890b9f9fdbd4bb7073b53983f085b892_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

890b9f9fdbd4bb7073b53983f085b892_JaffaCakes118
Size

471KB
MD5

890b9f9fdbd4bb7073b53983f085b892
SHA1

dc80b31b6d5fa3b6257c548fb15a24f9f400a78e
SHA256

4b42e1d25bef03f14c5fa8bf00df644875668309186797ee646d91d18c1bd4d5
SHA512

5a18bbf6cb6d48f70dee8fe56dbbf8b502681ee372e4bdf33c36c4f89cee98479155857b2db04da4e6ea7785abe80ad6a89f1a58409c0df7be778825aa89158b
SSDEEP

12288:x/Lm8Z8IW/5fRtEPSI0qF/ecj1JAxx/BMEi2OF2:hLmcbW/5fRtASItRec4xbMv2OF2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
890b9f9fdbd4bb7073b53983f085b892_JaffaCakes118

Files

890b9f9fdbd4bb7073b53983f085b892_JaffaCakes118
.exe windows:5 windows x86 arch:x86

0aacbca0564454d0215c3b905ed55de0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

ntdll

RtlTimeToElapsedTimeFields
RtlFreeOemString
NtDisplayString
RtlpWaitForCriticalSection
RtlFindLongestRunClear
PfxFindPrefix
mbstowcs
NtCreatePagingFile
toupper
NtRemoveIoCompletion
tan
isalpha
NtCreateSection
NtClose
LdrShutdownThread
ZwSetIoCompletion
ZwOpenThread
ZwRequestPort
ZwCreateJobSet
ZwEnumerateKey
RtlSetControlSecurityDescriptor
_alloca_probe
RtlRunDecodeUnicodeString
RtlAddAccessAllowedObjectAce
RtlCreateSecurityDescriptor
NtSetBootEntryOrder

crtdll

wcscat
isspace
_clearfp
fputc
_mbctolower
_CIpow
cos
_mbsstr
asin
tanh
_strspnp
atexit
_putw
raise
_spawnv
_putenv
fread
__doserrno
_control87
fputwc
_tzset
wscanf
_strrev
_copysign
_strerror
mbstowcs
getchar
iswxdigit
fgetpos
_mbbtombc

kernel32

QueueUserWorkItem
GetPrivateProfileSectionNamesW
OpenEventW
CreateTimerQueue
HeapSetInformation
WTSGetActiveConsoleSessionId
CommConfigDialogA
LoadLibraryExW
RtlFillMemory
EndUpdateResourceW
GetDateFormatW
LoadLibraryA
GetLocaleInfoW
SetConsoleMode
GetTimeZoneInformation
GetFullPathNameW
CancelDeviceWakeupRequest
WritePrivateProfileStringW
WriteConsoleOutputA
SetFileTime
GetProcessAffinityMask
FormatMessageW
EnumResourceTypesW
PeekNamedPipe
ReleaseActCtx
BeginUpdateResourceA
GetNumaAvailableMemoryNode
TlsAlloc
GetCurrentThread
EnumCalendarInfoA
WriteConsoleOutputCharacterW
CancelTimerQueueTimer
PeekConsoleInputW
LocalAlloc
QueryPerformanceCounter
GetEnvironmentStringsW
IsDebuggerPresent
GlobalGetAtomNameA
CreateIoCompletionPort
GetProcessHeaps
WritePrivateProfileStringA
VirtualAlloc
GetConsoleCharType
GetVolumePathNameW
EnumerateLocalComputerNamesA
GetVolumeInformationA
VerifyVersionInfoW
CallNamedPipeW
SetThreadPriorityBoost
GetTempFileNameA
BaseFlushAppcompatCache
lstrcmpW
UnhandledExceptionFilter
CloseConsoleHandle
GetProcessHeap
LZInit
LZCloseFile
GetSystemWow64DirectoryA
WritePrivateProfileSectionW
GetConsoleInputExeNameA
NlsGetCacheUpdateCount
GetFileInformationByHandle
ReadConsoleOutputCharacterA
OutputDebugStringW
FoldStringA
GetDriveTypeW

advapi32

ProcessIdleTasks
SetSecurityDescriptorSacl
RegQueryMultipleValuesA
SaferRecordEventLogEntry
CredWriteDomainCredentialsA
MD5Update
LookupSecurityDescriptorPartsW
SystemFunction036
LsaSetInformationPolicy
TraceMessage
ChangeServiceConfigA
SaferiChangeRegistryScope
CryptDestroyHash
CryptEnumProvidersA
LsaLookupPrivilegeDisplayName
LsaQueryDomainInformationPolicy
OpenSCManagerW
I_ScGetCurrentGroupStateW
RegUnLoadKeyW
ElfOpenBackupEventLogW
LsaDeleteTrustedDomain
WmiSetSingleInstanceA
RegisterEventSourceW
CryptContextAddRef
OpenEventLogA
SystemFunction011
RegOpenKeyW
CredpDecodeCredential
WmiSetSingleInstanceW
ReadEventLogW
CryptDuplicateKey
AddAce
BuildTrusteeWithObjectsAndNameA
LookupPrivilegeNameA
RegNotifyChangeKeyValue

