89a392b9c9b0420ea196fd7810000700_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

89a392b9c9b0420ea196fd7810000700_JaffaCakes118
Size

440KB
MD5

89a392b9c9b0420ea196fd7810000700
SHA1

550485e41ee8e1ae0e8e6be9a6ed01d5862196db
SHA256

f135e40a83f6620d901468fc4764f3ca17e59ef72f6c14a0cbffeacce1669bfb
SHA512

5b93e6ba48caef454d8189eeaee8e328d31083bfe52b584abff8ee65a4a41e199a22ca46cffdbf80962a4e83c1ecd88691890c7f32dc90e3a1d7b0aabee3533f
SSDEEP

12288:8XXaaB8xdMec50QISPftuCWL/xOvIuZ1LXhSju:8XnB8vQPfECa/xOnXV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
89a392b9c9b0420ea196fd7810000700_JaffaCakes118

Files

89a392b9c9b0420ea196fd7810000700_JaffaCakes118
.exe windows:5 windows x86 arch:x86

974f05dd289025f5851d275d2d3341e6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_adjust_fdiv
malloc
_initterm
free
wcsrchr
_wcsicmp
wcscpy
wcscat
wcslen
_except_handler3

wintrust

CryptCATAdminCalcHashFromFileHandle

rpcrt4

RpcRevertToSelfEx
I_RpcBindingIsClientLocal
RpcServerUnregisterIf
RpcServerRegisterAuthInfoW
RpcServerInqDefaultPrincNameW
RpcStringFreeW
RpcServerRegisterIfEx
RpcServerUseProtseqEpW
RpcImpersonateClient
RpcRevertToSelf
NdrServerCall2

user32

wsprintfW
wsprintfA

kernel32

FindNextFileW
GetACP
WideCharToMultiByte
GetSystemDirectoryW
GetSystemDirectoryA

advapi32

RegCloseKey
RegEnumValueW
RegEnumValueA
RegCreateKeyExA
CryptAcquireContextA
RegQueryValueExW
RegQueryInfoKeyW
RegEnumKeyW
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyW
CryptSetProviderExW
CryptGetDefaultProviderW
CryptGetProvParam
CryptEnumProviderTypesW
CryptEnumProvidersW
LsaOpenPolicy
LsaRetrievePrivateData
LogonUserW
LsaFreeMemory
LsaClose
ImpersonateLoggedOnUser
RegOpenKeyExW
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
GetLengthSid
CopySid
CryptReleaseContext
SystemFunction036
RevertToSelf
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
OpenThreadToken
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegisterServiceCtrlHandlerW
SetServiceStatus
RegisterEventSourceW
ReportEventW
DeregisterEventSource

certcli

CACertTypeAccessCheck
CAGetCertTypeProperty
CACountCertTypes
CAFreeCertTypeProperty
CAEnumNextCertType
CAEnumCertTypes
CACloseCA
CAEnumNextCA
CAFreeCAProperty
CAAccessCheck
CAGetCAProperty
CACountCAs
CAEnumFirstCA
CACloseCertType

crypt32

CertFreeCTLContext
CertFreeCertificateContext
CertAddCertificateContextToStore
CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
PFXExportCertStore
PFXImportCertStore
CertCreateContext
CertCloseStore
CryptDecodeObject

esent

JetTerm
JetUpdate
JetSetColumn
JetPrepareUpdate
JetDelete
JetMove
JetMakeKey
JetRetrieveColumn
JetSetSystemParameter
JetCloseTable
JetGetColumnInfo
JetOpenTable
JetRollback
JetCommitTransaction
JetCreateIndex
JetAddColumn
JetCreateTable
JetBeginTransaction
JetOpenDatabase
JetCloseDatabase
JetCreateDatabase
JetSetCurrentIndex
JetAttachDatabase
JetBeginSession
JetInit
JetDetachDatabase
JetEndSession
JetSeek

Exports

Exports

?aiaioioi@@YGXHHH@Z

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.asas
Size: 413KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

974f05dd289025f5851d275d2d3341e6

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

wintrust

rpcrt4

user32

kernel32

advapi32

certcli

crypt32

esent

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 5KB - Virtual size: 8KB

.data Size: 2KB - Virtual size: 4KB

.asas Size: 413KB - Virtual size: 416KB

.rsrc Size: 11KB - Virtual size: 48KB

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 5KB - Virtual size: 8KB

.data
Size: 2KB - Virtual size: 4KB

.asas
Size: 413KB - Virtual size: 416KB

.rsrc
Size: 11KB - Virtual size: 48KB