65dcc80e1251bd512b5ab153818597b4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

65dcc80e1251bd512b5ab153818597b4_JaffaCakes118
Size

469KB
MD5

65dcc80e1251bd512b5ab153818597b4
SHA1

a5366be3890f24ca4689d2190768e81b9ca9edff
SHA256

2db139d1e87b68987ba92650bff76ac283a28cb6ba663bb46178b1138a47d9aa
SHA512

edf4d36c7766dc61c4e31da7630419f1679ff318a017565e64f7f9c3c8178da4975c667a5eaf352cad1891fa5dee5b80663ea5c893956eb271f7edcaeee09e00
SSDEEP

6144:IawJTGa+xzgpDbnSUSwpKCbvRFUiYhLJmSspm9k/ZF84JO11xfTckU3SstGSkYvw:XwozSnBa38S8KY8hTZUistFde1T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
65dcc80e1251bd512b5ab153818597b4_JaffaCakes118

Files

65dcc80e1251bd512b5ab153818597b4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2c9cf54a9aa69df414ed74349832ec66

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetEnvironmentVariableW
GetComputerNameExW
UnmapViewOfFile
WriteFile
MultiByteToWideChar
TerminateProcess
GetLastError
LoadLibraryW
MapViewOfFileEx
OpenEventW
GetACP
ExpandEnvironmentStringsW
OpenFileMappingW
QueryPerformanceCounter
InterlockedExchangeAdd
DebugBreak
UnhandledExceptionFilter
GetModuleFileNameW
lstrcpyW
Sleep
lstrcmpW
DeleteCriticalSection
GetModuleHandleW
LocalFree
FormatMessageW
RegisterWaitForSingleObjectEx
GetSystemTimeAsFileTime
GetCurrentThread
InterlockedCompareExchange
GetCurrentProcessId
lstrlenA
OutputDebugStringA
FreeLibrary
SetEvent
UnregisterWait
LeaveCriticalSection
GetModuleFileNameA
InterlockedExchange
LoadLibraryA
InterlockedDecrement
GetLocalTime
SetUnhandledExceptionFilter
GetProfileStringA
EnterCriticalSection
InitializeCriticalSection
CreateFileW
CreateFileMappingW
CloseHandle
GetSystemInfo
InterlockedIncrement
DisableThreadLibraryCalls
FileTimeToSystemTime
GetTickCount
LocalAlloc
GetComputerNameW
lstrlenW
GetCurrentProcess
RaiseException
GetProcAddress
GetCurrentThreadId
CreateFileA
lstrcmpiA
WideCharToMultiByte
CreateEventW
VirtualAlloc

user32

CharLowerBuffW
wsprintfW

msvcrt

swprintf
strrchr
sscanf
wcscmp
sprintf
_stricmp
wcscat
_except_handler3
_adjust_fdiv
strchr
_strcmpi
wcstoul
free
_strnicmp
qsort
wcscpy
wcsspn
_wcsnicmp
wcslen
wcsrchr
_wcsicmp
malloc
_initterm
_vsnprintf
_ultoa

msasn1

ASN1CEREncGeneralizedTime
ASN1_CreateModule
ASN1BEREncBool
ASN1Free
ASN1_CreateDecoder
ASN1BERDecBool
ASN1_CloseDecoder
ASN1BERDecSXVal
ASN1bitstring_free
ASN1objectidentifier_free
ASN1BERDecZeroCharString
ASN1BEREncU32
ASN1charstring_free
ASN1BERDecNotEndOfContents
ASN1BEREncSX
ASN1_FreeDecoded
ASN1EncSetError
ASN1BERDecEndOfContents
ASN1BERDecGeneralizedTime
ASN1octetstring_free
ASN1DecSetError
ASN1_CreateEncoder
ASN1BEREncOpenType
ASN1intx2int32
ASN1BERDecObjectIdentifier
ASN1BEREncExplicitTag
ASN1DecAlloc
ASN1BEREncBitString
ASN1BEREncS32
ASN1BERDecExplicitTag
ASN1BERDecBitString
ASN1BEREncOctetString
ASN1_Encode
ASN1ztcharstring_free
ASN1BERDecOpenType2
ASN1BERDecOctetString
ASN1intx_free
ASN1BERDecCharString
ASN1BERDecPeekTag
ASN1BERDecS32Val
ASN1BEREncCharString
ASN1_FreeEncoded
ASN1BEREncObjectIdentifier
ASN1BERDecSkip
ASN1BERDecU32Val
ASN1intx_setuint32
ASN1_Decode
ASN1BEREncEndOfContents
ASN1intx2uint32
ASN1_CloseEncoder
ASN1intxisuint32