msdart

?sm_lpOSVERSIONINFO@CMdVersionInfo@@0PAU_OSVERSIONINFOW@@A
?ReadOrWriteUnlock@CSpinLock@@QAEX_N@Z
MpHeapCreate
?ReadUnlock@CReaderWriterLock@@QAEXXZ
MPCSUninitialize
?IsWriteLocked@CCritSec@@QBE_NXZ
??1CLockedSingleList@@QAE@XZ
?sm_dblDfltSpinAdjFctr@CReaderWriterLock@@1NA
?ReadLock@CSpinLock@@QAEXXZ
?GetSpinCount@CSpinLock@@QBEGXZ
?IsWriteUnlocked@CSmallSpinLock@@QBE_NXZ
?FindRecord@CLKRHashTable@@QBE?AW4LK_RETCODE@@PBX@Z
?BucketSize@CLKRHashTableStats@@SGJJ@Z
?_ReadLockSpin@CReaderWriterLock3@@AAEXW4SPIN_TYPE@1@@Z
?IsValid@CLKRHashTable@@QBE_NXZ
?sm_dblDfltSpinAdjFctr@CReaderWriterLock3@@1NA
?_EqualKeys@CLKRLinearHashTable@@ABE_NKK@Z
?IsUnlocked@CLockedDoubleList@@QBE_NXZ
?_IsLocked@CSpinLock@@ABE_NXZ
?_CurrentThreadId@CReaderWriterLock3@@CGJXZ
?ReadOrWriteLock@CFakeLock@@QAE_NXZ
?SetSpinCount@CReaderWriterLock3@@QAE_NG@Z
?_H0@CLKRLinearHashTable@@CGKKK@Z
?sm_wDefaultSpinCount@CSmallSpinLock@@1GA
?sm_llGlobalList@CLKRHashTable@@0VCLockedDoubleList@@A
?RemoveEntry@CLockedDoubleList@@QAEXQAVCListEntry@@@Z
?IsReadUnlocked@CLKRLinearHashTable@@QBE_NXZ
?IsWriteUnlocked@CLKRHashTable@@QBE_NXZ
?ReadUnlock@CSmallSpinLock@@QAEXXZ
?ConvertSharedToExclusive@CReaderWriterLock2@@QAEXXZ
?ConvertExclusiveToShared@CSmallSpinLock@@QAEXXZ
?ConvertExclusiveToShared@CReaderWriterLock2@@QAEXXZ
?SetDefaultSpinCount@CReaderWriterLock3@@SGXG@Z
?IsReadUnlocked@CFakeLock@@QBE_NXZ
?ConvertExclusiveToShared@CLKRLinearHashTable@@QBEXXZ
?GetSpinCount@CReaderWriterLock3@@QBEGXZ
?GetDefaultSpinAdjustmentFactor@CSmallSpinLock@@SGNXZ
?MpHeapCompact@@YAKPAX@Z

cryptext

CryptExtAddP7R
CryptExtOpenCTL
CryptExtAddCTL
CryptExtAddCER
CryptExtAddPFX
CryptExtAddCTLW
CryptExtOpenCATW
CryptExtAddCRL
CryptExtOpenP7R
CryptExtOpenPKCS7W
CryptExtOpenSTRW
CryptExtOpenP7RW
CryptExtAddPFXW
CryptExtOpenCAT
CryptExtAddSPCW
CryptExtOpenCRL
CryptExtOpenCRLW
CryptExtOpenPKCS7
CryptExtAddP7RW
CryptExtAddCRLW
CryptExtOpenSTR
CryptExtAddCERW
CryptExtOpenCERW
CryptExtOpenCER
DllGetClassObject
CryptExtOpenCTLW
CryptExtAddSPC

Sections

.text
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 151KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 571KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 229KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0aacbca0564454d0215c3b905ed55de0

Headers

File Characteristics

Imports

ntdll

crtdll

kernel32

advapi32

msdart

cryptext

Sections

.text Size: 88KB - Virtual size: 88KB

.rdata Size: 151KB - Virtual size: 151KB

.data Size: 1KB - Virtual size: 571KB

.rsrc Size: 229KB - Virtual size: 229KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 88KB - Virtual size: 88KB

.rdata
Size: 151KB - Virtual size: 151KB

.data
Size: 1KB - Virtual size: 571KB

.rsrc
Size: 229KB - Virtual size: 229KB

.reloc
Size: 1024B - Virtual size: 1024B