78d87318189f05746b14b8b2b18b971e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

78d87318189f05746b14b8b2b18b971e_JaffaCakes118
Size

860KB
MD5

78d87318189f05746b14b8b2b18b971e
SHA1

d2326ea5233f7adcba4757960ac5b85fde7da661
SHA256

28a07df364332bcecf378f03d82216f1648714dd3d261b789983b72019548046
SHA512

190028f6a292e7193d5a4f12ddebb3eace8edca2a988fb560a1e5019e8f1143b3b00df754788c3b5a74bf64bd76b9dfdfbd75af6d7048a27abd8901d7706ea7d
SSDEEP

24576:YOrSD++/eG5AeDtRDH97lNk4e9oI7qEGgaXpLVx:YOmB/B5A0RDHdrgq0qxd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
78d87318189f05746b14b8b2b18b971e_JaffaCakes118

Files

78d87318189f05746b14b8b2b18b971e_JaffaCakes118
.exe windows:5 windows x86 arch:x86

37583b46461c0ad6cc364098436e03ac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlxUnicodeStringToOemSize
NtLoadDriver
NtQueryDirectoryFile
RtlPushFrame
RtlQueryProcessBackTraceInformation
NtQuerySymbolicLinkObject
RtlCreateSystemVolumeInformationFolder
RtlInitializeRXact
NtReplyPort
RtlGetProcessHeaps
RtlIpv6StringToAddressW
_chkstk
ZwQueryTimer
RtlConvertUlongToLargeInteger
RtlReleasePebLock
RtlEqualComputerName
RtlRunEncodeUnicodeString
ZwDeleteBootEntry
ZwSetContextThread
RtlCharToInteger
wcsrchr
NtResumeThread
RtlActivateActivationContextEx
RtlCaptureStackContext
RtlAbsoluteToSelfRelativeSD
ZwDeleteKey
NtSetInformationThread
ZwQueryInformationPort
RtlTryEnterCriticalSection
ZwQueueApcThread
NtCreateSection
RtlAppendAsciizToString

mprddm

RasAcctProviderInitialize
RasAuthProviderInitialize
DDMAdminConnectionClearStats
DDMAdminPortClearStats
DDMTransportCreate
DDMAdminPortDisconnect
RasAuthProviderFreeAttributes
IfObjectLoadPhonebookInfo
RasAcctProviderFreeAttributes
DDMDisconnectInterface
DDMAdminPortEnum
RasAcctProviderInterimAccounting
RasAuthConfigChangeNotification
DDMAdminConnectionEnum
RasAuthProviderAuthenticateUser
IfObjectInitiatePersistentConnections
DDMAdminServerGetInfo
IfObjectNotifyOfReachabilityChange
DDMConnectInterface
DDMRegisterConnectionNotification
DDMAdminPortGetInfo
DDMGetIdentityAttributes
DDMAdminInterfaceDisconnect
DDMServicePostListens
RasAcctProviderStartAccounting
IfObjectSetDialoutHoursRestriction
DDMServiceInitialize
RasAcctProviderStopAccounting
DDMAdminConnectionGetInfo
DDMAdminPortReset
DDMAdminInterfaceConnect
RasAcctConfigChangeNotification
RasAcctProviderTerminate

ifsutil

?QueryChildren@DIGRAPH@@QBEEKPAVNUMBER_SET@@@Z
?DosDriveNameToNtDriveName@IFS_SYSTEM@@SGEPBVWSTRING@@PAV2@@Z
?Initialize@SUPERAREA@@IAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@KPAVMESSAGE@@@Z
?GetNextDataSlot@TLINK@@QAEAAVBIG_INT@@XZ
??0VOL_LIODPDRV@@IAE@XZ
?Remove@NUMBER_SET@@QAEEVBIG_INT@@@Z
?QueryMediaByte@DP_DRIVE@@QBEEXZ
??0TLINK@@QAE@XZ
?Initialize@TLINK@@QAEEG@Z
?AddVolumeName@MOUNT_POINT_MAP@@QAEEPAVWSTRING@@0@Z
??0LOG_IO_DP_DRIVE@@QAE@XZ
?GetFirst@TLINK@@QAEPAXXZ
??1NUMBER_SET@@UAE@XZ
?Initialize@SPARSE_SET@@QAEEXZ
?GetSortedNext@TLINK@@QAEPAXPAX@Z
?AddDriveName@MOUNT_POINT_MAP@@QAEEPAVWSTRING@@0@Z
?Add@NUMBER_SET@@QAEEVBIG_INT@@@Z
?EnableVolumeUpgrade@IFS_SYSTEM@@SGEPBVWSTRING@@@Z
??0SUPERAREA@@IAE@XZ
?RemoveEdge@DIGRAPH@@QAEEKK@Z
??1DIGRAPH@@UAE@XZ
?QueryFreeDiskSpace@IFS_SYSTEM@@SGEPBVWSTRING@@PAVBIG_INT@@@Z
?Remove@NUMBER_SET@@QAEEVBIG_INT@@0@Z
?IsATformat@DP_DRIVE@@QBEEXZ
??0MOUNT_POINT_MAP@@QAE@XZ
?Read@LOG_IO_DP_DRIVE@@QAEEVBIG_INT@@KPAX@Z
?QueryNtfsTime@IFS_SYSTEM@@SGXPAT_LARGE_INTEGER@@@Z
??0CANNED_SECURITY@@QAE@XZ
??0READ_WRITE_CACHE@@QAE@XZ
?IsArcSystemPartition@IFS_SYSTEM@@SGEPBVWSTRING@@PAE@Z
??0READ_CACHE@@QAE@XZ
?CheckAndRemove@NUMBER_SET@@QAEEVBIG_INT@@PAE@Z
??1VOL_LIODPDRV@@UAE@XZ
??0MOUNT_POINT_TUPLE@@QAE@XZ
?AddNext@NUMBER_SET@@QAEEVBIG_INT@@@Z
?CheckAndRemove@SPARSE_SET@@QAEEVBIG_INT@@PAE@Z
??0DIGRAPH@@QAE@XZ
?SetVolumeLabelAndPrintFormatReport@VOL_LIODPDRV@@QAEEPBVWSTRING@@PAVMESSAGE@@@Z
?QueryParentsWithChildren@DIGRAPH@@QBEEPAVNUMBER_SET@@K@Z
?DismountVolume@IFS_SYSTEM@@SGEPBVWSTRING@@@Z