secur32

LsaFreeReturnBuffer
FreeContextBuffer
CredMarshalTargetInfo
CredUnmarshalTargetInfo
LsaGetLogonSessionData

ntdll

NtWaitForSingleObject
RtlInitializeSid
RtlTimeFieldsToTime
RtlSetDaclSecurityDescriptor
RtlEqualUnicodeString
RtlDowncaseUnicodeString
RtlDeregisterWait
RtlInitAnsiString
RtlGetElementGenericTable
RtlEraseUnicodeString
RtlDeleteCriticalSection
RtlCreateSecurityDescriptor
NtOpenThreadToken
RtlAcquireResourceExclusive
RtlCopyUnicodeString
RtlCopySid
RtlConvertSharedToExclusive
DbgPrint
RtlInitializeCriticalSection
RtlEnterCriticalSection
NtQueryInformationToken
RtlLengthRequiredSid
RtlCreateTimer
RtlCompareMemory
RtlTimeToTimeFields
RtlInsertElementGenericTable
RtlCreateAcl
NtAllocateLocallyUniqueId
RtlLeaveCriticalSection
RtlDeleteElementGenericTable
RtlOemStringToUnicodeString
NtDuplicateObject
RtlUpcaseUnicodeString
RtlCreateTimerQueue
RtlEqualDomainName
RtlPrefixUnicodeString
RtlConvertSidToUnicodeString
RtlIntegerToUnicodeString
RtlRunDecodeUnicodeString
RtlCompareUnicodeString
NtAllocateVirtualMemory
RtlAnsiStringToUnicodeString
NtClose
RtlAcquireResourceShared
RtlVerifyVersionInfo
RtlEqualSid
RtlCopyLuid
NtQuerySystemTime
RtlUnicodeStringToAnsiString
RtlAppendUnicodeStringToString
RtlInitializeResource
RtlFreeSid
RtlFreeAnsiString
RtlUniform
RtlAllocateAndInitializeSid
RtlLookupElementGenericTable
NtCreateEvent
NtOpenEvent
RtlInsertElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlRegisterWait
RtlSystemTimeToLocalTime
RtlSubAuthorityCountSid
RtlInitUnicodeString
RtlDeleteResource
NtOpenProcessToken
RtlInitializeGenericTable
RtlSubAuthoritySid
NtQuerySystemInformation
RtlLengthSid
NtSetSecurityObject
RtlLookupElementGenericTableAvl
RtlAddAccessAllowedAce
RtlValidSid
RtlFreeUnicodeString
RtlReleaseResource
RtlNtStatusToDosError
RtlDeleteTimerQueue

cryptdll

MD5Update
CDFindCommonCSystemWithKey
MD5Final
CDGenerateRandomBits
CDLocateCSystem
MD5Init
CDLocateCheckSum
CDBuildIntegrityVect

advapi32

SystemFunction006
QueryServiceStatus
GetTraceLoggerHandle
CredUnmarshalCredentialW
RegCreateKeyExW
CryptReleaseContext
RegCloseKey
AllocateAndInitializeSid
OpenServiceW
FreeSid
RegEnumKeyExW
RevertToSelf
CryptSetProvParam
ReportEventW
RegOpenKeyExW
CryptGetProvParam
RegQueryValueExW
SetThreadToken
TraceEvent
CloseServiceHandle
QueryServiceConfigW
CryptCreateHash
OpenSCManagerW
CredFree
CryptHashData
DeregisterEventSource
SystemFunction007
RegConnectRegistryW
RegisterTraceGuidsW
CryptDestroyHash
RegQueryInfoKeyW
RegSetValueExW
RegDeleteValueW
GetTokenInformation
LookupAccountSidW
RegOpenKeyW
RegNotifyChangeKeyValue
RegisterEventSourceW
OpenProcessToken
CryptAcquireContextW
OpenThreadToken
CryptGetHashParam

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 984KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 367KB - Virtual size: 366KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2c9cf54a9aa69df414ed74349832ec66

Headers

File Characteristics

Imports

kernel32

user32

msvcrt

msasn1

secur32

ntdll

cryptdll

advapi32

Sections

.text Size: 31KB - Virtual size: 31KB

.reloc Size: 512B - Virtual size: 20B

.data Size: 23KB - Virtual size: 984KB

.rsrc Size: 46KB - Virtual size: 45KB

.rdata Size: 367KB - Virtual size: 366KB

.text
Size: 31KB - Virtual size: 31KB

.reloc
Size: 512B - Virtual size: 20B

.data
Size: 23KB - Virtual size: 984KB

.rsrc
Size: 46KB - Virtual size: 45KB

.rdata
Size: 367KB - Virtual size: 366KB