8b8cbee288a41c018d10f0f7e0c4c473_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8b8cbee288a41c018d10f0f7e0c4c473_JaffaCakes118
Size

237KB
MD5

8b8cbee288a41c018d10f0f7e0c4c473
SHA1

845dc016969cef92c97a06e2b98f07876ba0d7f5
SHA256

6ce93d901183cd2a9d2f166358546913e17ad67fbffe1cb72065f5a08bce87e9
SHA512

114f487af2e5c179bd4c85c48a09d4ee33b2fe3104b1be54018f2c05efed6458163347c364f295b68bb4ff20eb162a1e19b51890a7e377f6420957a5c201f9d5
SSDEEP

3072:/tP6VY7fWwCOuiQheQeFtJ0k4POsyO+Dm4PDi+fDyFcN39ft+Sh8L5M:/Zn7+wNQArz0k4PO9Oim4m+8uz+S+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8b8cbee288a41c018d10f0f7e0c4c473_JaffaCakes118

Files

8b8cbee288a41c018d10f0f7e0c4c473_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

9a23255520ff5a0bb68d7796882e8b33

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

mqrtdep.pdb

Imports

msvcrt

malloc
_adjust_fdiv
??1type_info@@UAE@XZ
_initterm
_onexit
?terminate@@YAXXZ
__CxxFrameHandler
??0exception@@QAE@ABV0@@Z
_CxxThrowException
_wtol
wcscmp
?what@exception@@UBEPBDXZ
_purecall
??1exception@@UAE@XZ
_local_unwind2
_except_handler3
??0exception@@QAE@XZ
_abnormal_termination
__dllonexit
free
wcsncmp
wcscpy
wcsncpy
_snwprintf
wcslen
swscanf
towupper
_wcsnicmp
wcschr
iswspace
swprintf
time

msvcp60

?nothrow@std@@3Unothrow_t@1@B
??0bad_alloc@std@@QAE@PBD@Z
??1bad_alloc@std@@UAE@XZ
??0bad_alloc@std@@QAE@ABV01@@Z

crypt32

CertGetCertificateContextProperty
CertOpenSystemStoreA
CertCloseStore
CertFreeCertificateContext
CertEnumCertificatesInStore

rpcrt4

RpcStringBindingComposeW
RpcMgmtSetCancelTimeout
UuidFromStringW
UuidCreate
RpcStringFreeW
RpcBindingFree
NdrClientCall2
RpcBindingFromStringBindingW

advapi32

IsValidSecurityDescriptor
GetSecurityDescriptorControl
MakeSelfRelativeSD
CryptImportKey
OpenProcessToken
GetTokenInformation
EqualSid
CryptGetUserKey
CryptExportKey
GetKernelObjectSecurity
GetSecurityDescriptorDacl
RegOpenKeyExW
GetAclInformation
InitializeAcl
GetAce
AddAce
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetKernelObjectSecurity
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
LookupAccountSidW
CryptDestroyKey
RegOpenCurrentUser
CryptAcquireContextA
CryptAcquireContextW
GetLengthSid
CryptReleaseContext
RegCloseKey
GetSecurityDescriptorLength
CopySid
CryptSignHashA
CryptCreateHash
CryptDestroyHash
TraceMessage

kernel32

SetLastError
GetLastError
ResumeThread
WaitForMultipleObjects
ExitThread
InterlockedDecrement
GetSystemTimeAsFileTime
IsBadReadPtr
SuspendThread
EnterCriticalSection
VirtualProtect
InterlockedIncrement
InterlockedExchangeAdd
ReleaseMutex
GetCurrentProcessId
Sleep
TlsFree
TlsAlloc
VirtualAlloc
CreateMutexA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateEventW
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ResetEvent
CreateThread
WaitForSingleObject
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryW
SetEvent
TlsGetValue
GetCurrentThread
GetCurrentProcess
DuplicateHandle
TlsSetValue
IsBadWritePtr

ole32

CoGetObjectContext

oleaut32

BSTR_UserSize
BSTR_UserMarshal
BSTR_UserUnmarshal
BSTR_UserFree
LPSAFEARRAY_UserSize
LPSAFEARRAY_UserMarshal
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserFree

mqsec

MQSec_GetUserType
MQSec_GetLocalMachineSid
MQSigCreateCertificate
MQSigOpenUserCertStore
MQSec_GetCryptoProvProperty
MQSigHashMessageProperties
MQSec_GetPubKeysFromDS

mqutil

?mqrpcBindQMService@@YGJPAGK0PAW4_tagMQRPC_AUTHENTICATION_LEVEL@@PAHPAPAXKP6GKPAXK@Z2K@Z
ShutDownDebugWindow
?Init@CCancelRpc@@QAEXXZ
MSMQGetOperatingSystem
SetFalconServiceName
?GetComputerNameInternal@@YGJPAGPAK@Z
?GetThreadUserSid@@YGJPAPAEPAK@Z
SetFalconKeyValue
?HashMessageProperties@@YGJKPBEKK0KPBGKPBUQUEUE_FORMAT@@2@Z
?XactGetDTC@@YGJPAPAUIUnknown@@PAKPAPAE@Z
GetFalconKeyValue
?mqrpcUnbindQMService@@YGJPAPAXPAPAG@Z
?Remove@CCancelRpc@@QAEXPAX@Z
?g_CancelRpc@@3VCCancelRpc@@A
?Add@CCancelRpc@@QAEXPAXJ@Z
?ComposeLocalEndPoint@@YGXPBGPAPAG@Z

netapi32

DsGetDcNameW
NetApiBufferFree

Exports

Exports

ServiceMain
?RTXactGetDTC@@YGJPAPAUIUnknown@@@Z
DepBeginTransaction
DepCloseCursor
DepCloseQueue
DepCreateCursor
DepCreateInternalCertificate
DepCreateQueue
DepDeleteInternalCert
DepDeleteQueue
DepFreeMemory
DepFreeSecurityContext
DepGetInternalCert
DepGetMachineProperties
DepGetOverlappedResult
DepGetPrivateComputerInformation
DepGetQueueProperties
DepGetQueueSecurity
DepGetSecurityContext
DepGetSecurityContextEx
DepGetUserCerts
DepHandleToFormatName
DepInstanceToFormatName
DepLocateBegin
DepLocateEnd
DepLocateNext
DepMgmtAction
DepMgmtGetInfo
DepOpenInternalCertStore
DepOpenQueue
DepPathNameToFormatName
DepPurgeQueue
DepReceiveMessage
DepRegisterCertificate
DepRegisterUserCert
DepRemoveUserCert
DepSendMessage
DepSetQueueProperties
DepSetQueueSecurity
DllRegisterServer

Sections

.text
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 117KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9a23255520ff5a0bb68d7796882e8b33

Headers

File Characteristics

PDB Paths

Imports

msvcrt

msvcp60

crypt32

rpcrt4

advapi32

kernel32

ole32

oleaut32

mqsec

mqutil

netapi32

Exports

Exports

Sections

.text Size: 105KB - Virtual size: 105KB

.data Size: 6KB - Virtual size: 9KB

.rsrc Size: 117KB - Virtual size: 117KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 105KB - Virtual size: 105KB

.data
Size: 6KB - Virtual size: 9KB

.rsrc
Size: 117KB - Virtual size: 117KB

.reloc
Size: 6KB - Virtual size: 6KB