kernel32

GetConsoleCursorInfo
QueryPerformanceCounter
AssignProcessToJobObject
EnumResourceTypesA
VirtualAlloc
LeaveCriticalSection
SystemTimeToTzSpecificLocalTime
EnumUILanguagesA
LZCloseFile
GetSystemDefaultLCID
GetVersionExA
CancelIo
FindNextChangeNotification
SetFilePointer
SetTimeZoneInformation
GetQueuedCompletionStatus
SetInformationJobObject
InterlockedExchangeAdd
WaitCommEvent
GetUserDefaultLCID
BaseCleanupAppcompatCacheSupport
SystemTimeToFileTime
DuplicateConsoleHandle
SetConsoleNumberOfCommandsA
MoveFileExW
EnterCriticalSection
LZRead
FindFirstVolumeMountPointW
GetFileAttributesExW
IsDebuggerPresent
InterlockedFlushSList
GetTempPathW
CreateJobObjectW
SizeofResource
SetCommBreak
WritePrivateProfileSectionA
GetStartupInfoA
GetComPlusPackageInstallStatus
CreateDirectoryW
IsBadStringPtrW
IsValidLocale
GetThreadPriorityBoost
IsValidCodePage
ReadConsoleInputExW
LoadLibraryA
GetUserGeoID
DebugBreakProcess
SetFileApisToOEM

crypt32

CertRegisterSystemStore
RegCreateKeyExU
CertRegisterPhysicalStore
CertSetCertificateContextPropertiesFromCTLEntry
I_CryptDetachTls
CertFreeCTLContext
CertSerializeCertificateStoreElement
CryptUninstallDefaultContext
I_CryptFreeLruCache
CryptInitOIDFunctionSet
CryptEnumKeyIdentifierProperties
RegSetValueExU
CryptSignAndEncryptMessage
I_CryptUninstallAsn1Module
CertOpenSystemStoreW
CryptGetOIDFunctionAddress
CryptVerifySignatureU
CryptGetMessageSignerCount
I_CryptReadTrustedPublisherDWORDValueFromRegistry
CertAddCRLLinkToStore
CertGetNameStringA
CertAddStoreToCollection
CryptBinaryToStringW
CryptCloseAsyncHandle
CertGetIntendedKeyUsage
CertFindSubjectInCTL
CertAddCRLContextToStore
I_CryptUnregisterSmartCardStore
I_CryptWalkAllLruCacheEntries
CryptGetMessageCertificates
CertSetCTLContextProperty
CertDuplicateStore
CryptMsgSignCTL

netapi32

I_BrowserQueryEmulatedDomains
DsRoleDemoteDc
NetServerComputerNameAdd
I_NetAccountDeltas
NlBindingAddServerToCache
NetpIsRemote
NetReplExportDirLock
NetScheduleJobGetInfo
NetLocalGroupSetMembers
I_NetDfsIsThisADomainName
I_BrowserDebugTrace
NetServerEnum
NetUserSetInfo
NetAuditWrite
NetWkstaUserGetInfo
NetServerTransportEnum
NetShareCheck
NetUserGetInfo
I_NetAccountSync
DsRoleGetPrimaryDomainInformation
DsValidateSubnetNameA
I_BrowserQueryStatistics
I_NetDfsGetVersion
NetServerComputerNameDel
DsAddressToSiteNamesExA
DsMergeForestTrustInformationW
I_NetLogonSamLogonWithFlags

lz32

LZCreateFileW
LZClose
CopyLZFile
GetExpandedNameA
LZCloseFile
LZRead
LZStart
LZCopy
LZOpenFileW
LZInit
LZDone
LZOpenFileA
LZSeek

wmdmlog

DllGetClassObject

Sections

.text
Size: 198KB - Virtual size: 198KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 239KB - Virtual size: 239KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 420KB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

37583b46461c0ad6cc364098436e03ac

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

mprddm

ifsutil

kernel32

crypt32

netapi32

lz32

wmdmlog

Sections

.text Size: 198KB - Virtual size: 198KB

.rdata Size: 239KB - Virtual size: 239KB

.data Size: 420KB - Virtual size: 1.9MB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 198KB - Virtual size: 198KB

.rdata
Size: 239KB - Virtual size: 239KB

.data
Size: 420KB - Virtual size: 1.9MB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 1024B - Virtual size: 1024B