76cd30509d948e3c9571abcc04119455_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

76cd30509d948e3c9571abcc04119455_JaffaCakes118
Size

329KB
MD5

76cd30509d948e3c9571abcc04119455
SHA1

f122f2fdb09c1d058bffeff86550360aa4de80f6
SHA256

5e329696a15edb5d5799dc5678856ef796be61d9fd9c0039383d25d528ff07f3
SHA512

e52b1a518a63afc61980a264d937ed1cff12f8022db736a71f3de8e88ddce099fd2a2fa7214992a391c99447ac4fe82241a02f2dd3de32fc49f0d2d9fc203f46
SSDEEP

6144:C0qxPE9EnoNEN7jcVq6N6o92H0qWkAsGSxrBVWxsVFvRhXdx3C:C0qqe7gB6oQ0IzfWxsVFbXP3C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
76cd30509d948e3c9571abcc04119455_JaffaCakes118

Files

76cd30509d948e3c9571abcc04119455_JaffaCakes118
.exe windows:5 windows x86 arch:x86

40046f19c3b2f7c1d61e8cc26333845f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlAcquireResourceExclusive
RtlFreeAnsiString
RtlCopyUnicodeString
RtlSubAuthoritySid
NtOpenProcessToken
RtlAppendUnicodeStringToString
RtlUniform
RtlLookupElementGenericTableAvl
RtlInitializeSid
RtlEraseUnicodeString
RtlDeleteTimerQueue
VerSetConditionMask
NtDuplicateObject
RtlVerifyVersionInfo
RtlEqualDomainName
RtlAllocateAndInitializeSid
RtlCopySid
RtlUpcaseUnicodeString
RtlConvertSharedToExclusive
RtlSubAuthorityCountSid
RtlDeregisterWait
DbgPrint
RtlEnterCriticalSection
RtlAcquireResourceShared
RtlRunDecodeUnicodeString
RtlLengthSid
RtlInitUnicodeString
RtlCompareMemory
NtOpenEvent
RtlAddAccessAllowedAce
NtAllocateLocallyUniqueId
NtOpenThreadToken
RtlTimeToTimeFields
RtlValidSid
RtlLookupElementGenericTable
RtlGetElementGenericTable
RtlDeleteElementGenericTable
RtlCopyLuid
RtlInitializeGenericTableAvl
RtlTimeFieldsToTime
RtlUnicodeStringToAnsiString
RtlAnsiStringToUnicodeString
NtQuerySystemInformation
NtQuerySystemTime
RtlEqualUnicodeString
RtlInitializeResource
RtlDowncaseUnicodeString
RtlSetDaclSecurityDescriptor
RtlDeleteResource
RtlLengthRequiredSid
RtlInsertElementGenericTableAvl
NtQueryInformationToken
RtlCreateAcl
RtlEqualSid
RtlSystemTimeToLocalTime
RtlInsertElementGenericTable
RtlPrefixUnicodeString
RtlRegisterWait
RtlInitAnsiString
RtlInitializeCriticalSection
RtlNtStatusToDosError
RtlLeaveCriticalSection
RtlConvertSidToUnicodeString
RtlFreeSid
RtlFreeUnicodeString
NtSetSecurityObject
RtlDeleteCriticalSection
RtlCreateSecurityDescriptor
RtlIntegerToUnicodeString
RtlCreateTimerQueue
NtAllocateVirtualMemory
NtWaitForSingleObject
RtlCompareUnicodeString
RtlReleaseResource
RtlCreateTimer
RtlOemStringToUnicodeString
NtCreateEvent
RtlInitializeGenericTable

cryptdll

CDBuildIntegrityVect
MD5Init
CDGenerateRandomBits
MD5Update
CDLocateCheckSum
CDFindCommonCSystemWithKey
CDLocateCSystem
MD5Final

