8985dce2abbc41dfc5fcfb0b17439a39_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8985dce2abbc41dfc5fcfb0b17439a39_JaffaCakes118
Size

258KB
MD5

8985dce2abbc41dfc5fcfb0b17439a39
SHA1

f30d4fa6f1b9965d4110246189e38ae291234ff4
SHA256

9d50048beedbad1284716b1826ab9b00384e9d4b9e61ca6a5624452f86cca3cf
SHA512

0d1c51fedd47bba4784d5d2b07fa8a4620d4cadc1aba132a313838b87b093537a0271a26f4a5b6d2a19a9a5c03d8035c289f3ebd915bdab3db420a6cbc340376
SSDEEP

6144:V1qOwZBJ4v88Kv1gdybhLj0FKyuGtnQAQuTz2:V1qrZBSsNLj0FKWtnQAQt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8985dce2abbc41dfc5fcfb0b17439a39_JaffaCakes118

Files

8985dce2abbc41dfc5fcfb0b17439a39_JaffaCakes118
.dll windows:5 windows x86 arch:x86

ca16d32fc5a77af3609ab84ad3f8d141

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

adsnt.pdb

Imports

activeds

ord7
ord21
ord22
ord23
ord17
ord18
ord15
ord14
ord16

advapi32

LockServiceDatabase
ChangeServiceConfigW
UnlockServiceDatabase
OpenServiceW
QueryServiceConfigW
OpenSCManagerW
CreateServiceW
CloseServiceHandle
QueryServiceStatus
GetSidSubAuthorityCount
GetSidSubAuthority
GetLengthSid
RegConnectRegistryW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
StartServiceW
ControlService
LookupAccountNameW
EnumServicesStatusW
DeleteService
GetUserNameW
SystemFunction040
SystemFunction041
GetSidIdentifierAuthority

kernel32

CompareStringW
GetTickCount
GetSystemTime
SystemTimeToFileTime
SetLastError
GetLastError
InterlockedIncrement
InterlockedDecrement
LocalFree
LocalAlloc
WaitForSingleObject
ReleaseSemaphore
LoadLibraryW
GetProcAddress
FreeLibrary
DeleteCriticalSection
CreateSemaphoreW
InitializeCriticalSection
DisableThreadLibraryCalls
GetComputerNameW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FormatMessageW
FileTimeToDosDateTime
DosDateTimeToFileTime
GetModuleHandleW
CloseHandle
EnterCriticalSection
LeaveCriticalSection
lstrlenW

mpr

WNetCancelConnection2W
WNetAddConnection2W

msvcrt

_CxxThrowException
free
_initterm
wcsrchr
wcscpy
_adjust_fdiv
__dllonexit
_onexit
_ftol
_wcsnicmp
wcschr
_ltow
_wtol
_itow
wcscmp
_except_handler3
wcslen
wcscat
_purecall
_wcsicmp
malloc

netapi32

NetLocalGroupGetMembers
NetGroupDel
NetLocalGroupDel
NetLocalGroupAdd
NetUserDel
I_NetNameCompare
NetFileEnum
NetGroupGetUsers
NetGetDCName
NetGetAnyDCName
DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation
NetWkstaGetInfo
NetUseGetInfo
NetWkstaUserGetInfo
NetGroupEnum
NetFileGetInfo
NetLocalGroupEnum
NetShareEnum
NetShareDel
NetShareSetInfo
NetShareAdd
NetShareGetInfo
NetSessionDel
NetSessionEnum
NetSessionGetInfo
NetServerSetInfo
NetLocalGroupGetInfo
NetGroupAdd
NetGroupDelUser
NetGroupAddUser
NetLocalGroupAddMembers
NetLocalGroupDelMembers
NetUserGetLocalGroups
NetUserGetGroups
NetGroupGetInfo
NetUserChangePassword
NetUserAdd
NetServerGetInfo
NetLocalGroupSetInfo
NetGroupSetInfo
NetUserGetInfo
NetUserSetInfo
NetQueryDisplayInformation
NetUserModalsGet
NetUserModalsSet
NetApiBufferFree
NetServerEnum

ntdll

RtlRunEncodeUnicodeString
RtlInitUnicodeString
RtlRunDecodeUnicodeString
RtlSecondsSince1970ToTime
RtlTimeToSecondsSince1970

ole32

CoCreateInstance
CoTaskMemFree
StringFromCLSID
CreatePointerMoniker
StringFromGUID2
CLSIDFromString
IIDFromString

oleaut32

VariantInit
DispGetIDsOfNames
LoadRegTypeLi
DispInvoke
SetErrorInfo
VariantCopy
SysFreeString
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreate
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocString
SafeArrayUnaccessData
SafeArrayAccessData
CreateErrorInfo
SystemTimeToVariantTime
VariantTimeToSystemTime
DosDateTimeToVariantTime
VariantTimeToDosDateTime
VariantClear

rassapi

ord3
ord2

user32

wsprintfW
LoadStringW

winspool.drv

DeletePrinter
GetJobW
EnumPrintersW
OpenPrinterW
SetPrinterW
ClosePrinter
AddPrinterW
GetPrinterW
EnumJobsW
SetJobW

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 221KB - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ca16d32fc5a77af3609ab84ad3f8d141

Headers

File Characteristics

PDB Paths

Imports

activeds

advapi32

kernel32

mpr

msvcrt

netapi32

ntdll

ole32

oleaut32

rassapi

user32

winspool.drv

Exports

Exports

Sections

.text Size: 221KB - Virtual size: 221KB

.data Size: 21KB - Virtual size: 21KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 221KB - Virtual size: 221KB

.data
Size: 21KB - Virtual size: 21KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 11KB