840c5b182f8a896090f4a15ef120698d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

840c5b182f8a896090f4a15ef120698d_JaffaCakes118
Size

329KB
MD5

840c5b182f8a896090f4a15ef120698d
SHA1

56b25470d697127c57075a18a16ae60aeb4a4d64
SHA256

8f04b5c4fec3ed2c25c14c2ccf0eeb5282796535388bf0b43f7c30a4838a0eb9
SHA512

ed88474868e3f4216d93f9a6defbbb213c0d7fbbc423637b1328dd05b1bec1d653565360f550e41a42f73f1b9163ceedfe805dc8b86eb8add46f4d48e6fb6f4d
SSDEEP

6144:cWdoBjVguPNMkyIA7l7Wpi/7H/MlU9hgw+VyQcHTZAou1guqdH:VyNqEykyIARx7H0SDGcVAoueuc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
840c5b182f8a896090f4a15ef120698d_JaffaCakes118

Files

840c5b182f8a896090f4a15ef120698d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

8dab6f6f55ea2be5c0d4d9385dc32252

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msasn1

ASN1BEREncU32
ASN1BERDecPeekTag
ASN1intx_free
ASN1objectidentifier_free
ASN1intx2int32
ASN1BERDecBool
ASN1_Decode
ASN1_CloseEncoder
ASN1BERDecExplicitTag
ASN1intx2uint32
ASN1DecAlloc
ASN1BERDecCharString
ASN1BERDecOpenType2
ASN1BEREncExplicitTag
ASN1_CreateEncoder
ASN1EncSetError
ASN1_CloseDecoder
ASN1BEREncOpenType
ASN1BEREncBitString
ASN1intx_setuint32
ASN1CEREncGeneralizedTime
ASN1BEREncS32
ASN1BERDecGeneralizedTime
ASN1_FreeDecoded
ASN1BERDecObjectIdentifier
ASN1BERDecNotEndOfContents
ASN1BEREncBool
ASN1BERDecU32Val
ASN1_FreeEncoded
ASN1BERDecSkip
ASN1BEREncEndOfContents
ASN1BERDecBitString
ASN1charstring_free
ASN1BERDecZeroCharString
ASN1BERDecSXVal
ASN1Free
ASN1DecSetError
ASN1octetstring_free
ASN1BEREncCharString
ASN1BEREncOctetString
ASN1intxisuint32
ASN1bitstring_free
ASN1_CreateDecoder
ASN1BEREncObjectIdentifier
ASN1_Encode
ASN1BERDecOctetString
ASN1ztcharstring_free
ASN1_CreateModule
ASN1BEREncSX
ASN1BERDecS32Val
ASN1BERDecEndOfContents

user32

CharLowerBuffW
wsprintfW

advapi32

SetThreadToken
RegConnectRegistryW
RegCloseKey
RegisterTraceGuidsW
RegisterEventSourceW
RegOpenKeyW
SystemFunction007
RevertToSelf
CryptAcquireContextW
SystemFunction006
OpenProcessToken
FreeSid
CryptSetProvParam
LookupAccountSidW
CryptDestroyHash
RegCreateKeyExW
TraceEvent
CryptHashData
OpenSCManagerW
OpenThreadToken
DeregisterEventSource
CryptReleaseContext
RegOpenKeyExW
GetTraceLoggerHandle
RegDeleteValueW
OpenServiceW
CryptGetProvParam
RegEnumKeyExW
CryptCreateHash
RegQueryInfoKeyW
QueryServiceStatus
CredFree
CredUnmarshalCredentialW
CryptGetHashParam
ReportEventW
QueryServiceConfigW
RegQueryValueExW
AllocateAndInitializeSid
CloseServiceHandle
RegSetValueExW
RegNotifyChangeKeyValue
GetTokenInformation

msvcrt

qsort
swprintf
wcslen
_strnicmp
_stricmp
wcscmp
wcstoul
_ultoa
wcscat
strchr
malloc
_wcsicmp
_adjust_fdiv
sscanf
wcsspn
_wcsnicmp
_strcmpi
_initterm
wcscpy
sprintf
free
wcsrchr
_except_handler3
strrchr
_vsnprintf

