61c075c86cf480eab3478010e0b0c629_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

61c075c86cf480eab3478010e0b0c629_JaffaCakes118
Size

272KB
MD5

61c075c86cf480eab3478010e0b0c629
SHA1

e3e770d59af7953dc8f080af67d6b4c6f9db1a2d
SHA256

21d2be8b1ed024af02395f2bbeebb785aa840ffaa78e3f09c8adb6f67ea60139
SHA512

492377959e446ef3697739260eb35c8fcee016b559d7f9205928ca7a0a02b566c0ad5619918d9def35f9d23950214799d9659b7835c656550e3ffc48ad33e664
SSDEEP

6144:5y6a5wiJf5RwpBPUEff8NVbNRPqREXuqHUYWyEe6X:M6a5wtBjn8NBNRPrX30DyD6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
61c075c86cf480eab3478010e0b0c629_JaffaCakes118

Files

61c075c86cf480eab3478010e0b0c629_JaffaCakes118
.dll windows:4 windows x86 arch:x86

a36f53afa67fa4896ad3c7c9f66ce00c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

nss3

SECITEM_CopyItem
SECOID_FindOIDByTag
PORT_ArenaMark
SECITEM_ArenaDupItem
PORT_SetError
SECOID_FindOID
NSS_Get_CERT_TimeChoiceTemplate
NSS_Get_SEC_ObjectIDTemplate
NSS_Get_SEC_IA5StringTemplate
NSS_Get_SEC_AnyTemplate
SEC_ASN1EncodeItem
PK11_FreeSymKey
SECITEM_AllocItem
SECOID_GetAlgorithmTag
SECOID_SetAlgorithmID
SECOID_CopyAlgorithmID
PK11_GetKeyStrength
PK11_ReferenceSymKey
PK11_DestroyContext
PK11_CipherOp
PORT_Free
PK11_CreateContextBySymKey
PK11_FreeSlot
PK11_IsHW
PK11_GetSlotFromKey
PK11_GetBlockSize
SECITEM_FreeItem
PORT_ZAlloc
SECITEM_ZfreeItem
PK11_MapPBEMechanismToCryptoMechanism
PK11_ParamFromAlgid
PK11_AlgtagToMechanism
PK11_GetSymKeyUserData
SEC_PKCS5IsAlgorithmPBEAlg
PK11_ParamToAlgid
PK11_GenerateNewParam
SEC_ASN1DecoderSetNotifyProc
SEC_ASN1DecoderStart
PORT_GetError
SEC_ASN1DecoderClearFilterProc
SEC_ASN1DecoderSetFilterProc
SEC_ASN1DecoderFinish
PORT_Alloc
SEC_ASN1DecoderUpdate
SEC_ASN1EncodeInteger
PORT_FreeArena
PORT_NewArena
SECOID_DestroyAlgorithmID
PK11_CreatePBEAlgorithmID
SEC_ASN1EncoderUpdate
SEC_ASN1EncoderSetNotifyProc
SEC_ASN1EncoderSetStreaming
SEC_ASN1EncoderStart
SEC_ASN1EncoderSetTakeFromBuf
SEC_ASN1EncoderClearNotifyProc
SEC_ASN1EncoderFinish
SEC_ASN1EncoderClearStreaming
SEC_ASN1EncoderClearTakeFromBuf
PK11_KeyGen
PK11_GetBestSlot
PK11_FindCertAndKeyByRecipientListNew
PK11_SetPasswordFunc
SECKEY_DestroyPublicKey
CERT_ExtractPublicKey
PK11_PubWrapSymKey
SECKEY_PublicKeyStrength
SECKEY_GetPublicKeyType
PK11_PubUnwrapSymKey
PK11_GetKeyLength
PK11_WrapSymKey
SECKEY_DestroyPrivateKey
PK11_PubDerive
PK11_FindKeyByAnyCert
CERT_DestroyCertificate
PK11_FindBestKEAMatch
NSS_Get_SEC_IntegerTemplate
PK11_UnwrapSymKey
PK11_MakeKEAPubKey
SEC_ASN1DecodeItem
SECKEY_DestroySubjectPublicKeyInfo
SECKEY_CopyPublicKey
CERT_GetCertIssuerAndSN
