a365dc76a4c75a7a854e645ad980d14b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a365dc76a4c75a7a854e645ad980d14b_JaffaCakes118
Size

329KB
MD5

a365dc76a4c75a7a854e645ad980d14b
SHA1

112a67a7f274a6e8b361ddeafa4d9936a7a55f28
SHA256

d185b516ee9fa1935f3872ca6381d51ca64b6c6a52452660f1b4317f32725dbc
SHA512

e51d482b3b03534752208e260809601aaeb122e167dc1f05161d57cfc3f23b1e0d51066a91f78c6bec37bc5e4c1997d4eb78959355ad5f8c40fbcdaf48b7e181
SSDEEP

6144:M0qxPE9ENoNEN7jcVq6N6o92H0qWkAsGSxrBVWxsVFvRhXdx3C:M0qEe7gB6oQ0IzfWxsVFbXP3C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a365dc76a4c75a7a854e645ad980d14b_JaffaCakes118

Files

a365dc76a4c75a7a854e645ad980d14b_JaffaCakes118
.exe windows:5 windows x86 arch:x86

40046f19c3b2f7c1d61e8cc26333845f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlAcquireResourceExclusive
RtlFreeAnsiString
RtlCopyUnicodeString
RtlSubAuthoritySid
NtOpenProcessToken
RtlAppendUnicodeStringToString
RtlUniform
RtlLookupElementGenericTableAvl
RtlInitializeSid
RtlEraseUnicodeString
RtlDeleteTimerQueue
VerSetConditionMask
NtDuplicateObject
RtlVerifyVersionInfo
RtlEqualDomainName
RtlAllocateAndInitializeSid
RtlCopySid
RtlUpcaseUnicodeString
RtlConvertSharedToExclusive
RtlSubAuthorityCountSid
RtlDeregisterWait
DbgPrint
RtlEnterCriticalSection
RtlAcquireResourceShared
RtlRunDecodeUnicodeString
RtlLengthSid
RtlInitUnicodeString
RtlCompareMemory
NtOpenEvent
RtlAddAccessAllowedAce
NtAllocateLocallyUniqueId
NtOpenThreadToken
RtlTimeToTimeFields
RtlValidSid
RtlLookupElementGenericTable
RtlGetElementGenericTable
RtlDeleteElementGenericTable
RtlCopyLuid
RtlInitializeGenericTableAvl
RtlTimeFieldsToTime
RtlUnicodeStringToAnsiString
RtlAnsiStringToUnicodeString
NtQuerySystemInformation
NtQuerySystemTime
RtlEqualUnicodeString
RtlInitializeResource
RtlDowncaseUnicodeString
RtlSetDaclSecurityDescriptor
RtlDeleteResource
RtlLengthRequiredSid
RtlInsertElementGenericTableAvl
NtQueryInformationToken
RtlCreateAcl
RtlEqualSid
RtlSystemTimeToLocalTime
RtlInsertElementGenericTable
RtlPrefixUnicodeString
RtlRegisterWait
RtlInitAnsiString
RtlInitializeCriticalSection
RtlNtStatusToDosError
RtlLeaveCriticalSection
RtlConvertSidToUnicodeString
RtlFreeSid
RtlFreeUnicodeString
NtSetSecurityObject
RtlDeleteCriticalSection
RtlCreateSecurityDescriptor
RtlIntegerToUnicodeString
RtlCreateTimerQueue
NtAllocateVirtualMemory
NtWaitForSingleObject
RtlCompareUnicodeString
RtlReleaseResource
RtlCreateTimer
RtlOemStringToUnicodeString
NtCreateEvent
RtlInitializeGenericTable

cryptdll

CDBuildIntegrityVect
MD5Init
CDGenerateRandomBits
MD5Update
CDLocateCheckSum
CDFindCommonCSystemWithKey
CDLocateCSystem
MD5Final

