8e0783c0a9681213c529fab9ee4c3216_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

8e0783c0a9681213c529fab9ee4c3216_JaffaCakes118
Size

258KB
MD5

8e0783c0a9681213c529fab9ee4c3216
SHA1

1fa08cec642145085b8211b0c750ff66c2f3f889
SHA256

a959ad547f1748e8f346db1d71eee2719b0768f405926a6d67f23e49374f860c
SHA512

5e2054ec36d4f2f89a87f4b2924c2b2f579903dabf0e28fcf8e26a236e8210142e494969d671f9997c928694559be1a769bc6a22c52a1397ea903516ccdd598d
SSDEEP

6144:9QBhbbszAYe3t05+vDt3ktm2EK1fmY0L/:WBhkoPt3ktm81fmY0D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e0783c0a9681213c529fab9ee4c3216_JaffaCakes118

Files

8e0783c0a9681213c529fab9ee4c3216_JaffaCakes118
.dll windows:5 windows x86 arch:x86

ca16d32fc5a77af3609ab84ad3f8d141

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

adsnt.pdb

Imports

activeds

ord7
ord21
ord22
ord23
ord17
ord18
ord15
ord14
ord16

advapi32

LockServiceDatabase
ChangeServiceConfigW
UnlockServiceDatabase
OpenServiceW
QueryServiceConfigW
OpenSCManagerW
CreateServiceW
CloseServiceHandle
QueryServiceStatus
GetSidSubAuthorityCount
GetSidSubAuthority
GetLengthSid
RegConnectRegistryW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
StartServiceW
ControlService
LookupAccountNameW
EnumServicesStatusW
DeleteService
GetUserNameW
SystemFunction040
SystemFunction041
GetSidIdentifierAuthority

kernel32

CompareStringW
GetTickCount
GetSystemTime
SystemTimeToFileTime
SetLastError
GetLastError
InterlockedIncrement
InterlockedDecrement
LocalFree
LocalAlloc
WaitForSingleObject
ReleaseSemaphore
LoadLibraryW
GetProcAddress
FreeLibrary
DeleteCriticalSection
CreateSemaphoreW
InitializeCriticalSection
DisableThreadLibraryCalls
GetComputerNameW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FormatMessageW
FileTimeToDosDateTime
DosDateTimeToFileTime
GetModuleHandleW
CloseHandle
EnterCriticalSection
LeaveCriticalSection
lstrlenW

mpr

WNetCancelConnection2W
WNetAddConnection2W

msvcrt

_CxxThrowException
free
_initterm
wcsrchr
wcscpy
_adjust_fdiv
__dllonexit
_onexit
_ftol
_wcsnicmp
wcschr
_ltow
_wtol
_itow
wcscmp
_except_handler3
wcslen
wcscat
_purecall
_wcsicmp
malloc

netapi32

NetLocalGroupGetMembers
NetGroupDel
NetLocalGroupDel
NetLocalGroupAdd
NetUserDel
I_NetNameCompare
NetFileEnum
NetGroupGetUsers
NetGetDCName
NetGetAnyDCName
DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation
NetWkstaGetInfo
NetUseGetInfo
NetWkstaUserGetInfo
NetGroupEnum
NetFileGetInfo
NetLocalGroupEnum
NetShareEnum
NetShareDel
NetShareSetInfo
NetShareAdd
NetShareGetInfo
NetSessionDel
NetSessionEnum
NetSessionGetInfo
NetServerSetInfo
NetLocalGroupGetInfo
NetGroupAdd
NetGroupDelUser
NetGroupAddUser
NetLocalGroupAddMembers
NetLocalGroupDelMembers
NetUserGetLocalGroups
NetUserGetGroups
NetGroupGetInfo
NetUserChangePassword
NetUserAdd
NetServerGetInfo
NetLocalGroupSetInfo
NetGroupSetInfo
NetUserGetInfo
NetUserSetInfo
NetQueryDisplayInformation
NetUserModalsGet
NetUserModalsSet
NetApiBufferFree
NetServerEnum

ntdll

RtlRunEncodeUnicodeString
RtlInitUnicodeString
RtlRunDecodeUnicodeString
RtlSecondsSince1970ToTime
RtlTimeToSecondsSince1970

ole32

CoCreateInstance
CoTaskMemFree
StringFromCLSID
CreatePointerMoniker
StringFromGUID2
CLSIDFromString
IIDFromString

oleaut32

VariantInit
DispGetIDsOfNames
LoadRegTypeLi
DispInvoke
SetErrorInfo
VariantCopy
SysFreeString
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreate
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocString
SafeArrayUnaccessData
SafeArrayAccessData
CreateErrorInfo
SystemTimeToVariantTime
VariantTimeToSystemTime
DosDateTimeToVariantTime
VariantTimeToDosDateTime
VariantClear

rassapi

ord3
ord2

user32

wsprintfW
LoadStringW

winspool.drv

DeletePrinter
GetJobW
EnumPrintersW
OpenPrinterW
SetPrinterW
ClosePrinter
AddPrinterW
GetPrinterW
EnumJobsW
SetJobW

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 221KB - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ca16d32fc5a77af3609ab84ad3f8d141

Headers

File Characteristics

PDB Paths

Imports

activeds

advapi32

kernel32

mpr

msvcrt

netapi32

ntdll

ole32

oleaut32

rassapi

user32

winspool.drv

Exports

Exports

Sections

.text Size: 221KB - Virtual size: 221KB

.data Size: 21KB - Virtual size: 21KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 221KB - Virtual size: 221KB

.data
Size: 21KB - Virtual size: 21KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 11KB