3254237dd9ea6224bf537826469964fd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3254237dd9ea6224bf537826469964fd_JaffaCakes118
Size

151KB
MD5

3254237dd9ea6224bf537826469964fd
SHA1

4e8cce8b321283b9eaadaab999891afc83c069a9
SHA256

2b74b85645738c807f345ff47d765b3982d25fc3f8df73415f2ed6885c681387
SHA512

3217c8c802161c1d9ce9fc2b425e587444b9d1c99f99a9fdf0a5ed139d7c9fb9777f08faa5b5114bace1fb1123635360b443f34e04515792933a6c0bffbf7bff
SSDEEP

3072:9gB0CVFbt3UZ0+1LdyFJAZ70k84zXukTjSS6GZhunZ358MfbZOr:9M0Cnt3F+1MA24z+W/DwD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3254237dd9ea6224bf537826469964fd_JaffaCakes118

Files

3254237dd9ea6224bf537826469964fd_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a944d9c6a9357644556246784f7492fb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnumResourceNamesW
UnlockFileEx
ReadConsoleInputExW
LoadLibraryA
WriteFileEx
AttachConsole
GetFileType
FatalAppExitW
BeginUpdateResourceW
SetConsoleMaximumWindowSize
WriteFileGather
SetConsoleCursor
SetConsoleTitleA
GetConsoleCommandHistoryW
GetSystemWow64DirectoryW
GetConsoleAliasExesA
WriteConsoleInputA
WriteConsoleA
EnumSystemLanguageGroupsA
FindNextFileA
SetSystemTimeAdjustment
VirtualAlloc
TransactNamedPipe
GetNextVDMCommand
GlobalUnfix
IsWow64Process
FreeConsole
DebugActiveProcess
GetEnvironmentVariableA
FlushFileBuffers
QueryPerformanceCounter
GetCurrentDirectoryW
CreateMailslotW
CreateSemaphoreW
CopyLZFile
LZCloseFile
RtlZeroMemory
GetTapeStatus
GetProcAddress
SetInformationJobObject
GetCPInfo
VerifyConsoleIoHandle
CreateThread
lstrcpynW
GetCommMask
GetExpandedNameA
QueryPerformanceFrequency
GetShortPathNameA
SetHandleInformation
HeapCreate
LZOpenFileA
ReplaceFileW
QueryMemoryResourceNotification
DeleteCriticalSection
EnumSystemLanguageGroupsW
VirtualUnlock
VirtualProtectEx
Process32NextW
SetThreadAffinityMask
lstrlen
CreateHardLinkW
TlsSetValue
GetStartupInfoW
SetConsoleCursorInfo
QueryDosDeviceA
SetFilePointer
GetLongPathNameA
AddConsoleAliasA
GetFullPathNameW
GlobalMemoryStatusEx
OutputDebugStringA
OpenSemaphoreA
CompareFileTime
GlobalFindAtomW
QueryDepthSList
lstrcatW
GetSystemTimeAdjustment

polstore

IPSecFreePolStr
IPSecSetISAKMPData
IPSecDeleteNegPolData
IPSecFreeMulFilterData
IPSecFreeMulISAKMPData
IPSecFreeMulNFAData
IPSecCopyFilterData
IPSecGetAssignedPolicyData
IPSecDeleteISAKMPData
IPSecUnassignPolicy
IPSecCopyFilterSpec
IPSecEnumISAKMPData
IPSecAllocPolMem
IPSecCreateNFAData
IPSecFreeMulPolicyData
IPSecFreeMulNegPolData
IPSecFreeNFAData
IPSecGetFilterData
IPSecDeleteFilterData
IPSecCopyPolicyData
IPSecCopyISAKMPData
IPSecImportPolicies
IPSecGetNegPolData
IPSecSetNegPolData
IPSecIsDomainPolicyAssigned
IPSecCreateFilterData
IPSecEnumPolicyData
IPSecCreateISAKMPData
IPSecCopyNegPolData
IPSecSetPolicyData

