8693637d96fc4c69fb7bf9868307cf95_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

8693637d96fc4c69fb7bf9868307cf95_JaffaCakes118
Size

30KB
MD5

8693637d96fc4c69fb7bf9868307cf95
SHA1

a3185a5f4d19d7b913250aa0c7cdfafbfe0b621c
SHA256

2384b89ef41234429217b3e4880127e73504fa2ce98d81413c6a04c516432cf1
SHA512

c5e35beeef9a75275bb7a6366adfe96659cc84ced21ed1281124fc5bb79158b911f2ee5d57ea21d7e4567c21b78d6253c13d28bdf4321fa0fe8113894f9105a0
SSDEEP

768:OEFp0oisprliByzlHaCdbqXpFmvJFDb/hbtvCoqGlP051hBARHIL9kQ:Om/iByzl6ZCJFDbZMvmG6Q9r

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8693637d96fc4c69fb7bf9868307cf95_JaffaCakes118

Files

8693637d96fc4c69fb7bf9868307cf95_JaffaCakes118
.exe windows:5 windows x86 arch:x86

bcce0968bdaa479e918646790a9d273b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

RpcStringBindingComposeW
NdrClientCall2
UuidToStringA
RpcEpResolveBinding
RpcStringBindingComposeA
RpcStringFreeW
RpcBindingFromStringBindingA
UuidCreate
RpcStringFreeA
RpcRevertToSelf
RpcBindingSetAuthInfoExW
RpcImpersonateClient
RpcBindingFree
RpcBindingFromStringBindingW

kernel32

MapViewOfFile
SetEvent
DeleteCriticalSection
LocalFree
TlsSetValue
UnhandledExceptionFilter
PulseEvent
GetLastError
OpenFileMappingW
SetEndOfFile
SetFileAttributesA
CreateEventA
CloseHandle
FindFirstChangeNotificationA
CreateFileMappingA
LocalSize
InterlockedIncrement
GetTempFileNameA
EnterCriticalSection
FormatMessageW
InterlockedDecrement
GetModuleFileNameW
FormatMessageA
GetProcAddress
CreateDirectoryW
WideCharToMultiByte
TlsGetValue
LeaveCriticalSection
DeleteFileW
ExitThread
FindNextChangeNotification
FindCloseChangeNotification
OpenEventA
GetFileSize
GetVersionExA
lstrcmpA
LoadLibraryA
FindFirstFileA
lstrlenW
UnmapViewOfFile
SetLastError
WaitForSingleObject
CreateDirectoryA
FindFirstChangeNotificationW
FindNextFileA
GetCurrentThreadId
GetTickCount
CompareStringW
SystemTimeToFileTime
OutputDebugStringA
OpenMutexW
ReleaseMutex
OpenMutexA
DeleteFileA
GetComputerNameA
WaitForSingleObjectEx
GetSystemDefaultLangID
ExpandEnvironmentStringsA
CreateFileW
TerminateProcess
LoadLibraryExA
CreateMutexW
ReadFile
lstrcpyA
CreateMutexA
GetSystemTimeAsFileTime
DuplicateHandle
Sleep
CreateThread
GetTimeFormatW
VirtualAlloc
GetDateFormatA
GetUserDefaultLCID
GetEnvironmentVariableA
CreateFileA
LocalAlloc
FreeLibraryAndExitThread
GetModuleHandleA
GetCurrentProcessId
GetFileAttributesExW
lstrcatA
LocalReAlloc
GetTimeFormatA
InterlockedCompareExchange
GetLocalTime
GetDateFormatW
FreeLibrary
SetFilePointer
TlsAlloc
GetTempPathA
FileTimeToLocalFileTime
GetComputerNameW
GetACP
SetUnhandledExceptionFilter
GetFileAttributesA
lstrlenA
QueryPerformanceCounter
CompareFileTime
FindNextFileW
ExpandEnvironmentStringsW
LoadLibraryExW
FindClose
WaitForMultipleObjectsEx
WriteFile
FileTimeToSystemTime
CreateFileMappingW
GetModuleFileNameA
MultiByteToWideChar
GetSystemTime
DelayLoadFailureHook
CompareStringA
GetCurrentThread
GetFileAttributesW
SetFileAttributesW
InitializeCriticalSection
TlsFree
GetCurrentProcess
FindFirstFileW

user32

GetSystemMetrics
LoadStringA
wsprintfA
MessageBoxA
wsprintfW
LoadStringW
MessageBoxW
GetProcessDefaultLayout

