformation
RtlDeregisterWait
NtCreateEvent
RtlSetDaclSecurityDescriptor
RtlInitializeSid
RtlInitializeGenericTable
RtlTimeFieldsToTime
RtlEnterCriticalSection
RtlAllocateAndInitializeSid
RtlReleaseResource
RtlSystemTimeToLocalTime
NtClose

kernel32

InterlockedExchangeAdd
GetComputerNameW
GetModuleHandleW
GetModuleFileNameA
GetACP
GetLocalTime
InterlockedCompareExchange
InitializeCriticalSection
UnhandledExceptionFilter
WideCharToMultiByte
FileTimeToSystemTime
OutputDebugStringA
FormatMessageW
GetCurrentThreadId
VirtualAlloc
SetUnhandledExceptionFilter
lstrlenA
GetCurrentThread
CreateEventW
lstrcmpiA
lstrcmpW
LoadLibraryW
GetComputerNameExW
LeaveCriticalSection
CreateFileMappingW
DeleteCriticalSection
GetCurrentProcess
LoadLibraryA
CreateFileA
GetLastError
OpenFileMappingW
UnmapViewOfFile
LocalAlloc
TerminateProcess
Sleep
LocalFree
DebugBreak
MapViewOfFileEx
GetSystemTimeAsFileTime
RegisterWaitForSingleObjectEx
InterlockedDecrement
UnregisterWait
lstrcpyW
WriteFile
FreeLibrary
QueryPerformanceCounter
MultiByteToWideChar
EnterCriticalSection
CreateFileW
CloseHandle
GetTickCount
RaiseException
GetProfileStringA
SetEvent
GetModuleFileNameW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
InterlockedExchange
lstrlenW
InterlockedIncrement
GetCurrentProcessId
OpenEventW
DisableThreadLibraryCalls
GetSystemInfo
GetProcAddress

cryptdll

CDLocateCSystem
CDBuildIntegrityVect
CDLocateCheckSum
CDGenerateRandomBits
MD5Init
MD5Final
CDFindCommonCSystemWithKey
MD5Update

user32

wsprintfW
CharLowerBuffW

msasn1

ASN1BERDecBitString
ASN1BEREncObjectIdentifier
ASN1BERDecBool
ASN1BERDecOctetString
ASN1Free
ASN1intx_setuint32
ASN1BERDecObjectIdentifier
ASN1octetstring_free
ASN1BEREncS32
ASN1_Decode
ASN1BERDecGeneralizedTime
ASN1_CloseDecoder
ASN1_FreeEncoded
ASN1ztcharstring_free
ASN1BEREncOpenType
ASN1BEREncBool
ASN1EncSetError
ASN1intxisuint32
ASN1CEREncGeneralizedTime
ASN1DecSetError
ASN1_CreateModule
ASN1_CreateDecoder
ASN1_CreateEncoder
ASN1_Encode
ASN1BERDecSkip
ASN1BERDecExplicitTag
ASN1BERDecEndOfContents
ASN1intx_free
ASN1charstring_free
ASN1_CloseEncoder
ASN1BEREncBitString
ASN1BEREncEndOfContents
ASN1BERDecU32Val
ASN1BEREncOctetString
ASN1DecAlloc
ASN1BERDecS32Val
ASN1BERDecOpenType2
ASN1bitstring_free
ASN1_FreeDecoded
ASN1intx2int32
ASN1BERDecZeroCharString
ASN1BEREncU32
ASN1BERDecNotEndOfContents
ASN1BERDecPeekTag
ASN1BEREncSX
ASN1intx2uint32
ASN1BEREncExplicitTag
ASN1BERDecSXVal
ASN1BERDecCharString
ASN1BEREncCharString
ASN1objectidentifier_free

msvcrt

strrchr
wcsrchr
wcscpy
_strcmpi
wcslen
_adjust_fdiv
sprintf
wcscmp
sscanf
_ultoa
strchr
wcsspn
malloc
_except_handler3
_initterm
wcstoul
_wcsicmp
_strnicmp
wcscat
_stricmp
free
qsort
_wcsnicmp
_vsnprintf
swprintf

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

16e402bbd9d03429ea81a65e433b0f61

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

secur32

ntdll

kernel32

cryptdll

user32

msasn1

msvcrt

Sections

.text Size: 18KB - Virtual size: 17KB

.data Size: 9KB - Virtual size: 1.4MB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 36KB - Virtual size: 36KB

.rdata Size: 264KB - Virtual size: 263KB

.text
Size: 18KB - Virtual size: 17KB

.data
Size: 9KB - Virtual size: 1.4MB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 36KB - Virtual size: 36KB

.rdata
Size: 264KB - Virtual size: 263KB