4b64cde44e5acb4d4a9848185d5c8b4a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4b64cde44e5acb4d4a9848185d5c8b4a_JaffaCakes118
Size

124KB
MD5

4b64cde44e5acb4d4a9848185d5c8b4a
SHA1

28212e7ab866efa8fd75610ea29b6509ca4305d6
SHA256

910fdb0b8060a1d23b716f0247d17f71bd095d6129eff923b9cdbe382223a4da
SHA512

095dd33bf84eae5b8cdc91247f729d3db9ea45d2ab06919c53b2c811d30f9330b4248d432fe9b1d564f757fb6c0eff661ff6398640dfd9d6bd0081ac000a9f35
SSDEEP

3072:OQ/lgKtU4deAACOqvL50IdGHOpIYfBb8a6:DgCO6d5wYF/6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4b64cde44e5acb4d4a9848185d5c8b4a_JaffaCakes118

Files

4b64cde44e5acb4d4a9848185d5c8b4a_JaffaCakes118
.dll windows:6 windows x86 arch:x86

c74e0c34ec75e21378c896530c8ec934

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

aclui.pdb

Imports

msvcrt

memcpy
memset
_vsnwprintf
_itow_s
iswspace
wcsncmp
malloc
free
_initterm
_amsg_exit
_adjust_fdiv
_except_handler4_common
_XcptFilter

ntdll

NtClose
NtOpenProcessToken
WinSqmEventEnabled
WinSqmEventWrite
RtlCreateUnicodeString
RtlFreeUnicodeString
NtOpenThreadToken
WinSqmSetString
WinSqmStartSession
WinSqmIsOptedIn
WinSqmEndSession
RtlLengthSid
NtQueryInformationToken
RtlNtStatusToDosError
RtlEqualUnicodeString
RtlInitUnicodeString
RtlGetNtProductType
WinSqmAddToStream

kernel32

GlobalUnlock
GlobalLock
SetLastError
lstrlenW
InterlockedIncrement
lstrcmpiW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetTickCount
LoadLibraryW
GetProcAddress
InterlockedCompareExchange
LoadLibraryA
InterlockedExchange
Sleep
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LockResource
LoadResource
FindResourceW
FormatMessageW
GetCurrentThread
InitializeCriticalSection
CreateThread
FreeLibrary
GetModuleHandleW
FreeLibraryAndExitThread
WaitForSingleObject
GetCurrentProcess
CloseHandle
CompareStringW
GetLastError
DisableThreadLibraryCalls
LocalFree
LocalAlloc
ExpandEnvironmentStringsA
GetModuleFileNameW
CheckElevationEnabled
DelayLoadFailureHook
CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
InterlockedDecrement

user32

GetSysColorBrush
GetDC
InflateRect
SetScrollInfo
CallWindowProcW
OffsetRect
LoadImageW
RegisterClassW
LoadBitmapW
GetWindow
FrameRect
GetWindowTextW
DefWindowProcW
DestroyIcon
MapDialogRect
SystemParametersInfoW
UnregisterClassW
GetDlgItemTextW
SendDlgItemMessageW
DestroyWindow
GetSysColor
DrawFocusRect
DrawTextW
ReleaseDC
ShowScrollBar
LoadCursorW
SetCursor
GetClientRect
GetSystemMetrics
SetDlgItemTextW
CheckDlgButton
GetWindowLongW
IsWindowEnabled
IsDlgButtonChecked
MessageBoxW
GetWindowRect
MapWindowPoints
SetWindowPos
SetWindowTextW
IsWindowVisible
ShowWindow
GetParent
PostMessageW
GetFocus
SetFocus
EnableWindow
DialogBoxParamW
EndDialog
LoadIconW
GetDlgItem
SendMessageW
LoadStringW
RegisterWindowMessageW
RegisterClipboardFormatW
MoveWindow
GetScrollInfo
SetScrollPos
ScrollWindow
GetDesktopWindow
CreateWindowExW
GetDlgCtrlID
SetWindowLongW

gdi32

SelectObject
CreateFontIndirectW
GetObjectW
DeleteObject
SetBkMode
SetTextColor
SetBkColor

shlwapi

StrRChrW
StrChrW
PathAppendW

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetWindowsAccountDomainSid
LookupAccountSidW
EqualPrefixSid
GetSidSubAuthority
IsValidSecurityDescriptor
IsValidAcl
IsWellKnownSid
DeleteAce
LookupAccountNameW
GetLengthSid
ConvertSidToStringSidW
EqualSid
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorControl
InitializeAcl
LsaClose
LsaFreeMemory
LsaQueryInformationPolicy
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorSacl
IsValidSid
GetSecurityDescriptorOwner
GetTokenInformation
OpenProcessToken
SetSecurityDescriptorOwner
OpenThreadToken
DuplicateTokenEx
AdjustTokenPrivileges
SetThreadToken
CopySid
LsaOpenPolicy
GetSidSubAuthorityCount
LsaLookupSids

ole32

CoCreateInstance
ReleaseStgMedium
CoInitialize
CoCreateGuid
CoUninitialize

oleaut32

SafeArrayAccessData
SafeArrayUnaccessData
SysFreeString
SysReAllocStringLen
SysAllocStringLen
SysAllocString

shell32

ord6
ord258
ord259

psapi

GetModuleBaseNameW

ntdsapi

DsBindWithSpnExW
DsCrackNamesW
DsUnBindW
DsFreeNameResultW
DsMakeSpnW

Exports

Exports

CreateSecurityPage
EditSecurity
EditSecurityAdvanced
IID_ISecurityInformation

Sections

.text
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c74e0c34ec75e21378c896530c8ec934

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

user32

gdi32

shlwapi

advapi32

ole32

oleaut32

shell32

psapi

ntdsapi

Exports

Exports

Sections

.text Size: 94KB - Virtual size: 94KB

.data Size: 1024B - Virtual size: 2KB

.rsrc Size: 21KB - Virtual size: 21KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 94KB - Virtual size: 94KB

.data
Size: 1024B - Virtual size: 2KB

.rsrc
Size: 21KB - Virtual size: 21KB

.reloc
Size: 6KB - Virtual size: 5KB