ntdll

RtlConvertSharedToExclusive
RtlInitializeGenericTableAvl
RtlDeleteElementGenericTable
RtlInitializeSid
RtlDeregisterWait
VerSetConditionMask
RtlInitializeResource
RtlRunDecodeUnicodeString
RtlDowncaseUnicodeString
RtlLeaveCriticalSection
NtCreateEvent
NtQuerySystemInformation
NtOpenEvent
RtlAcquireResourceShared
RtlCreateTimer
RtlDeleteCriticalSection
RtlUniform
RtlIntegerToUnicodeString
RtlInitializeCriticalSection
RtlOemStringToUnicodeString
RtlCopySid
RtlEqualSid
DbgPrint
RtlEnterCriticalSection
NtOpenThreadToken
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlSetDaclSecurityDescriptor
RtlFreeUnicodeString
RtlPrefixUnicodeString
RtlInsertElementGenericTableAvl
RtlInsertElementGenericTable
RtlGetElementGenericTable
NtAllocateLocallyUniqueId
RtlSystemTimeToLocalTime
RtlDeleteTimerQueue
NtAllocateVirtualMemory
RtlLookupElementGenericTable
RtlSubAuthoritySid
RtlLengthSid
RtlFreeAnsiString
NtQuerySystemTime
RtlLookupElementGenericTableAvl
NtSetSecurityObject
RtlEqualDomainName
RtlSubAuthorityCountSid
RtlLengthRequiredSid
RtlValidSid
RtlTimeToTimeFields
RtlEqualUnicodeString
RtlFreeSid
NtOpenProcessToken
RtlInitUnicodeString
NtQueryInformationToken
RtlNtStatusToDosError
NtWaitForSingleObject
RtlCreateAcl
RtlCompareUnicodeString
RtlCompareMemory
NtClose
RtlEraseUnicodeString
RtlConvertSidToUnicodeString
RtlCopyLuid
RtlVerifyVersionInfo
RtlAppendUnicodeStringToString
RtlAddAccessAllowedAce
RtlAcquireResourceExclusive
RtlAllocateAndInitializeSid
RtlReleaseResource
RtlRegisterWait
RtlCreateTimerQueue
RtlCreateSecurityDescriptor
RtlDeleteResource
RtlInitializeGenericTable
RtlCopyUnicodeString
RtlAnsiStringToUnicodeString
NtDuplicateObject
RtlUpcaseUnicodeString

kernel32

CreateFileMappingW
WideCharToMultiByte
RegisterWaitForSingleObjectEx
GetTickCount
RaiseException
GetModuleFileNameW
UnregisterWait
MapViewOfFileEx
GetComputerNameExW
GetCurrentProcessId
GetCurrentProcess
OutputDebugStringA
GetModuleHandleW
UnmapViewOfFile
lstrcmpW
InterlockedCompareExchange
OpenFileMappingW
CreateFileW
InterlockedExchangeAdd
lstrlenA
InterlockedDecrement
GetCurrentThread
LoadLibraryW
CreateEventW
GetSystemTimeAsFileTime
GetProcAddress
GetModuleFileNameA
FileTimeToSystemTime
LocalFree
DisableThreadLibraryCalls
SetUnhandledExceptionFilter
OpenEventW
SetEvent
VirtualAlloc
GetProfileStringA
UnhandledExceptionFilter
FormatMessageW
InterlockedExchange
MultiByteToWideChar
InitializeCriticalSection
DebugBreak
GetEnvironmentVariableW
CreateFileA
GetLocalTime
lstrcpyW
WriteFile
ExpandEnvironmentStringsW
InterlockedIncrement
LocalAlloc
CloseHandle
GetComputerNameW
FreeLibrary
GetSystemInfo
lstrlenW
GetCurrentThreadId
GetACP
GetLastError
DeleteCriticalSection
lstrcmpiA
LeaveCriticalSection
EnterCriticalSection
QueryPerformanceCounter
TerminateProcess
LoadLibraryA
Sleep

secur32

LsaGetLogonSessionData
CredMarshalTargetInfo
CredUnmarshalTargetInfo
FreeContextBuffer
LsaFreeReturnBuffer

cryptdll

CDFindCommonCSystemWithKey
CDLocateCSystem
CDGenerateRandomBits
CDBuildIntegrityVect
MD5Final
MD5Init
MD5Update
CDLocateCheckSum

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8dab6f6f55ea2be5c0d4d9385dc32252

Headers

DLL Characteristics

File Characteristics

Imports

msasn1

user32

advapi32

msvcrt

ntdll

kernel32

secur32

cryptdll

Sections

.text Size: 18KB - Virtual size: 17KB

.data Size: 9KB - Virtual size: 1.4MB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 36KB - Virtual size: 36KB

.rdata Size: 264KB - Virtual size: 263KB

.text
Size: 18KB - Virtual size: 17KB

.data
Size: 9KB - Virtual size: 1.4MB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 36KB - Virtual size: 36KB

.rdata
Size: 264KB - Virtual size: 263KB