85873de6e1b6ed168ca45b3c700356b6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

85873de6e1b6ed168ca45b3c700356b6_JaffaCakes118
Size

29KB
MD5

85873de6e1b6ed168ca45b3c700356b6
SHA1

0fee06c4f52a07f974962244e14480685a1c78a7
SHA256

591e7204d6965986350036e38d2d8ccc9e2683252b41626c46b7f586307184f2
SHA512

05bda06d88d791e8c941b441c7f0315b4f30ba0df931bdc5fcfa6589ddc1e1401d9e2727c7f96c0d6b3f263337279473f46bc2e37940d86aa3d1f0b9ef1038e1
SSDEEP

768:T7vex/4X6ItjcdgZzcWRB+1ROWWdKAXY:T7vK/Q9tj/cWr+1ROWWdKAo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
85873de6e1b6ed168ca45b3c700356b6_JaffaCakes118

Files

85873de6e1b6ed168ca45b3c700356b6_JaffaCakes118
.dll windows:4 windows x86 arch:x86

79b6286ff69ccbfef2571579293fc1bc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Ideacts Work\Work\Dev\CSM\CSM\BIN\TerminalSetting.pdb

Imports

mfc80

ord1037
ord1092
ord1208
ord1098
ord371
ord1084
ord1167
ord1120
ord1201
ord1175
ord1177
ord314
ord1209
ord581
ord315
ord765
ord6754
ord907
ord911
ord1482
ord1916
ord6138
ord764
ord2272
ord6168
ord4109
ord6099
ord1489
ord299
ord6703
ord5403
ord2468
ord2322
ord3023
ord5431
ord4067
ord310
ord781
ord870
ord1206
ord757
ord566
ord664
ord427
ord297
ord578
ord304
ord2131
ord784
ord1917

msvcr80

_encoded_null
malloc
free
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
?terminate@@YAXXZ
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
atoi
_amsg_exit
_initterm_e
_initterm
memset
_malloc_crt
_decode_pointer
_onexit
_lock
__dllonexit
_encode_pointer
_unlock
??2@YAPAXI@Z
__CxxFrameHandler3
atol

kernel32

UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
LocalAlloc
LocalFree
CloseHandle
SetUnhandledExceptionFilter
InterlockedExchange
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
GetCurrentProcessId
GetSystemTimeAsFileTime

user32

EnumDisplaySettingsA
ChangeDisplaySettingsA

advapi32

RegCreateKeyExA
RegSetValueExA
RegFlushKey
RegCloseKey
RegOpenKeyExA
GetUserNameA
RevertToSelf
ImpersonateLoggedOnUser
LogonUserA
RegQueryValueExA

Exports

Exports

??0RegistryEntry@@QAE@ABV0@@Z
??1RegistryEntry@@QAE@XZ
??4CTerminalSetting@@QAEAAV0@ABV0@@Z
?ApplyRecommendedSettings@CTerminalSetting@@SAXXZ
?ApplyTerminalSettings@CTerminalSetting@@SAX_N@Z
?DetectLoginUserName@CTerminalSetting@@SA?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?InitMapIds_RegPaths@CTerminalSetting@@SAXXZ
?InitiateAdminUser@CTerminalSetting@@SAHXZ
?SaveSettings@CTerminalSetting@@SAXXZ
?SetDefaultSetting@CTerminalSetting@@SAXPBD0H@Z
?SilentApplyTerminalSettings@CTerminalSetting@@SA_NV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?TerminateAdminUser@CTerminalSetting@@SAHXZ
?ToggleSetting@CTerminalSetting@@SAXPBD0_N@Z
?ToggleSetting@CTerminalSetting@@SAXPBD_N@Z
?bImpersonateStatus@CTerminalSetting@@2HA
?checkButtonState@CTerminalSetting@@SA_NV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAH@Z
?getSystemState@CTerminalSetting@@SA_NXZ
?hLogonHandle@CTerminalSetting@@2PAXA
?initMap@CTerminalSetting@@SAXXZ
?m_MapIds_RegPaths@CTerminalSetting@@2VCMapStringToString@@A
?mapConstToKey@CTerminalSetting@@2VCMapStringToString@@A
?mapTS@CTerminalSetting@@2VCMapStringToString@@A
?nNestedAdminSessionCount@CTerminalSetting@@2HA
?saveInitialSystemState@CTerminalSetting@@SA_NXZ
?setSystemState@CTerminalSetting@@SAXV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?test@CTerminalSetting@@SAXXZ
UninstallTerminalSettings

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

79b6286ff69ccbfef2571579293fc1bc

Headers

File Characteristics

PDB Paths

Imports

mfc80

msvcr80

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 816B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 816B

.reloc
Size: 3KB - Virtual size: 3KB