87375a59ae72b1a278185463bd6cfa38_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

87375a59ae72b1a278185463bd6cfa38_JaffaCakes118
Size

89KB
MD5

87375a59ae72b1a278185463bd6cfa38
SHA1

63d5f1e7cc29920de26e839b75ab819743cc35ed
SHA256

b6bbc772635dc504d3e092f808bd31c38e195e69809cc47b920a7ff37b963d5e
SHA512

b271b462cbf7fc0d79af0d1aefa399436b274b7b6469b177c79cbbe631eeb3de70c9ae4391102b0421b74b61f82b673bf5ef74eed2aaefe618c5fe738164fa25
SSDEEP

1536:naxLmQ8tPV1nMKWZkrVGjVu+Rcmi1uGVwLR5wbDnDY0acm4Z4YQqlQbfQynIL:axLmXtPV1nMJyrQjhRWwl5wnRvm4TXlj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
87375a59ae72b1a278185463bd6cfa38_JaffaCakes118

Files

87375a59ae72b1a278185463bd6cfa38_JaffaCakes118
.exe windows:5 windows x86 arch:x86

2b0df6d0c25171615d9887e9ce1f1a81

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

adsldpc

ADsFreeColumn

rpcrt4

RpcStringBindingComposeA
RpcStringBindingComposeW
RpcStringFreeA
UuidToStringA
NdrClientCall2
RpcImpersonateClient
RpcEpResolveBinding
RpcRevertToSelf
RpcBindingFromStringBindingW
RpcBindingFromStringBindingA
UuidCreate
RpcBindingFree
RpcBindingSetAuthInfoExW
RpcStringFreeW

msasn1

ASN1_Decode
ASN1BERDecZeroCharString
ASN1_CloseModule
ASN1DecSetError
ASN1BERDecOctetString2
ASN1BERDotVal2Eoid
ASN1BERDecUTCTime
ASN1_CreateModule
ASN1BEREncU32
ASN1objectidentifier2_cmp
ASN1BERDecS32Val
ASN1CEREncUTCTime
ASN1CEREncFlushBlkElement
ASN1_FreeDecoded
ASN1char16string_free
ASN1CEREncGeneralizedTime
ASN1BERDecBool
ASN1BERDecOpenType2
ASN1BERDecEoid
ASN1EncSetError
ASN1_Encode
ASN1BERDecChar32String
ASN1BEREncOpenType
ASN1octetstring_free
ASN1BERDecBitString
ASN1BERDecSXVal
ASN1BERDecBitString2
ASN1Free
ASN1open_free
ASN1_CloseEncoder
ASN1utf8string_free
ASN1BEREncOctetString
ASN1_CloseDecoder
ASN1BERDecObjectIdentifier2
ASN1_SetEncoderOption
ASN1BEREncUTF8String
ASN1BEREncObjectIdentifier2
ASN1BEREoid_free
ASN1BERDecMultibyteString
ASN1intx_free
ASN1DecRealloc
ASN1BERDecUTF8String
ASN1BERDecPeekTag
ASN1BEREncEndOfContents
ASN1BERDecNotEndOfContents
ASN1BEREncMultibyteString
ASN1BEREncS32
ASN1_CreateDecoder
ASN1BEREncSX
ASN1BEREncCharString
ASN1char32string_free
ASN1BERDecEndOfContents
ASN1BEREncChar16String
ASN1_CreateEncoder
ASN1charstring_free
ASN1BEREncBitString
ASN1CEREncEndBlk
ASN1BERDecOpenType
ASN1bitstring_free
ASN1BEREncExplicitTag
ASN1BERDecExplicitTag
ASN1BERDecGeneralizedTime
ASN1BEREncChar32String
ASN1BEREncEoid
ASN1BERDecChar16String
ASN1BERDecOctetString
ASN1CEREncNewBlkElement
ASN1BEREoid2DotVal
ASN1ztcharstring_free
ASN1BEREncBool
ASN1_FreeEncoded
ASN1BERDecCharString
ASN1BERDecU32Val
ASN1CEREncBeginBlk

