690e22912be7784b6e4850beff0560b6_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

690e22912be7784b6e4850beff0560b6_JaffaCakes118
Size

335KB
MD5

690e22912be7784b6e4850beff0560b6
SHA1

2ca210bb22fe332ae8057b8ba730f15735646f56
SHA256

7ffd8a1a7c858333fedffd87e1b47b69d575e9850bd31a302598769c9f9423be
SHA512

b580ab0abb4dfb47de0ceb3b08761b5da3f092b39756105125c634eaf3fc541d9fafd92b33931f19aa09654d183e4aec0ba4b24b2fd8c0f55f3b71ee30237075
SSDEEP

6144:oxNFlJdAECZBHb1nzste/htEtK4z6r8jBXumTNlgao15hgVv7X:oxNFrmEC3Hb1g4/gtK06raemx+ao12j

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
690e22912be7784b6e4850beff0560b6_JaffaCakes118

Files

690e22912be7784b6e4850beff0560b6_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

923bfef7c53d36f4993102791681172e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

objsel.pdb

Imports

msvcrt

__RTDynamicCast
_purecall
wcscpy
wcsrchr
wcschr
_wcsnicmp
_itow
iswspace
wcstoul
memmove
wcsstr
?terminate@@YAXXZ
wcsspn
towlower
wcslen
_except_handler3
??0exception@@QAE@ABV0@@Z
__CxxFrameHandler
??1type_info@@UAE@XZ
_onexit
__dllonexit
_adjust_fdiv
malloc
_initterm
free
_CxxThrowException

msvcp60

?_Xran@std@@YAXXZ
?assign@?$char_traits@G@std@@SAXAAGABG@Z
?copy@?$char_traits@G@std@@SAPAGPAGPBGI@Z
?_Xlen@std@@YAXXZ
?length@?$char_traits@G@std@@SAIPBG@Z
?move@?$char_traits@G@std@@SAPAGPAGPBGI@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
?compare@?$char_traits@G@std@@SAHPBG0I@Z
?find@?$char_traits@G@std@@SAPBGPBGIABG@Z
?eq@?$char_traits@G@std@@SA_NABG0@Z
?assign@?$char_traits@G@std@@SAPAGPAGIABG@Z
??0bad_alloc@std@@QAE@ABV01@@Z
??1bad_alloc@std@@UAE@XZ
??0bad_alloc@std@@QAE@PBD@Z

ntdll

RtlCreateUnicodeString
RtlRunDecodeUnicodeString
RtlFreeUnicodeString
NtImpersonateAnonymousToken
NtOpenThreadToken
NtSetInformationThread
RtlRunEncodeUnicodeString

kernel32

LocalFree
GetLastError
CreateThread
LocalAlloc
ReleaseSemaphore
WaitForSingleObject
SetEvent
EnterCriticalSection
LeaveCriticalSection
lstrcpyW
lstrcmpiW
DeleteCriticalSection
InitializeCriticalSection
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
GetSystemTimeAsFileTime
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenW
SetLastError
DisableThreadLibraryCalls
MulDiv
FormatMessageW
LoadLibraryW
FreeLibrary
CompareStringW
GetComputerNameW
GetModuleFileNameW
lstrcpynW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
CloseHandle
lstrcmpW
WideCharToMultiByte
GetComputerNameExW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateEventW
CreateSemaphoreW
GetWindowsDirectoryW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
lstrlenA
MultiByteToWideChar
OutputDebugStringW