msasn1

ASN1DecAlloc
ASN1BERDecOctetString
ASN1BERDecU32Val
ASN1BERDecCharString
ASN1BEREncBool
ASN1BERDecObjectIdentifier
ASN1_Encode
ASN1BERDecSXVal
ASN1intx_setuint32
ASN1BEREncBitString
ASN1_CloseEncoder
ASN1_Decode
ASN1BERDecExplicitTag
ASN1BERDecNotEndOfContents
ASN1BEREncOctetString
ASN1BEREncU32
ASN1Free
ASN1EncSetError
ASN1BERDecEndOfContents
ASN1BEREncEndOfContents
ASN1BEREncExplicitTag
ASN1BERDecPeekTag
ASN1CEREncGeneralizedTime
ASN1BERDecGeneralizedTime
ASN1ztcharstring_free
ASN1_CreateEncoder
ASN1charstring_free
ASN1BEREncObjectIdentifier
ASN1BEREncOpenType
ASN1BERDecBitString
ASN1BEREncS32
ASN1intx2uint32
ASN1_CreateDecoder
ASN1BEREncCharString
ASN1BERDecOpenType2
ASN1_FreeEncoded
ASN1objectidentifier_free
ASN1BERDecZeroCharString
ASN1intxisuint32
ASN1intx2int32
ASN1BERDecBool
ASN1DecSetError
ASN1BERDecSkip
ASN1_CloseDecoder
ASN1BEREncSX
ASN1_CreateModule
ASN1_FreeDecoded
ASN1octetstring_free
ASN1bitstring_free
ASN1intx_free
ASN1BERDecS32Val

kernel32

GetComputerNameW
InterlockedExchangeAdd
LoadLibraryA
GetACP
GetModuleFileNameW
CreateFileW
lstrlenA
GetSystemTimeAsFileTime
FormatMessageW
FileTimeToSystemTime
GetCurrentProcess
GetProcAddress
LocalAlloc
lstrcmpiA
InitializeCriticalSection
CreateEventW
OpenFileMappingW
GetLastError
CreateFileA
InterlockedCompareExchange
lstrcpyW
GetModuleHandleW
WriteFile
LocalFree
lstrcmpW
GetComputerNameExW
DisableThreadLibraryCalls
Sleep
QueryPerformanceCounter
RegisterWaitForSingleObjectEx
GetCurrentThread
SetUnhandledExceptionFilter
GetEnvironmentVariableW
LoadLibraryW
GetTickCount
WideCharToMultiByte
MapViewOfFileEx
UnmapViewOfFile
FreeLibrary
InterlockedIncrement
UnregisterWait
DeleteCriticalSection
ExpandEnvironmentStringsW
CloseHandle
CreateFileMappingW
lstrlenW
EnterCriticalSection
GetLocalTime
VirtualAlloc
InterlockedDecrement
OpenEventW
DebugBreak
UnhandledExceptionFilter
GetSystemInfo
GetCurrentThreadId
TerminateProcess
LeaveCriticalSection
GetModuleFileNameA
OutputDebugStringA
MultiByteToWideChar
SetEvent
InterlockedExchange
GetProfileStringA
RaiseException
GetCurrentProcessId

secur32

LsaGetLogonSessionData
LsaFreeReturnBuffer
CredUnmarshalTargetInfo
CredMarshalTargetInfo
FreeContextBuffer

advapi32

SetThreadToken
CryptDestroyHash
QueryServiceStatus
OpenServiceW
RegQueryInfoKeyW
RegOpenKeyExW
RevertToSelf
SystemFunction006
OpenSCManagerW
CryptGetHashParam
OpenProcessToken
CloseServiceHandle
RegEnumKeyExW
CredUnmarshalCredentialW
CryptHashData
RegisterEventSourceW
CredFree
CryptSetProvParam
CryptReleaseContext
DeregisterEventSource
RegCreateKeyExW
FreeSid
RegNotifyChangeKeyValue
RegConnectRegistryW
RegOpenKeyW
SystemFunction007
RegisterTraceGuidsW
AllocateAndInitializeSid
ReportEventW
CryptCreateHash
LookupAccountSidW
RegDeleteValueW
CryptGetProvParam
GetTraceLoggerHandle
RegSetValueExW
RegCloseKey
GetTokenInformation
RegQueryValueExW
CryptAcquireContextW
TraceEvent
OpenThreadToken
QueryServiceConfigW

msvcrt

wcsrchr
_strcmpi
free
sscanf
_wcsicmp
wcscmp
qsort
wcslen
wcsspn
_vsnprintf
strchr
_strnicmp
_stricmp
malloc
wcscat
_except_handler3
wcstoul
_wcsnicmp
_adjust_fdiv
_ultoa
wcscpy
_initterm
strrchr
sprintf
swprintf

user32

wsprintfW
CharLowerBuffW

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

40046f19c3b2f7c1d61e8cc26333845f

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

cryptdll

msasn1

kernel32

secur32

advapi32

msvcrt

user32

Sections

.text Size: 18KB - Virtual size: 17KB

.data Size: 9KB - Virtual size: 1.4MB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 36KB - Virtual size: 36KB

.rdata Size: 264KB - Virtual size: 263KB

.text
Size: 18KB - Virtual size: 17KB

.data
Size: 9KB - Virtual size: 1.4MB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 36KB - Virtual size: 36KB

.rdata
Size: 264KB - Virtual size: 263KB