advapi32

AddAccessAllowedAce
RegCreateKeyExA
QueryServiceStatus
OpenProcessToken
RegEnumValueA
GetSidSubAuthority
CryptVerifySignatureA
ControlService
EqualSid
SystemFunction041
RegSetValueExA
CloseServiceHandle
LookupPrivilegeValueA
RegQueryInfoKeyW
CryptSetHashParam
CryptDeriveKey
RegQueryValueExA
CryptGenKey
CryptAcquireContextA
CryptGetKeyParam
RegQueryValueExW
RegOpenKeyExW
GetAce
CryptReleaseContext
RegDeleteKeyW
FreeSid
OpenServiceW
QueryServiceConfigA
RegQueryInfoKeyA
A_SHAFinal
A_SHAInit
SetSecurityDescriptorOwner
CryptSetKeyParam
LockServiceDatabase
RegGetKeySecurity
RegDeleteKeyA
CryptSetProvParam
InitializeSecurityDescriptor
OpenSCManagerW
GetUserNameA
IsValidSid
RegCloseKey
SetSecurityDescriptorDacl
GetLengthSid
GetSecurityDescriptorDacl
StartServiceW
CryptHashData
CryptEncrypt
RegNotifyChangeKeyValue
CryptDestroyHash
CryptGetDefaultProviderW
CryptGetUserKey
AllocateAndInitializeSid
SetSecurityDescriptorGroup
RegEnumKeyA
RegConnectRegistryW
CryptGetProvParam
CryptSignHashA
A_SHAUpdate
OpenThreadToken
GetSidIdentifierAuthority
RegEnumKeyExA
RegConnectRegistryA
GetSidSubAuthorityCount
CryptExportKey
RegSetValueExW
AdjustTokenPrivileges
CryptCreateHash
RegEnumValueW
CryptSetProviderA
UnlockServiceDatabase
CryptDecrypt
ChangeServiceConfigA
SystemFunction040
MD5Init
MD5Update
GetTokenInformation
InitializeAcl
RegDeleteValueW
LookupAccountSidW
RegEnumKeyExW
LsaNtStatusToWinError
CryptImportKey
GetSecurityDescriptorOwner
RegSetKeySecurity
CryptGetHashParam
RegCreateKeyExW
RegOpenKeyExA
CryptDestroyKey
CopySid
GetUserNameW
StartServiceA
CryptGenRandom
MD5Final
RegDeleteValueA

msvcrt

_ultoa
wcschr
sprintf
_initterm
malloc
_snwprintf
wcscpy
memcpy
wcslen
atol
_ltoa
memmove
bsearch
_ltow
_wcsnicmp
_itow
_snprintf
isupper
isdigit
_adjust_fdiv
_wcsicmp
strncpy
strncmp
isxdigit
__dllonexit
free
_except_handler3
_onexit
wcscmp
wcscat
strtoul
qsort

msasn1

ASN1BERDotVal2Eoid
ASN1DecRealloc
ASN1BERDecOpenType2
ASN1BERDecSXVal
ASN1BERDecOpenType
ASN1BEREncS32
ASN1intx_free
ASN1BEREncOctetString
ASN1BEREncChar16String
ASN1BERDecChar16String
ASN1CEREncNewBlkElement
ASN1BERDecBitString2
ASN1BEREncBool
ASN1BEREncU32
ASN1CEREncGeneralizedTime
ASN1BERDecEoid
ASN1BERDecChar32String
ASN1octetstring_free
ASN1ztcharstring_free
ASN1BERDecOctetString2
ASN1_FreeDecoded
ASN1CEREncUTCTime
ASN1BEREoid_free
ASN1charstring_free
ASN1CEREncBeginBlk
ASN1BEREncEoid
ASN1EncSetError
ASN1BERDecEndOfContents
ASN1CEREncEndBlk
ASN1BERDecS32Val
ASN1CEREncFlushBlkElement
ASN1char16string_free
ASN1utf8string_free
ASN1BEREncEndOfContents
ASN1BEREncExplicitTag
ASN1BERDecBitString
ASN1_CloseEncoder
ASN1open_free
ASN1BEREncOpenType
ASN1BERDecExplicitTag
ASN1DecSetError
ASN1char32string_free
ASN1BEREncSX
ASN1_CloseModule
ASN1BERDecUTF8String
ASN1_Decode
ASN1BERDecObjectIdentifier2
ASN1_Encode
ASN1BEREncChar32String
ASN1BERDecMultibyteString
ASN1_SetEncoderOption
ASN1BEREoid2DotVal
ASN1BERDecUTCTime
ASN1BEREncBitString
ASN1bitstring_free
ASN1BERDecZeroCharString
ASN1BERDecU32Val
ASN1Free
ASN1BERDecBool
ASN1BEREncMultibyteString
ASN1_FreeEncoded
ASN1BEREncCharString
ASN1BERDecOctetString
ASN1BERDecPeekTag
ASN1_CloseDecoder
ASN1_CreateEncoder
ASN1BERDecNotEndOfContents
ASN1BERDecCharString
ASN1_CreateModule
ASN1BERDecGeneralizedTime
ASN1BEREncUTF8String
ASN1BEREncObjectIdentifier2
ASN1objectidentifier2_cmp
ASN1_CreateDecoder

adsldpc

ADsFreeColumn

Sections

.textbss
Size: - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 512B - Virtual size: 412B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 28KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bcce0968bdaa479e918646790a9d273b

Headers

DLL Characteristics

File Characteristics

Imports

rpcrt4

kernel32

user32

advapi32

msvcrt

msasn1

adsldpc

Sections

.textbss Size: - Virtual size: 80KB

.text Size: 512B - Virtual size: 412B

.rdata Size: 512B - Virtual size: 32B

.reloc Size: 512B - Virtual size: 196B

.idata Size: 28KB - Virtual size: 100KB

.textbss
Size: - Virtual size: 80KB

.text
Size: 512B - Virtual size: 412B

.rdata
Size: 512B - Virtual size: 32B

.reloc
Size: 512B - Virtual size: 196B

.idata
Size: 28KB - Virtual size: 100KB