user32

IsCharAlphaW
MsgWaitForMultipleObjects
PeekMessageW
TranslateMessage
DispatchMessageW
GetSystemMenu
SetMenuItemInfoW
LoadStringW
LoadMenuW
GetSubMenu
GetMenuItemCount
GetMenuItemInfoW
EnableMenuItem
GetForegroundWindow
GetKeyState
RedrawWindow
GetWindowDC
GetDC
ReleaseDC
DestroyWindow
RegisterClipboardFormatW
IsDlgButtonChecked
GetWindowThreadProcessId
SendDlgItemMessageW
CallWindowProcW
WinHelpW
DestroyIcon
LoadIconW
LoadCursorW
SetCursor
MapWindowPoints
GetWindowLongW
SetWindowLongW
RegisterClassW
SystemParametersInfoW
ShowWindow
IsWindowVisible
GetParent
FillRect
GetSysColor
GetWindowTextLengthW
GetWindowTextW
DrawTextExW
EndPaint
InvalidateRect
DefWindowProcW
CreatePopupMenu
IsWindowEnabled
AppendMenuW
GetWindowRect
TrackPopupMenu
DestroyMenu
GetFocus
SetFocus
SetWindowTextW
IsWindow
wsprintfW
GetClientRect
GetSystemMetrics
MapDialogRect
SetWindowPos
SetDlgItemTextW
EndDialog
EnableWindow
GetDlgItem
SendMessageW
PostMessageW
MessageBoxW
GetDesktopWindow
CreateWindowExW
CreateDialogParamW
DialogBoxParamW
BeginPaint

gdi32

SetTextAlign
TextOutW
MoveToEx
LineTo
SetBkColor
SetTextColor
SelectObject
CreatePen
DeleteObject
GetDeviceCaps
GetTextMetricsW
GetTextExtentPoint32W

advapi32

LookupAccountNameW
EqualSid
IsValidSid
CopySid
LsaEnumerateTrustedDomains
RegDeleteKeyW
RegQueryValueExW
LookupAccountSidW
AllocateAndInitializeSid
LsaFreeMemory
LsaLookupSids
LsaClose
LsaOpenPolicy
FreeSid
RevertToSelf
ImpersonateLoggedOnUser
LogonUserW
LsaQueryInformationPolicy
GetSidSubAuthority
GetSidIdentifierAuthority
GetSidLengthRequired
GetSidSubAuthorityCount
RegCloseKey
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegConnectRegistryW
RegOpenKeyExW

ole32

CoCreateInstance
CoUninitialize
CoInitialize
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoTaskMemAlloc
CoTaskMemFree
ReleaseStgMedium

oleaut32

SystemTimeToVariantTime
VariantInit
VariantCopy
SafeArrayGetLBound
SafeArrayGetUBound
VariantClear
SafeArrayAccessData
SafeArrayUnaccessData
SysFreeString
SafeArrayCreate
SafeArrayGetElement
SysAllocString

activeds

ord9
ord7
ord4
ord6
ord5
ord13

netapi32

DsRoleFreeMemory
NetUseDel
DsRoleGetPrimaryDomainInformation
DsGetDcNameW
DsEnumerateDomainTrustsW
NetApiBufferFree
NetWkstaGetInfo
NetUseAdd

secur32

LsaConnectUntrusted
LsaDeregisterLogonProcess
LsaFreeReturnBuffer
LsaCallAuthenticationPackage
TranslateNameW

ntdsapi

DsFreePasswordCredentials
DsBindWithCredW
DsBindW
DsMakePasswordCredentialsW
DsCrackNamesW
DsFreeNameResultW
DsUnBindW

shell32

ord258
ord259

credui

CredUIPromptForCredentialsW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 188KB - Virtual size: 188KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 58KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

923bfef7c53d36f4993102791681172e

Headers

File Characteristics

PDB Paths

Imports

msvcrt

msvcp60

ntdll

kernel32

user32

gdi32

advapi32

ole32

oleaut32

activeds

netapi32

secur32

ntdsapi

shell32

credui

Exports

Exports

Sections

.text Size: 188KB - Virtual size: 188KB

.data Size: 58KB - Virtual size: 61KB

.rsrc Size: 73KB - Virtual size: 73KB

.reloc Size: 13KB - Virtual size: 13KB

.text
Size: 188KB - Virtual size: 188KB

.data
Size: 58KB - Virtual size: 61KB

.rsrc
Size: 73KB - Virtual size: 73KB

.reloc
Size: 13KB - Virtual size: 13KB