88d9e6810c5241e90bfb461ebde38752_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

88d9e6810c5241e90bfb461ebde38752_JaffaCakes118
Size

126KB
MD5

88d9e6810c5241e90bfb461ebde38752
SHA1

fffc6aed3fc1b8d75401ea8edcbb558ad9d59c7e
SHA256

d891f010a611bf5f95505eca0c2595ec18ec6754353e72154ad9bfaa423cdeb4
SHA512

8e5c29b403a87a48109908ee80689e8313e218c4b011cd15729e23f94ab2c3016f196ba04a93473acdf95021d748a7e94e172afafc3cc091ff63f681b56fd186
SSDEEP

3072:Kpg56Br0gi6Z5y36swOglsVYt387oNfbT5ADH:eogF86swOq3JNfxADH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
88d9e6810c5241e90bfb461ebde38752_JaffaCakes118

Files

88d9e6810c5241e90bfb461ebde38752_JaffaCakes118
.exe windows:4 windows x86 arch:x86

29761038de737d5bce44b24e8364c07a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

cryptdll

MD5Init
MD5Final
CDFindCommonCSystemWithKey
CDBuildIntegrityVect
CDLocateCheckSum
CDGenerateRandomBits
CDLocateCSystem
MD5Update

advapi32

DeregisterEventSource
OpenServiceW
GetTokenInformation
CryptReleaseContext
CryptHashData
QueryServiceConfigW
RegQueryValueExW
RegOpenKeyW
CryptSetProvParam
ReportEventW
CryptAcquireContextW
CredUnmarshalCredentialW
RegisterEventSourceW
RegOpenKeyExW
RegCreateKeyExW
CryptGetHashParam
RegNotifyChangeKeyValue
SystemFunction007
CredFree
RegEnumKeyExW
RevertToSelf
TraceEvent
FreeSid
RegQueryInfoKeyW
RegConnectRegistryW
LookupAccountSidW
RegCloseKey
CryptGetProvParam
CryptCreateHash
OpenThreadToken
SetThreadToken
OpenProcessToken
SystemFunction006
CryptDestroyHash
RegisterTraceGuidsW
RegDeleteValueW
QueryServiceStatus
AllocateAndInitializeSid
OpenSCManagerW
RegSetValueExW
GetTraceLoggerHandle
CloseServiceHandle

ntdll

NtOpenThreadToken
RtlAllocateAndInitializeSid
RtlNtStatusToDosError
RtlSubAuthoritySid
RtlLengthRequiredSid
RtlInsertElementGenericTable
RtlCompareMemory
RtlInsertElementGenericTableAvl
RtlRegisterWait
RtlInitializeGenericTableAvl
NtSetSecurityObject
RtlSubAuthorityCountSid
RtlTimeToTimeFields
RtlEraseUnicodeString
RtlInitializeResource
RtlUniform
RtlCopyUnicodeString
RtlAddAccessAllowedAce
RtlAppendUnicodeStringToString
RtlDeleteElementGenericTable
RtlVerifyVersionInfo
RtlPrefixUnicodeString
RtlInitializeCriticalSection
RtlCompareUnicodeString
NtCreateEvent
RtlAcquireResourceShared
RtlOemStringToUnicodeString
RtlCopySid
RtlInitializeSid
NtQuerySystemTime
RtlDeleteTimerQueue
RtlLeaveCriticalSection
RtlFreeUnicodeString
RtlReleaseResource
NtAllocateLocallyUniqueId
NtAllocateVirtualMemory
RtlInitAnsiString
RtlDeleteCriticalSection
NtOpenEvent
RtlInitializeGenericTable
NtOpenProcessToken
RtlRunDecodeUnicodeString
RtlCopyLuid
RtlFreeSid
RtlEqualUnicodeString
RtlDeleteResource
RtlSetDaclSecurityDescriptor
RtlIntegerToUnicodeString
RtlUpcaseUnicodeString
RtlCreateTimerQueue
DbgPrint
RtlEqualDomainName
RtlEqualSid
RtlGetElementGenericTable
RtlConvertSidToUnicodeString
RtlCreateSecurityDescriptor
NtClose
RtlConvertSharedToExclusive
RtlLengthSid
RtlCreateAcl
RtlEnterCriticalSection
RtlTimeFieldsToTime
RtlFreeAnsiString
RtlAnsiStringToUnicodeString
RtlCreateTimer
RtlLookupElementGenericTable
NtQueryInformationToken
NtQuerySystemInformation
NtDuplicateObject
RtlSystemTimeToLocalTime
RtlLookupElementGenericTableAvl
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
RtlDowncaseUnicodeString
RtlDeregisterWait
NtWaitForSingleObject
VerSetConditionMask
RtlValidSid

