88f196a3facba7f6c438089c3951b082_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

88f196a3facba7f6c438089c3951b082_JaffaCakes118
Size

329KB
MD5

88f196a3facba7f6c438089c3951b082
SHA1

190fe8e1e355ba1822b57a6705611e63995a1cab
SHA256

8ad1f6bf97c49f12dbc10985799ebcd8ad07edc409f6a896cf5206ab2e821ef5
SHA512

9ff263a8bc05b6ad9e2f219f1c50f37781366a5f3de5879a8b36f5fae28d599b2fc1b4fd516b15270b0f7e1d4039f7e2d6da8550dcad594b1f654517cff9bc97
SSDEEP

6144:iAoyIoLDKPTRK7q5ZRQHT6B8pEIU2RTxQ4p6K6d3fgDrXeaHNU:iA9LD69h78JRtdpXO3g1He

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
88f196a3facba7f6c438089c3951b082_JaffaCakes118

Files

88f196a3facba7f6c438089c3951b082_JaffaCakes118
.exe windows:5 windows x86 arch:x86

0917a5f06ca7196a6f8fbbb0848e6a69

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateProcess
VirtualAlloc
GetLastError
UnregisterWait
CreateFileA
SetUnhandledExceptionFilter
lstrlenW
LocalFree
GetSystemTimeAsFileTime
SetEvent
GetModuleFileNameA
MultiByteToWideChar
GetEnvironmentVariableW
WriteFile
GetCurrentProcess
InterlockedExchangeAdd
GetTickCount
WideCharToMultiByte
DeleteCriticalSection
LoadLibraryA
CreateFileMappingW
LeaveCriticalSection
DisableThreadLibraryCalls
FreeLibrary
lstrlenA
CreateFileW
LoadLibraryW
lstrcpyW
LocalAlloc
ExpandEnvironmentStringsW
GetCurrentProcessId
RegisterWaitForSingleObjectEx
OutputDebugStringA
GetACP
InterlockedIncrement
OpenFileMappingW
GetCurrentThread
GetSystemInfo
UnmapViewOfFile
MapViewOfFileEx
InitializeCriticalSection
GetProcAddress
GetComputerNameExW
FormatMessageW
CloseHandle
GetModuleHandleW
GetLocalTime
lstrcmpiA
QueryPerformanceCounter
InterlockedCompareExchange
GetModuleFileNameW
GetCurrentThreadId
UnhandledExceptionFilter
GetComputerNameW
FileTimeToSystemTime
CreateEventW
OpenEventW
GetProfileStringA
lstrcmpW
Sleep
InterlockedExchange
DebugBreak
EnterCriticalSection
RaiseException
InterlockedDecrement

advapi32

CryptGetHashParam
CryptCreateHash
RegEnumKeyExW
CryptAcquireContextW
RegDeleteValueW
QueryServiceStatus
GetTraceLoggerHandle
OpenProcessToken
RegSetValueExW
RegOpenKeyW
RegQueryInfoKeyW
CryptDestroyHash
OpenServiceW
OpenSCManagerW
FreeSid
CredUnmarshalCredentialW
LookupAccountSidW
AllocateAndInitializeSid
CloseServiceHandle
RegNotifyChangeKeyValue
CryptGetProvParam
CredFree
RegOpenKeyExW
CryptReleaseContext
RegConnectRegistryW
CryptSetProvParam
RegCloseKey
SystemFunction007
RevertToSelf
QueryServiceConfigW
RegisterTraceGuidsW
DeregisterEventSource
TraceEvent
RegQueryValueExW
RegCreateKeyExW
SystemFunction006
RegisterEventSourceW
SetThreadToken
CryptHashData
GetTokenInformation
ReportEventW
OpenThreadToken

msasn1

ASN1_Decode
ASN1objectidentifier_free
ASN1BERDecS32Val
ASN1BEREncExplicitTag
ASN1intx_free
ASN1DecAlloc
ASN1BERDecOpenType2
ASN1BERDecCharString
ASN1intxisuint32
ASN1BERDecGeneralizedTime
ASN1BEREncEndOfContents
ASN1BEREncCharString
ASN1_CloseDecoder
ASN1BEREncSX
ASN1BEREncOpenType
ASN1BERDecZeroCharString
ASN1_FreeDecoded
ASN1BERDecNotEndOfContents
ASN1_CloseEncoder
ASN1intx2int32
ASN1BEREncObjectIdentifier
ASN1BEREncBool
ASN1BEREncS32
ASN1intx2uint32
ASN1_CreateModule
ASN1BERDecEndOfContents
ASN1EncSetError
ASN1BEREncBitString
ASN1BERDecSXVal
ASN1BERDecExplicitTag
ASN1BERDecBool
ASN1_Encode
ASN1BERDecBitString
ASN1charstring_free
ASN1_FreeEncoded
ASN1_CreateDecoder
ASN1octetstring_free
ASN1DecSetError
ASN1BERDecSkip
ASN1BEREncU32
ASN1BERDecOctetString
ASN1intx_setuint32
ASN1bitstring_free
ASN1BERDecPeekTag
ASN1BEREncOctetString
ASN1BERDecObjectIdentifier
ASN1CEREncGeneralizedTime
ASN1ztcharstring_free
ASN1Free
ASN1BERDecU32Val
ASN1_CreateEncoder