CERT_DupCertificate
SECKEY_CreateSubjectPublicKeyInfo
SEC_QuickDERDecodeItem
CERT_FindSubjectKeyIDExtension
SEC_ASN1DecodeInteger
PK11_FindPrivateKeyFromCert
SECKEY_CopyPrivateKey
CERT_DestroyCertificateList
CERT_DestroyCertList
PORT_ArenaUnmark
NSS_Get_SEC_PointerToAnyTemplate
PORT_ArenaRelease
CERT_FilterCertListByUsage
CERT_AddCertToListTail
CERT_NewCertList
CERT_ImportCerts
CERT_FindCertByDERCert
SGN_Digest
SEC_SignData
PK11_FortezzaMapSig
VFY_VerifyDigest
VFY_VerifyData
DER_DecodeTimeChoice
CERT_FindCertByIssuerAndSN
CERT_FindCertBySubjectKeyID
CERT_GetCommonName
PORT_Strdup
DER_EncodeTimeChoice
PK11_FortezzaHasKEA
CERT_SaveSMimeProfile
CERT_GetDefaultCertDB
CERT_CertListFromCert
SECOID_CompareAlgorithmID
SECITEM_ItemsAreEqual
HASH_GetHashObjectByOidTag
SECOID_FindOIDTag
CERT_FindSMimeProfile
NSS_VersionCheck
NSS_Get_sgn_DigestInfoTemplate
NSS_Get_SECKEY_PrivateKeyInfoTemplate
NSS_Get_SECKEY_PointerToEncryptedPrivateKeyInfoTemplate
PK11_GenerateRandom
PK11_HashBuf
PK11_DigestFinal
PK11_DigestOp
PK11_DigestBegin
SGN_CreateDigestInfo
PORT_UCS2_ASCIIConversion
SGN_DestroyDigestInfo
SECITEM_CompareItem
PORT_Realloc
PORT_UCS2_UTF8Conversion
SGN_CopyDigestInfo
DER_GetInteger
SEC_PKCS5GetKeyLength
SEC_PKCS5GetCryptoAlgorithm
NSS_Get_SECKEY_PointerToPrivateKeyInfoTemplate
NSS_Get_SEC_BMPStringTemplate
PK11_GetInternalSlot
PK11_ReferenceSlot
PK11_PBEKeyGen
PK11_GetInternalKeySlot
PORT_ArenaStrdup
PK11_IsInternal
SECKEY_DestroyEncryptedPrivateKeyInfo
SECKEY_CopyEncryptedPrivateKeyInfo
PK11_ExportEncryptedPrivateKeyInfo
SECKEY_DestroyPrivateKeyInfo
SECKEY_CopyPrivateKeyInfo
PK11_ExportPrivateKeyInfo
__CERT_NewTempCertificate
PK11_DestroyPBEParams
PK11_CreatePBEParams
PK11_SetSymKeyUserData
SECITEM_DupItem
SEC_ASN1DecoderClearNotifyProc
PORT_ZFree
__CERT_DecodeDERCertificate
PK11_GetTokenName
PK11_TraverseCertsForSubjectInSlot
PK11_TraverseCertsForNicknameInSlot
PK11_FindKeyByDERCert
PK11_ImportDERCert
PK11_ImportCertForKeyToSlot
CERT_IsRootDERCert
CERT_IsCADERCert
PK11_ImportPrivateKeyInfo
PK11_ImportEncryptedPrivateKeyInfo
ATOB_ConvertAsciiToItem
ATOB_AsciiToData
PK11_RawPBEKeyGen
PK11_FindCertAndKeyByRecipientList
SEC_ASN1DecoderAbort
HASH_ResultLen
HASH_GetHashTypeByOidTag
SEC_ASN1EncoderAbort
SEC_ASN1Encode
PORT_ArenaAlloc
PORT_ArenaGrow
NSS_Get_CERT_IssuerAndSNTemplate
NSS_Get_CERT_SetOfSignedCrlTemplate
NSS_Get_SECOID_AlgorithmIDTemplate
NSS_Get_SEC_BitStringTemplate
NSS_Get_SEC_OctetStringTemplate
NSS_Get_SEC_PointerToOctetStringTemplate
NSS_Get_SEC_SetOfAnyTemplate
PORT_ArenaZAlloc
CERT_DestroyCertArray
CERT_CertChainFromCert
CERT_VerifyCert

