5de42377cf17bc37f7e28ba5ba166290_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5de42377cf17bc37f7e28ba5ba166290_JaffaCakes118
Size

86KB
MD5

5de42377cf17bc37f7e28ba5ba166290
SHA1

7d1e5e006b070d859fa9dcdc8929d74d32165987
SHA256

228925759ac0c00d82a15dac14906398939430be681bb92ffcb2016bb4fdaf6d
SHA512

9184217537696521e708aa7540c06857387306f760cf49312dca0354e37439788ebbc9f23cb6d1df1ac9d2f9bdeac83d43447cb29a9b626e5fa1514524e1e4be
SSDEEP

1536:8S5s5TuNFG7Zp7D/CC8CTrqSBw95N5Yc1wz0ir6R38WTvWZLL:PsKAzcCTZMKuZ8WTvWZLL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5de42377cf17bc37f7e28ba5ba166290_JaffaCakes118

Files

5de42377cf17bc37f7e28ba5ba166290_JaffaCakes118
.exe windows:5 windows x86 arch:x86

0159e00823e90176a73aa8cb4e58a1e4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\builds\moz2_slave\m-in-w32-d-0000000000000000000\build\src\obj-firefox\security\manager\ssl\tests\unit\tlsserver\cmd\BadCertServer.pdb

Imports

nss3

NSS_Init
NSS_Initialize
SECKEY_ExtractPublicKey
PR_InitializeNetAddr
PR_GetEnv
ATOB_AsciiToData
NSS_SetDomesticPolicy
NSS_FindCertKEAType
SSL_ConfigServerSessionIDCache
SSL_ConfigSecureServerWithCertChain
PR_Assert
SSL_SNISocketConfigHook
SSL_ResetHandshake
SSL_OptionSet
VFY_VerifyDigestDirect
SSL_ImportFD
PK11_ImportCert
PK11_FindCertFromNickname
PK11_FindKeyByDERCert
PK11_ImportDERPrivateKeyInfoAndReturnKey
PK11_FindKeyByAnyCert
PK11_NeedUserInit
PK11_InitPin
PK11_GetInternalKeySlot
PR_ErrorToName
PR_fprintf
CERT_DestroyCertificateList
CERT_DecodeCertPackage
SECKEY_DestroySubjectPublicKeyInfo
CERT_FindCertByName
CERT_NewTempCertificate
CERT_GetDefaultCertDB
CERT_ExtractPublicKey
CERT_DupCertificate
PR_SetSocketOption
PR_Send
PR_Recv
PR_Listen
PR_Bind
PR_Accept
PR_Connect
PR_NewTCPSocket
PR_CloseDir
PR_ReadDir
PR_OpenDir
PR_Available
PR_Read
PR_Close
PR_OpenFile
PR_GetSpecialFD
PR_Now
SECITEM_DupArray
SECITEM_AllocArray
SECITEM_CopyItem
SECITEM_AllocItem
PORT_FreeArena
PORT_ArenaAlloc
PORT_NewArena
PR_CallOnce
PK11_GenerateKeyPair
PK11_RandomUpdate
PK11_GetInternalSlot
PK11_FreeSlot
CERT_FindCertIssuer
NSS_NoDB_Init
SECKEY_DestroyPrivateKey
SECKEY_CreateSubjectPublicKeyInfo
SECKEY_CopyPrivateKey
SEC_SignData
SECITEM_FreeItem
PK11_HashBuf
SECKEY_DestroyPublicKey
SECKEY_DecodeDERSubjectPublicKeyInfo
PR_ErrorInstallTable
PR_GetError
PR_SetError
CERT_DestroyCertificate
SECITEM_ItemsAreEqual
PORT_Free
PORT_ZAlloc

kernel32

GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
GetCurrentThreadId
GetSystemTimeAsFileTime
GetCurrentProcess
TerminateProcess

msvcr120

_vsnprintf
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
_time64
_XcptFilter
exit
strncmp
_amsg_exit
__getmainargs
__set_app_type
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__initenv
_fmode
_commode
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_except_handler4_common
?terminate@@YAXXZ
__crtSetUnhandledExceptionFilter
fwrite
fopen_s
fclose
_dupenv_s
_gmtime64_s
abort
_invoke_watson
atoi
_hypot
memmove
memset
memcmp
_wassert
_purecall
memcpy
fprintf
fflush
__iob_func
_controlfp_s

mozglue

malloc
?moz_Xout_of_range@std@@YAXPBD@Z
?moz_Xlength_error@std@@YAXPBD@Z
moz_xmalloc
free

msvcp120

?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAPBDH@Z
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_BADOFF@std@@3_JB
??_7ios_base@std@@6B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
?_Syserror_map@std@@YAPBDH@Z

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0159e00823e90176a73aa8cb4e58a1e4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

nss3

kernel32

msvcr120

mozglue

msvcp120

Sections

.text Size: 61KB - Virtual size: 61KB

.rdata Size: 19KB - Virtual size: 19KB

.data Size: 512B - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 61KB - Virtual size: 61KB

.rdata
Size: 19KB - Virtual size: 19KB

.data
Size: 512B - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB