355fef8572af4a0b7f5f0e9a833928e4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

355fef8572af4a0b7f5f0e9a833928e4_JaffaCakes118
Size

182KB
MD5

355fef8572af4a0b7f5f0e9a833928e4
SHA1

d0f8c1a8f5bf29ce76f90107b788793a7a615b34
SHA256

4157fae92f195c4bff731c49763e1056194888546d8526f457c78f9010e881be
SHA512

45c87de45a412abffa4059c387a05a501e194b650b384057e53de3d1d4da2bbc676890959898cdd227a22269980d54bfb402668ca00dd74441c096f33366054e
SSDEEP

3072:BC+Of2OecnCNu4QOWq1wlyJBMhjz2QwxduvyTRzpC4uCSuJy7PI:KfnCNBQOWqg2QwxddbuCSuJy7A

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
355fef8572af4a0b7f5f0e9a833928e4_JaffaCakes118

Files

355fef8572af4a0b7f5f0e9a833928e4_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

002971e96894404ca60dd8b26b957a12

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

wcsncat
wcscmp
_wcsupr
bsearch
_strnicmp
strtoul
wcsncpy
_ultow
wcsrchr
_wcsicmp
wcschr
_initterm
_adjust_fdiv
??1type_info@@UAE@XZ
__dllonexit
_onexit
sprintf
_wtoi64
_mbschr
_purecall
wcslen
__CxxFrameHandler
?terminate@@YAXXZ
wcscat
wcscpy
swprintf
??0exception@@QAE@ABV0@@Z
free
_CxxThrowException
malloc
_callnewh
wcstoul
_except_handler3

msvcp60

??1bad_alloc@std@@UAE@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
?nothrow@std@@3Unothrow_t@1@B
??0bad_alloc@std@@QAE@PBD@Z
??0bad_alloc@std@@QAE@ABV01@@Z

atl

ord21
ord18
ord22
ord15
ord32
ord16

ntdll

RtlInitUnicodeString
RtlNtStatusToDosError
RtlEqualSid
RtlSubAuthorityCountSid
RtlLengthRequiredSid
RtlAllocateHeap
RtlCopySid
RtlInitializeSid
RtlSubAuthoritySid
RtlGetNtProductType
RtlAdjustPrivilege
RtlInitString
NtAllocateLocallyUniqueId
RtlFreeHeap
RtlLengthSid
RtlCopySidAndAttributesArray
RtlAnsiStringToUnicodeString

iaspolcy

IASAttributeAddRef
IASAttributeAnsiAlloc
IASAttributeAlloc
IASAttributeRelease

iasrad

?radiusToIAS@VSAFilter@@QBEJPAUIAttributesRaw@@@Z
?radiusFromIAS@VSAFilter@@QBEJPAUIAttributesRaw@@@Z

iassvcs

IASGetLocalDictionary
IASAllocateUniqueID
IASAdler32
IASGetHostByName
IASGetDictionary
IASVariantChangeType
IASRegisterComponent

advapi32

DeregisterEventSource
RegisterEventSourceW
RegOpenKeyW
RegNotifyChangeKeyValue
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteKeyW
GetTokenInformation
LsaOpenPolicy
LsaQueryInformationPolicy
LsaClose
LsaFreeMemory
SystemFunction017
SystemFunction019
SystemFunction008
SystemFunction009
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey

kernel32

LoadLibraryA
GetTimeZoneInformation
FreeLibrary
GetProcAddress
GetComputerNameW
ExpandEnvironmentStringsW
SwitchToThread
TryEnterCriticalSection
FileTimeToSystemTime
InterlockedCompareExchange
RegisterWaitForSingleObject
InterlockedExchange
GetSystemTimeAsFileTime
UnregisterWait
WaitForSingleObject
CreateThread
SetEvent
LocalAlloc
LocalFree
SetLastError
FormatMessageA
Sleep
GetModuleFileNameW
VirtualQuery
SystemTimeToFileTime
LoadLibraryW
DisableThreadLibraryCalls
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
GetLastError
CloseHandle

netapi32

NetRegisterDomainNameChangeNotification
NetApiBufferFree
DsGetDcNameW
NetpParmsQueryUserProperty
NetpParmsSetUserProperty
NetUnregisterDomainNameChangeNotification

ntdsapi

DsCrackNamesW
DsUnBindW
DsBindW
DsBindWithCredA
DsFreeNameResultW

ole32

CoTaskMemAlloc
CoTaskMemFree

oleaut32

SafeArrayRedim
SafeArrayPtrOfIndex
SafeArrayCreate
VariantTimeToSystemTime
SetErrorInfo
LoadRegTypeLi
VariantClear
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
VariantInit
SysStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound

rtutils

TraceRegisterExW
TraceVprintfExA
TracePutsExA
TraceDeregisterW

user32

wsprintfA

wldap32

ord133
ord13
ord203
ord167
ord145
ord16
ord14
ord88
ord127
ord147
ord41
ord77
ord79
ord142
ord224
ord140
ord26
ord312
ord36
ord18
ord73

secur32

LsaLogonUser
LsaDeregisterLogonProcess
LsaCallAuthenticationPackage
LsaRegisterLogonProcess
LsaFreeReturnBuffer
LsaLookupAuthenticationPackage

samlib

SamLookupNamesInDomain
SamOpenUser
SamConnect
SamOpenDomain
SamiChangePasswordUser2
SamQueryInformationUser
SamGetGroupsForUser
SamGetAliasMembership
SamFreeMemory
SamiChangePasswordUser
SamCloseHandle
SamLookupDomainInSamServer

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IASParmsFreeUserParms
IASParmsQueryRasUser0
IASParmsQueryUserProperty
IASParmsSetRasUser0
IASParmsSetUserProperty

Sections

.text
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

002971e96894404ca60dd8b26b957a12

Headers

File Characteristics

Imports

msvcrt

msvcp60

atl

ntdll

iaspolcy

iasrad

iassvcs

advapi32

kernel32

netapi32

ntdsapi

ole32

oleaut32

rtutils

user32

wldap32

secur32

samlib

Exports

Exports

Sections

.text Size: 75KB - Virtual size: 74KB

.data Size: 1024B - Virtual size: 3KB

.rsrc Size: 99KB - Virtual size: 98KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 75KB - Virtual size: 74KB

.data
Size: 1024B - Virtual size: 3KB

.rsrc
Size: 99KB - Virtual size: 98KB

.reloc
Size: 6KB - Virtual size: 5KB