44d4d2a6202eb4bbf9e810d799d445f6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

44d4d2a6202eb4bbf9e810d799d445f6_JaffaCakes118
Size

179KB
MD5

44d4d2a6202eb4bbf9e810d799d445f6
SHA1

6f6a812d66b0e8745f401c9eab3938030f77fbfc
SHA256

893a29c617b32388f975956555545ee63a00d20cc948d8f99dbf81e2f6c4b90d
SHA512

9e05b4e85c29817936ae20ef6b2faedfe391a531c87a61ac954041abec98747bbcfc06b0ba46bda2f5fb7acacb040ac5488c0df6d7a0fb0d7b4f2481fd803260
SSDEEP

3072:KQXv/MhI4/xlcDXaO6WuidyCxNcndnf9U/yij6xwI4bwn:9/Ma4/xl2aO6Wu+EV9KL6x

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44d4d2a6202eb4bbf9e810d799d445f6_JaffaCakes118

Files

44d4d2a6202eb4bbf9e810d799d445f6_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

72f93c8267e992058418aa9198546671

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w32time.pdb

Imports

advapi32

RegOpenKeyExW
RegisterServiceCtrlHandlerExW
SetServiceStatus
OpenThreadToken
PrivilegeCheck
GetTokenInformation
LookupAccountSidW
ConvertSidToStringSidW
I_ScSetServiceBitsW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
LsaNtStatusToWinError
RegDeleteKeyW
DeleteService
OpenSCManagerW
CreateServiceW
OpenServiceW
ChangeServiceConfig2W
ChangeServiceConfigW
CloseServiceHandle
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegQueryValueExW
RegCloseKey

iphlpapi

NotifyAddrChange
GetIpAddrTable

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
EnterCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
LocalFree
DeleteCriticalSection
LocalAlloc
GetLastError
CreateTimerQueueTimer
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CloseHandle
CreateEventW
WaitForSingleObject
WriteFile
GetCurrentThreadId
InterlockedIncrement
GetFileSizeEx
CreateFileW
InterlockedDecrement
GetSystemTimeAdjustment
GetModuleFileNameW
GetModuleHandleW
FormatMessageW
UnregisterWait
RegisterWaitForSingleObject
SetHandleInformation
UnregisterWaitEx
SetEvent
GetTickCount
QueueUserWorkItem
OpenEventW
SetTimeZoneInformation
GetTimeZoneInformation
GetCurrentProcess
WaitForMultipleObjects
FreeLibrary
SetSystemTimeAdjustment
SetSystemTime
GetSystemTime
SetThreadPriority
GetCurrentThread
CreateThread
ResetEvent
GetExitCodeThread
GetProcAddress
LoadLibraryW
QueryPerformanceFrequency
DisableThreadLibraryCalls
QueryPerformanceCounter

msvcp60

??1bad_alloc@std@@UAE@XZ

msvcrt

wcscmp
??3@YAXPAX@Z
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler3
ceil
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_CxxThrowException
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
?what@exception@@UBEPBDXZ
memmove
_ultow
qsort
_wcsnicmp
??1exception@@UAE@XZ
wcscat
_wcsicmp
__CxxFrameHandler
_ftol
wcsstr
??2@YAPAXI@Z
_vsnwprintf
swprintf
wcschr
wcsncpy
wcscspn
wcscpy
wcslen
wcstoul

netapi32

DsGetSiteNameW
NetLogonGetTimeServiceParentDomain
NetLogonSetServiceBits
I_NetlogonComputeClientDigest
DsGetDcNameW
NetApiBufferFree
I_NetlogonGetTrustRid
DsRoleGetPrimaryDomainInformation
DsRoleFreeMemory
I_NetlogonComputeServerDigest

ntdll

NtSetSystemTime
NtQuerySystemTime
NtSetSystemInformation

rpcrt4

RpcMgmtWaitServerListen
RpcMgmtStopServerListening
RpcServerUnregisterIf
RpcRevertToSelf
RpcImpersonateClient
RpcBindingSetAuthInfoW
RpcMgmtInqServerPrincNameW
RpcBindingFree
RpcBindingFromStringBindingW
RpcStringBindingComposeW
NdrClientCall2
NdrServerCall2
RpcStringFreeW
RpcServerRegisterAuthInfoW
RpcServerListen
RpcServerUseProtseqEpW
RpcServerInqDefaultPrincNameW
RpcServerRegisterIf

secur32

LsaUnregisterPolicyChangeNotification
LsaRegisterPolicyChangeNotification

user32

wsprintfW

userenv

RegisterGPNotification
UnregisterGPNotification

ws2_32

WSAGetLastError
WSAEventSelect
bind
socket
htons
closesocket
WSAStartup
WSAAddressToStringW
sendto
recvfrom
WSACleanup
WSALookupServiceEnd
WSALookupServiceNextW
WSALookupServiceBeginW

Exports

Exports

DllInstall
DllRegisterServer
DllUnregisterServer
SvchostEntry_W32Time
SvchostPushServiceGlobals
TimeProvClose
TimeProvCommand
TimeProvOpen
W32TimeBufferFree
W32TimeDcPromo
W32TimeGetNetlogonServiceBits
W32TimeQueryConfig
W32TimeQueryHardwareProviderStatus
W32TimeQueryNTPProviderStatus
W32TimeSetConfig
W32TimeSyncNow
W32TimeVerifyJoinConfig
W32TimeVerifyUnjoinConfig
W32TmServiceMain
fnW32TmRegisterServiceCtrlHandlerEx
fnW32TmSetServiceStatus

Sections

.text
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

72f93c8267e992058418aa9198546671

Headers

File Characteristics

PDB Paths

Imports

advapi32

iphlpapi

kernel32

msvcp60

msvcrt

netapi32

ntdll

rpcrt4

secur32

user32

userenv

ws2_32

Exports

Exports

Sections

.text Size: 140KB - Virtual size: 139KB

.data Size: 3KB - Virtual size: 2KB

.rsrc Size: 27KB - Virtual size: 27KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 140KB - Virtual size: 139KB

.data
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 27KB - Virtual size: 27KB

.reloc
Size: 7KB - Virtual size: 7KB