plc4

PL_strncasecmp

nspr4

PR_Now

msvcrt

_adjust_fdiv
malloc
_initterm
free
memmove
strchr

kernel32

DisableThreadLibraryCalls

Exports

Exports

CERT_ConvertAndDecodeCertificate
CERT_DecodeCertFromPackage
CERT_DecodeCertPackage
NSSSMIME_VersionCheck
NSS_CMSContentInfo_GetBulkKey
NSS_CMSContentInfo_GetBulkKeySize
NSS_CMSContentInfo_GetContent
NSS_CMSContentInfo_GetContentEncAlgTag
NSS_CMSContentInfo_GetContentTypeTag
NSS_CMSContentInfo_SetBulkKey
NSS_CMSContentInfo_SetContent
NSS_CMSContentInfo_SetContentEncAlg
NSS_CMSContentInfo_SetContent_Data
NSS_CMSContentInfo_SetContent_DigestedData
NSS_CMSContentInfo_SetContent_EncryptedData
NSS_CMSContentInfo_SetContent_EnvelopedData
NSS_CMSContentInfo_SetContent_SignedData
NSS_CMSDEREncode
NSS_CMSDecoder_Cancel
NSS_CMSDecoder_Finish
NSS_CMSDecoder_Start
NSS_CMSDecoder_Update
NSS_CMSDigestContext_Cancel
NSS_CMSDigestContext_FinishMultiple
NSS_CMSDigestContext_FinishSingle
NSS_CMSDigestContext_StartMultiple
NSS_CMSDigestContext_StartSingle
NSS_CMSDigestContext_Update
NSS_CMSDigestedData_Create
NSS_CMSDigestedData_Destroy
NSS_CMSDigestedData_GetContentInfo
NSS_CMSEncoder_Cancel
NSS_CMSEncoder_Finish
NSS_CMSEncoder_Start
NSS_CMSEncoder_Update
NSS_CMSEncryptedData_Create
NSS_CMSEncryptedData_Destroy
NSS_CMSEncryptedData_GetContentInfo
NSS_CMSEnvelopedData_AddRecipient
NSS_CMSEnvelopedData_Create
NSS_CMSEnvelopedData_Destroy
NSS_CMSEnvelopedData_GetContentInfo
NSS_CMSMessage_ContentLevel
NSS_CMSMessage_ContentLevelCount
NSS_CMSMessage_Copy
NSS_CMSMessage_Create
NSS_CMSMessage_CreateFromDER
NSS_CMSMessage_Destroy
NSS_CMSMessage_GetContent
NSS_CMSMessage_GetContentInfo
NSS_CMSMessage_IsEncrypted
NSS_CMSMessage_IsSigned
NSS_CMSRecipientInfo_Create
NSS_CMSRecipientInfo_CreateFromDER
NSS_CMSRecipientInfo_CreateNew
NSS_CMSRecipientInfo_CreateWithSubjKeyID
NSS_CMSRecipientInfo_CreateWithSubjKeyIDFromCert
NSS_CMSRecipientInfo_Destroy
NSS_CMSRecipientInfo_Encode
NSS_CMSRecipientInfo_GetCertAndKey
NSS_CMSRecipientInfo_UnwrapBulkKey
NSS_CMSRecipientInfo_WrapBulkKey
NSS_CMSSignedData_AddCertChain
NSS_CMSSignedData_AddCertList
NSS_CMSSignedData_AddCertificate
NSS_CMSSignedData_AddDigest
NSS_CMSSignedData_AddSignerInfo
NSS_CMSSignedData_Create
NSS_CMSSignedData_CreateCertsOnly
NSS_CMSSignedData_Destroy
NSS_CMSSignedData_GetContentInfo
NSS_CMSSignedData_GetDigestAlgs
NSS_CMSSignedData_GetSignerInfo
NSS_CMSSignedData_HasDigests
NSS_CMSSignedData_ImportCerts
NSS_CMSSignedData_SetDigestValue
NSS_CMSSignedData_SetDigests
NSS_CMSSignedData_SignerInfoCount
NSS_CMSSignedData_VerifyCertsOnly
NSS_CMSSignedData_VerifySignerInfo
NSS_CMSSignerInfo_AddMSSMIMEEncKeyPrefs
NSS_CMSSignerInfo_AddSMIMECaps