ntdll

ZwSetIntervalProfile
NtDelayExecution
NtDeleteBootEntry
RtlFindSetBitsAndClear
NtSetQuotaInformationFile
NtTerminateProcess
RtlSetOwnerSecurityDescriptor
NtAreMappedFilesTheSame
RtlPcToFileHeader
RtlRegisterWait
NtSetEaFile
isupper
ZwRemoveIoCompletion
_ltow
CsrSetPriorityClass
RtlUnlockBootStatusData
log
LdrInitShimEngineDynamic
ZwReplyPort
RtlEnableEarlyCriticalSectionEventCreation
RtlLargeIntegerAdd
strpbrk
NtQueryOpenSubKeys
RtlCopySidAndAttributesArray
NlsMbCodePageTag
RtlGetOwnerSecurityDescriptor
ZwQueryInformationJobObject
ZwTranslateFilePath
RtlEraseUnicodeString
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle
_stricmp

winsta

LogonIdFromWinStationNameA
WinStationGetAllProcesses
WinStationSetInformationA
WinStationQueryInformationA
ServerLicensingClose
ServerLicensingFreePolicyInformation
WinStationEnumerateLicenses
WinStationShadow
WinStationRenameA
WinStationShadowStop
ServerQueryInetConnectorInformationW
WinStationNameFromLogonIdW
WinStationQueryInformationW
WinStationGetTermSrvCountersValue
WinStationSendWindowMessage
WinStationSetPoolCount
WinStationActivateLicense
_WinStationCallback
_NWLogonSetAdmin
WinStationNtsdDebug
WinStationSetInformationW
WinStationUnRegisterConsoleNotification
WinStationRenameW
WinStationEnumerate_IndexedA
_WinStationGetApplicationInfo
_WinStationBeepOpen
WinStationNameFromLogonIdA
WinStationSendMessageW
_WinStationFUSCanRemoteUserDisconnect
ServerLicensingUnloadPolicy
WinStationGetProcessSid
WinStationFreeGAPMemory
_WinStationUpdateClientCachedCredentials
ServerLicensingOpenW
WinStationEnumerateProcesses
WinStationCloseServer
LogonIdFromWinStationNameW
_WinStationShadowTargetSetup
ServerLicensingGetPolicyInformationW
WinStationBroadcastSystemMessage
WinStationOpenServerW
_WinStationNotifyDisconnectPipe
WinStationQueryLicense

rpcns4

RpcNsBindingUnexportPnPW
I_RpcNsSendReceive
RpcNsProfileEltAddW
RpcNsProfileEltInqBeginW
RpcNsGroupMbrRemoveA
RpcNsBindingUnexportPnPA
I_RpcNsRaiseException
RpcNsBindingExportA
RpcNsEntryExpandNameW
RpcNsEntryExpandNameA
RpcNsMgmtSetExpAge
RpcNsMgmtEntryInqIfIdsW
RpcNsBindingImportDone
RpcNsMgmtEntryDeleteA
I_RpcNsGetBuffer
RpcNsGroupDeleteA
RpcNsProfileEltRemoveA
RpcNsBindingImportBeginA
RpcNsBindingImportNext
RpcNsBindingSelect
RpcNsGroupMbrInqBeginA
RpcNsEntryObjectInqBeginW
RpcNsBindingExportPnPW
RpcNsGroupMbrRemoveW
RpcNsBindingLookupBeginA
RpcNsProfileEltRemoveW
RpcNsProfileEltInqNextA
RpcNsEntryObjectInqNext
RpcNsGroupMbrAddW
RpcNsGroupMbrInqDone
RpcNsBindingLookupNext

mtxex

SafeRef
GetObjectContext
DllGetClassObject
MTSCreateActivity

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a944d9c6a9357644556246784f7492fb

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

polstore

ntdll

winsta

rpcns4

mtxex

Sections

.text Size: 55KB - Virtual size: 55KB

.rdata Size: 43KB - Virtual size: 43KB

.data Size: 49KB - Virtual size: 135KB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 55KB - Virtual size: 55KB

.rdata
Size: 43KB - Virtual size: 43KB

.data
Size: 49KB - Virtual size: 135KB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 1024B - Virtual size: 1024B