kernel32

FindFirstFileA
LocalSize
MultiByteToWideChar
OpenMutexA
FindCloseChangeNotification
GetSystemTime
MapViewOfFile
lstrlenW
InterlockedDecrement
GetTimeFormatW
FileTimeToLocalFileTime
GetModuleFileNameA
CreateFileA
GetCurrentProcessId
GetTempFileNameA
ExpandEnvironmentStringsW
OutputDebugStringA
DuplicateHandle
InterlockedIncrement
CreateFileW
ExitThread
Sleep
GetLastError
FindNextFileA
FindClose
LeaveCriticalSection
ReleaseMutex
WaitForSingleObject
GetComputerNameW
GetTimeFormatA
CreateFileMappingW
OpenFileMappingW
CreateFileMappingA
GetFileAttributesW
DeleteCriticalSection
ReadFile
SystemTimeToFileTime
GetACP
GetUserDefaultLCID
GetModuleFileNameW
CreateDirectoryW
GetTickCount
GetSystemTimeAsFileTime
GetVersionExA
SetFilePointer
SetUnhandledExceptionFilter
FindFirstChangeNotificationW
GetFileAttributesA
LoadLibraryExA
CreateMutexA
GetCurrentThreadId
lstrlenA
GetModuleHandleA
SetLastError
SetFileAttributesA
lstrcmpA
EnterCriticalSection
WriteFile
GetCurrentThread
LocalFree
CloseHandle
InterlockedCompareExchange
lstrcpyA
SetEndOfFile
VirtualAlloc
GetFileAttributesExW
LocalAlloc
CreateEventA
GetProcAddress
WideCharToMultiByte
TlsSetValue
FormatMessageA
WaitForMultipleObjectsEx
LocalReAlloc
CreateDirectoryA
OpenMutexW
GetDateFormatW
GetDateFormatA
GetFileSize
FindNextChangeNotification
ExpandEnvironmentStringsA
FileTimeToSystemTime
CreateMutexW
CompareStringW
LoadLibraryA
TlsAlloc
TlsFree
CompareStringA
FindFirstChangeNotificationA
UnmapViewOfFile
GetEnvironmentVariableA
UnhandledExceptionFilter
FormatMessageW
CreateThread
TlsGetValue
FindFirstFileW
FindNextFileW
DeleteFileW
DeleteFileA
GetTempPathA
InitializeCriticalSection
FreeLibrary
GetCurrentProcess
FreeLibraryAndExitThread
TerminateProcess
GetComputerNameA
QueryPerformanceCounter
SetEvent
lstrcatA
GetLocalTime
CompareFileTime
GetSystemDefaultLangID
DelayLoadFailureHook
SetFileAttributesW
WaitForSingleObjectEx
PulseEvent
OpenEventA
LoadLibraryExW

user32

MessageBoxW
wsprintfA
MessageBoxA
LoadStringW
GetSystemMetrics
LoadStringA
GetProcessDefaultLayout
wsprintfW

advapi32

QueryServiceConfigA
MD5Final
RegDeleteKeyW
ChangeServiceConfigA
RegDeleteValueA
StartServiceW
RegEnumKeyA
GetLengthSid
CryptSetProvParam
CopySid
RegGetKeySecurity
CryptImportKey
CryptGetProvParam
CryptEncrypt
GetUserNameW
CryptSetProviderA
CryptVerifySignatureA
OpenServiceW
A_SHAFinal
FreeSid
SystemFunction040
RegDeleteKeyA
SystemFunction041
LookupAccountSidW
GetSidSubAuthority
RegQueryValueExW
OpenProcessToken
RegConnectRegistryA
GetAce
RegCloseKey
CryptDecrypt
CryptCreateHash
CryptSignHashA
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExA
OpenSCManagerW
CryptGetDefaultProviderW
QueryServiceStatus
CryptSetKeyParam
InitializeSecurityDescriptor
CryptHashData
StartServiceA
CryptSetHashParam
CryptGenKey
AdjustTokenPrivileges
MD5Update
RegOpenKeyExW
SetSecurityDescriptorDacl
CryptDestroyKey
RegCreateKeyExA
A_SHAUpdate
CryptAcquireContextA
AddAccessAllowedAce
UnlockServiceDatabase
CryptDestroyHash
RegSetValueExW
SetSecurityDescriptorOwner
GetTokenInformation
RegEnumValueW
LsaNtStatusToWinError
IsValidSid
RegEnumValueA
CryptExportKey
RegSetKeySecurity
InitializeAcl
GetSidIdentifierAuthority
GetSecurityDescriptorOwner
CryptGetKeyParam
CryptDeriveKey
RegCreateKeyExW
OpenThreadToken
RegConnectRegistryW
RegQueryInfoKeyA
SetSecurityDescriptorGroup
CryptReleaseContext
CryptGetHashParam
RegDeleteValueW
LookupPrivilegeValueA
CryptGetUserKey
CloseServiceHandle
A_SHAInit
MD5Init
ControlService
GetSecurityDescriptorDacl
RegOpenKeyExA
RegNotifyChangeKeyValue
RegEnumKeyExA
GetUserNameA
RegQueryValueExA
AllocateAndInitializeSid
EqualSid
CryptGenRandom
GetSidSubAuthorityCount
LockServiceDatabase

msvcrt

wcslen
_onexit
free
wcscmp
isdigit
strncpy
_ultoa
memmove
_itow
atol
isxdigit
_wcsicmp
_adjust_fdiv
sprintf
_ltoa
strtoul
_except_handler3
_snprintf
_snwprintf
wcschr
_wcsnicmp
isupper
qsort
bsearch
memcpy
strncmp
malloc
_ltow
__dllonexit
wcscat
wcscpy
_initterm

Sections

.textbss
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2b0df6d0c25171615d9887e9ce1f1a81

Headers

DLL Characteristics

File Characteristics

Imports

adsldpc

rpcrt4

msasn1

kernel32

user32

advapi32

msvcrt

Sections

.textbss Size: - Virtual size: 1.2MB

.text Size: 512B - Virtual size: 416B

.rdata Size: 512B - Virtual size: 32B

.reloc Size: 1024B - Virtual size: 816B

.idata Size: 86KB - Virtual size: 85KB

.textbss
Size: - Virtual size: 1.2MB

.text
Size: 512B - Virtual size: 416B

.rdata
Size: 512B - Virtual size: 32B

.reloc
Size: 1024B - Virtual size: 816B

.idata
Size: 86KB - Virtual size: 85KB