NSS_CMSSignerInfo_AddSMIMEEncKeyPrefs
NSS_CMSSignerInfo_AddSigningTime
NSS_CMSSignerInfo_Create
NSS_CMSSignerInfo_CreateWithSubjKeyID
NSS_CMSSignerInfo_Destroy
NSS_CMSSignerInfo_GetCertList
NSS_CMSSignerInfo_GetSignerCommonName
NSS_CMSSignerInfo_GetSignerEmailAddress
NSS_CMSSignerInfo_GetSigningCertificate
NSS_CMSSignerInfo_GetSigningTime
NSS_CMSSignerInfo_GetVerificationStatus
NSS_CMSSignerInfo_GetVersion
NSS_CMSSignerInfo_IncludeCerts
NSS_CMSUtil_VerificationStatusToString
NSS_SMIMESignerInfo_SaveSMIMEProfile
NSS_SMIMEUtil_FindBulkAlgForRecipients
SECMIME_DecryptionAllowed
SEC_PKCS12AddCertAndKey
SEC_PKCS12AddPasswordIntegrity
SEC_PKCS12CreateExportContext
SEC_PKCS12CreatePasswordPrivSafe
SEC_PKCS12CreateUnencryptedSafe
SEC_PKCS12DecoderFinish
SEC_PKCS12DecoderGetCerts
SEC_PKCS12DecoderImportBags
SEC_PKCS12DecoderIterateInit
SEC_PKCS12DecoderIterateNext
SEC_PKCS12DecoderSetTargetTokenCAs
SEC_PKCS12DecoderStart
SEC_PKCS12DecoderUpdate
SEC_PKCS12DecoderValidateBags
SEC_PKCS12DecoderVerify
SEC_PKCS12DestroyExportContext
SEC_PKCS12EnableCipher
SEC_PKCS12Encode
SEC_PKCS12IsEncryptionAllowed
SEC_PKCS12SetPreferredCipher
SEC_PKCS7AddCertificate
SEC_PKCS7AddRecipient
SEC_PKCS7AddSigningTime
SEC_PKCS7ContainsCertsOrCrls
SEC_PKCS7ContentIsEncrypted
SEC_PKCS7ContentIsSigned
SEC_PKCS7ContentType
SEC_PKCS7CopyContentInfo
SEC_PKCS7CreateCertsOnly
SEC_PKCS7CreateData
SEC_PKCS7CreateEncryptedData
SEC_PKCS7CreateEnvelopedData
SEC_PKCS7CreateSignedData
SEC_PKCS7DecodeItem
SEC_PKCS7DecoderAbort
SEC_PKCS7DecoderFinish
SEC_PKCS7DecoderStart
SEC_PKCS7DecoderUpdate
SEC_PKCS7DecryptContents
SEC_PKCS7DestroyContentInfo
SEC_PKCS7Encode
SEC_PKCS7EncodeItem
SEC_PKCS7EncoderAbort
SEC_PKCS7EncoderFinish
SEC_PKCS7EncoderStart
SEC_PKCS7EncoderUpdate
SEC_PKCS7GetCertificateList
SEC_PKCS7GetContent
SEC_PKCS7GetEncryptionAlgorithm
SEC_PKCS7GetSignerCommonName
SEC_PKCS7GetSignerEmailAddress
SEC_PKCS7GetSigningTime
SEC_PKCS7IncludeCertChain
SEC_PKCS7IsContentEmpty
SEC_PKCS7SetContent
SEC_PKCS7VerifyDetachedSignature
SEC_PKCS7VerifySignature

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 172KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a36f53afa67fa4896ad3c7c9f66ce00c

Headers

File Characteristics

Imports

nss3

plc4

nspr4

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 68KB - Virtual size: 67KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 172KB - Virtual size: 168KB

.rsrc Size: 4KB - Virtual size: 808B

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 68KB - Virtual size: 67KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 172KB - Virtual size: 168KB

.rsrc
Size: 4KB - Virtual size: 808B

.reloc
Size: 4KB - Virtual size: 2KB