secur32

FreeContextBuffer
CredUnmarshalTargetInfo
CredMarshalTargetInfo
LsaGetLogonSessionData
LsaFreeReturnBuffer

msasn1

ASN1BEREncBool
ASN1BERDecSkip
ASN1intx_free
ASN1_Encode
ASN1BERDecNotEndOfContents
ASN1BEREncBitString
ASN1BERDecBitString
ASN1intx2int32
ASN1BERDecU32Val
ASN1BERDecPeekTag
ASN1octetstring_free
ASN1_FreeDecoded
ASN1objectidentifier_free
ASN1BERDecEndOfContents
ASN1_Decode
ASN1BERDecExplicitTag
ASN1Free
ASN1BERDecBool
ASN1BERDecZeroCharString
ASN1_CloseEncoder
ASN1DecSetError
ASN1bitstring_free
ASN1intxisuint32
ASN1BEREncCharString
ASN1BEREncSX
ASN1_CreateModule
ASN1intx2uint32
ASN1BERDecObjectIdentifier
ASN1intx_setuint32
ASN1BERDecSXVal
ASN1EncSetError
ASN1BERDecCharString
ASN1BEREncOpenType
ASN1BEREncExplicitTag
ASN1BEREncOctetString
ASN1BERDecGeneralizedTime
ASN1BERDecOpenType2
ASN1_CreateDecoder
ASN1ztcharstring_free
ASN1BEREncEndOfContents
ASN1BERDecS32Val
ASN1DecAlloc
ASN1_FreeEncoded
ASN1BEREncObjectIdentifier
ASN1BEREncU32
ASN1CEREncGeneralizedTime
ASN1_CreateEncoder
ASN1BEREncS32
ASN1_CloseDecoder
ASN1charstring_free
ASN1BERDecOctetString

msvcrt

wcscmp
sscanf
wcslen
_strnicmp
wcscat
wcscpy
wcsrchr
sprintf
strchr
_strcmpi
_ultoa
_initterm
wcsspn
_adjust_fdiv
_vsnprintf
_stricmp
malloc
wcstoul
qsort
_except_handler3
_wcsnicmp
free
_wcsicmp
strrchr
swprintf

kernel32

InterlockedIncrement
WriteFile
UnhandledExceptionFilter
SetEvent
GetLocalTime
QueryPerformanceCounter
RegisterWaitForSingleObjectEx
lstrlenA
VirtualAlloc
GetLastError
InterlockedCompareExchange
InterlockedExchangeAdd
ExpandEnvironmentStringsW
InitializeCriticalSection
GetComputerNameExW
LocalFree
DeleteCriticalSection
CreateFileW
GetProfileStringA
LoadLibraryA
CloseHandle
GetProcAddress
GetCurrentProcess
DisableThreadLibraryCalls
GetCurrentThreadId
GetSystemInfo
lstrlenW
TerminateProcess
GetACP
GetModuleFileNameW
CreateFileA
GetModuleFileNameA
GetModuleHandleW
OpenFileMappingW
MapViewOfFileEx
FormatMessageW
SetUnhandledExceptionFilter
lstrcpyW
GetCurrentThread
GetEnvironmentVariableW
CreateEventW
lstrcmpiA
InterlockedDecrement
GetComputerNameW
LeaveCriticalSection
UnregisterWait
CreateFileMappingW
UnmapViewOfFile
WideCharToMultiByte
DebugBreak
LoadLibraryW
GetSystemTimeAsFileTime
GetTickCount
FileTimeToSystemTime
Sleep
MultiByteToWideChar
lstrcmpW
GetCurrentProcessId
FreeLibrary
OpenEventW
EnterCriticalSection
LocalAlloc
InterlockedExchange
OutputDebugStringA
RaiseException

user32

wsprintfW
CharLowerBuffW

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 984KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 365KB - Virtual size: 365KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

29761038de737d5bce44b24e8364c07a

Headers

File Characteristics

Imports

cryptdll

advapi32

ntdll

secur32

msasn1

msvcrt

kernel32

user32

Sections

.text Size: 31KB - Virtual size: 31KB

.reloc Size: 512B - Virtual size: 20B

.data Size: 23KB - Virtual size: 984KB

.rsrc Size: 46KB - Virtual size: 45KB

.rdata Size: 365KB - Virtual size: 365KB

.text
Size: 31KB - Virtual size: 31KB

.reloc
Size: 512B - Virtual size: 20B

.data
Size: 23KB - Virtual size: 984KB

.rsrc
Size: 46KB - Virtual size: 45KB

.rdata
Size: 365KB - Virtual size: 365KB