5f6c5714828a886324c2ec5c89d51c76_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5f6c5714828a886324c2ec5c89d51c76_JaffaCakes118
Size

447KB
MD5

5f6c5714828a886324c2ec5c89d51c76
SHA1

4e1965614730921c8a07e20c28409953dc0f5177
SHA256

38edb2aeeabff2f352be7ce7b259cd693a21019888dcfa6a4f30f3a8f3640bf9
SHA512

516d3f92c591fcbd836f10978a106a7c70952ffde519a9800bb3962ae51be133e61b7afb2686c5e4d65c020cf864ffead1b3056f280454521dcc9bd701759d31
SSDEEP

6144:aRgmZ7LvRbvewrXgYuYSF3zvW6PAsvaj1xLcO2P6taTgPwlfSlDZ79np8mi9lScq:aBZPXgCSNXPBGEFeaT09Z7xGHdBdsi+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5f6c5714828a886324c2ec5c89d51c76_JaffaCakes118

Files

5f6c5714828a886324c2ec5c89d51c76_JaffaCakes118
.exe windows:5 windows x86 arch:x86

45a6cbf39b5f9303a132f099b074a5cc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

secur32

ApplyControlToken
LsaCallAuthenticationPackage
LsaFreeReturnBuffer
LsaConnectUntrusted
LsaLookupAuthenticationPackage

msvcrt

wcschr
_except_handler3
wcslen
wcscat
iswctype
memmove
wcscpy
_ltow
wcscmp
time
free
_initterm
malloc
_adjust_fdiv
_ultoa
_ltoa

msasn1

ASN1CEREncNewBlkElement
ASN1_FreeDecoded
ASN1CEREncBeginBlk
ASN1CEREncFlushBlkElement
ASN1CEREncEndBlk
ASN1_FreeEncoded
ASN1_SetEncoderOption
ASN1_Decode
ASN1_Encode
ASN1octetstring_free
ASN1BERDecOctetString
ASN1intx_free
ASN1BERDecS32Val
ASN1BERDecSXVal
ASN1BEREncS32
ASN1BEREncSX
ASN1BERDecObjectIdentifier2
ASN1BEREncObjectIdentifier2
ASN1open_free
ASN1Free
ASN1BERDecExplicitTag
ASN1BERDecNotEndOfContents
ASN1BERDecPeekTag
ASN1DecRealloc
ASN1BERDecOpenType
ASN1BERDecEndOfContents
ASN1BEREncExplicitTag
ASN1BEREncOpenType
ASN1BEREncEndOfContents
ASN1BERDecBitString2
ASN1_CloseModule
ASN1_CreateModule
ASN1BEREncOctetString
ASN1BEREncBitString

crypt32

CryptSignAndEncodeCertificate
CertFindChainInStore
CryptEncodeObject
CryptDecodeObject
I_CryptUninstallAsn1Module
I_CryptInstallAsn1Module
CryptInstallOIDFunctionAddress
I_CryptGetAsn1Decoder
I_CryptGetAsn1Encoder
CertDuplicateCertificateContext
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertVerifyCertificateChainPolicy
CertOpenSystemStoreA
CertAddStoreToCollection
CertEnumCTLsInStore
CertAddEncodedCertificateToStore
CertGetCertificateContextProperty
CertSerializeCertificateStoreElement
CertSaveStore
CertFreeCertificateChain
CertCompareCertificateName
CertGetCertificateChain
CryptDecodeObjectEx
CertGetNameStringW
CertFindCertificateInStore
CertOpenStore
CertAddSerializedElementToStore
CertCloseStore
CertNameToStrW
CertCreateCertificateContext
CertNameToStrA
CertFreeCertificateContext
CertDuplicateStore
CertControlStore

advapi32

AllocateLocallyUniqueId
CryptAcquireContextA
CryptAcquireContextW
CryptReleaseContext
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CryptDestroyHash
CryptSetHashParam
CryptCreateHash
RevertToSelf
CredFree
CredUnmarshalCredentialW
CredIsMarshaledCredentialW
CryptSignHashW
CryptHashData
RegSetValueExW
RegQueryValueExW
RegCreateKeyExA
RegCreateKeyExW
RegOpenKeyExW
RegNotifyChangeKeyValue
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegFlushKey
CryptGenRandom
CryptExportKey
CryptDestroyKey
CryptImportKey
MD5Final
MD5Update
MD5Init
CryptGenKey
CryptGetKeyParam
CryptDuplicateKey
A_SHAFinal
A_SHAUpdate
A_SHAInit
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenThreadToken
CryptGetProvParam
CryptDecrypt
CryptDeriveKey
CryptDuplicateHash
CryptEncrypt
CryptGetUserKey
CryptHashSessionKey
CryptSetKeyParam
CryptSignHashA
CryptVerifySignatureA
CryptGetHashParam

kernel32

LocalReAlloc
InitializeCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
EnterCriticalSection
DeleteCriticalSection
lstrcmpiA
lstrlenA
CreateEventA
RegisterWaitForSingleObject
UnregisterWaitEx
SetEvent
ResetEvent
GetTickCount
FormatMessageW
CreateEventW
OpenProcess
GetCurrentProcess
VirtualAlloc
InterlockedDecrement
lstrcpyW
DisableThreadLibraryCalls
FreeLibrary
LoadLibraryW
GetProcAddress
GetSystemDefaultLCID
GetLocaleInfoA
InterlockedIncrement
SetLastError
GetCurrentThread
GetComputerNameW
GetComputerNameExW
GetSystemWow64DirectoryA

userenv

RegisterGPNotification
UnregisterGPNotification

Sections

.text
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.uuup
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.kuup
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ouup
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.duup
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.auuu
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qiii
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gooo
Size: 417KB - Virtual size: 420KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

45a6cbf39b5f9303a132f099b074a5cc

Headers

File Characteristics

Imports

secur32

msvcrt

msasn1

crypt32

advapi32

kernel32

userenv

Sections

.text Size: 7KB - Virtual size: 8KB

.rdata Size: 6KB - Virtual size: 8KB

.data Size: 1KB - Virtual size: 4KB

.uuup Size: 512B - Virtual size: 4KB

.kuup Size: 512B - Virtual size: 4KB

.ouup Size: 512B - Virtual size: 4KB

.duup Size: 512B - Virtual size: 4KB

.auuu Size: 512B - Virtual size: 4KB

.qiii Size: 512B - Virtual size: 4KB

.gooo Size: 417KB - Virtual size: 420KB

.rsrc Size: 11KB - Virtual size: 24KB

.text
Size: 7KB - Virtual size: 8KB

.rdata
Size: 6KB - Virtual size: 8KB

.data
Size: 1KB - Virtual size: 4KB

.uuup
Size: 512B - Virtual size: 4KB

.kuup
Size: 512B - Virtual size: 4KB

.ouup
Size: 512B - Virtual size: 4KB

.duup
Size: 512B - Virtual size: 4KB

.auuu
Size: 512B - Virtual size: 4KB

.qiii
Size: 512B - Virtual size: 4KB

.gooo
Size: 417KB - Virtual size: 420KB

.rsrc
Size: 11KB - Virtual size: 24KB