msvcrt

_ultoa
_adjust_fdiv
wcscat
malloc
wcscmp
_stricmp
free
_wcsicmp
wcslen
_except_handler3
strchr
wcscpy
sprintf
wcstoul
sscanf
qsort
wcsrchr
_strcmpi
_strnicmp
_wcsnicmp
_initterm
swprintf
wcsspn
_vsnprintf
strrchr

cryptdll

CDLocateCheckSum
MD5Init
MD5Final
CDGenerateRandomBits
CDFindCommonCSystemWithKey
MD5Update
CDLocateCSystem
CDBuildIntegrityVect

secur32

FreeContextBuffer
CredUnmarshalTargetInfo
LsaGetLogonSessionData
LsaFreeReturnBuffer
CredMarshalTargetInfo

ntdll

RtlInitializeGenericTable
RtlDeregisterWait
NtOpenEvent
RtlNtStatusToDosError
RtlEraseUnicodeString
RtlValidSid
RtlInitializeResource
NtCreateEvent
RtlCreateTimer
RtlInitializeCriticalSection
RtlLookupElementGenericTable
NtSetSecurityObject
NtOpenProcessToken
RtlGetElementGenericTable
RtlIntegerToUnicodeString
RtlCompareMemory
NtQueryInformationToken
RtlConvertSidToUnicodeString
RtlAcquireResourceExclusive
RtlSubAuthoritySid
RtlDeleteTimerQueue
RtlAllocateAndInitializeSid
NtClose
RtlAddAccessAllowedAce
RtlInitAnsiString
RtlInitUnicodeString
RtlEqualUnicodeString
RtlUpcaseUnicodeString
RtlCreateSecurityDescriptor
RtlLengthSid
RtlFreeUnicodeString
RtlCompareUnicodeString
RtlInitializeSid
RtlUnicodeStringToAnsiString
RtlInsertElementGenericTableAvl
RtlDeleteElementGenericTable
RtlEnterCriticalSection
RtlSystemTimeToLocalTime
RtlDowncaseUnicodeString
NtDuplicateObject
RtlEqualDomainName
RtlAnsiStringToUnicodeString
RtlCopySid
RtlSubAuthorityCountSid
RtlTimeToTimeFields
RtlFreeSid
NtQuerySystemTime
RtlPrefixUnicodeString
RtlCopyLuid
RtlInitializeGenericTableAvl
RtlTimeFieldsToTime
DbgPrint
RtlLeaveCriticalSection
VerSetConditionMask
RtlSetDaclSecurityDescriptor
RtlUniform
RtlEqualSid
NtAllocateVirtualMemory
NtWaitForSingleObject
NtOpenThreadToken
RtlCreateTimerQueue
NtQuerySystemInformation
RtlCreateAcl
RtlConvertSharedToExclusive
RtlDeleteCriticalSection
RtlRunDecodeUnicodeString
RtlVerifyVersionInfo
RtlAppendUnicodeStringToString
RtlOemStringToUnicodeString
RtlLengthRequiredSid
RtlInsertElementGenericTable
RtlFreeAnsiString
RtlRegisterWait
NtAllocateLocallyUniqueId
RtlLookupElementGenericTableAvl
RtlDeleteResource
RtlCopyUnicodeString
RtlAcquireResourceShared

user32

CharLowerBuffW
wsprintfW

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0917a5f06ca7196a6f8fbbb0848e6a69

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

msasn1

msvcrt

cryptdll

secur32

ntdll

user32

Sections

.text Size: 18KB - Virtual size: 17KB

.data Size: 9KB - Virtual size: 1.4MB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 36KB - Virtual size: 36KB

.rdata Size: 264KB - Virtual size: 263KB

.text
Size: 18KB - Virtual size: 17KB

.data
Size: 9KB - Virtual size: 1.4MB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 36KB - Virtual size: 36KB

.rdata
Size: 264KB - Virtual size: 263KB