msasn1

ASN1DecAlloc
ASN1BERDecOctetString
ASN1BERDecU32Val
ASN1BERDecCharString
ASN1BEREncBool
ASN1BERDecObjectIdentifier
ASN1_Encode
ASN1BERDecSXVal
ASN1intx_setuint32
ASN1BEREncBitString
ASN1_CloseEncoder
ASN1_Decode
ASN1BERDecExplicitTag
ASN1BERDecNotEndOfContents
ASN1BEREncOctetString
ASN1BEREncU32
ASN1Free
ASN1EncSetError
ASN1BERDecEndOfContents
ASN1BEREncEndOfContents
ASN1BEREncExplicitTag
ASN1BERDecPeekTag
ASN1CEREncGeneralizedTime
ASN1BERDecGeneralizedTime
ASN1ztcharstring_free
ASN1_CreateEncoder
ASN1charstring_free
ASN1BEREncObjectIdentifier
ASN1BEREncOpenType
ASN1BERDecBitString
ASN1BEREncS32
ASN1intx2uint32
ASN1_CreateDecoder
ASN1BEREncCharString
ASN1BERDecOpenType2
ASN1_FreeEncoded
ASN1objectidentifier_free
ASN1BERDecZeroCharString
ASN1intxisuint32
ASN1intx2int32
ASN1BERDecBool
ASN1DecSetError
ASN1BERDecSkip
ASN1_CloseDecoder
ASN1BEREncSX
ASN1_CreateModule
ASN1_FreeDecoded
ASN1octetstring_free
ASN1bitstring_free
ASN1intx_free
ASN1BERDecS32Val

kernel32

GetComputerNameW
InterlockedExchangeAdd
LoadLibraryA
GetACP
GetModuleFileNameW
CreateFileW
lstrlenA
GetSystemTimeAsFileTime
FormatMessageW
FileTimeToSystemTime
GetCurrentProcess
GetProcAddress
LocalAlloc
lstrcmpiA
InitializeCriticalSection
CreateEventW
OpenFileMappingW
GetLastError
CreateFileA
InterlockedCompareExchange
lstrcpyW
GetModuleHandleW
WriteFile
LocalFree
lstrcmpW
GetComputerNameExW
DisableThreadLibraryCalls
Sleep
QueryPerformanceCounter
RegisterWaitForSingleObjectEx
GetCurrentThread
SetUnhandledExceptionFilter
GetEnvironmentVariableW
LoadLibraryW
GetTickCount
WideCharToMultiByte
MapViewOfFileEx
UnmapViewOfFile
FreeLibrary
InterlockedIncrement
UnregisterWait
DeleteCriticalSection
ExpandEnvironmentStringsW
CloseHandle
CreateFileMappingW
lstrlenW
EnterCriticalSection
GetLocalTime
VirtualAlloc
InterlockedDecrement
OpenEventW
DebugBreak
UnhandledExceptionFilter
GetSystemInfo
GetCurrentThreadId
TerminateProcess
LeaveCriticalSection
GetModuleFileNameA
OutputDebugStringA
MultiByteToWideChar
SetEvent
InterlockedExchange
GetProfileStringA
RaiseException
GetCurrentProcessId

secur32

LsaGetLogonSessionData
LsaFreeReturnBuffer
CredUnmarshalTargetInfo
CredMarshalTargetInfo
FreeContextBuffer

advapi32

SetThreadToken
CryptDestroyHash
QueryServiceStatus
OpenServiceW
RegQueryInfoKeyW
RegOpenKeyExW
RevertToSelf
SystemFunction006
OpenSCManagerW
CryptGetHashParam
OpenProcessToken
CloseServiceHandle
RegEnumKeyExW
CredUnmarshalCredentialW
CryptHashData
RegisterEventSourceW
CredFree
CryptSetProvParam
CryptReleaseContext
DeregisterEventSource
RegCreateKeyExW
FreeSid
RegNotifyChangeKeyValue
RegConnectRegistryW
RegOpenKeyW
SystemFunction007
RegisterTraceGuidsW
AllocateAndInitializeSid
ReportEventW
CryptCreateHash
LookupAccountSidW
RegDeleteValueW
CryptGetProvParam
GetTraceLoggerHandle
RegSetValueExW
RegCloseKey
GetTokenInformation
RegQueryValueExW
CryptAcquireContextW
TraceEvent
OpenThreadToken
QueryServiceConfigW

msvcrt

wcsrchr
_strcmpi
free
sscanf
_wcsicmp
wcscmp
qsort
wcslen
wcsspn
_vsnprintf
strchr
_strnicmp
_stricmp
malloc
wcscat
_except_handler3
wcstoul
_wcsnicmp
_adjust_fdiv
_ultoa
wcscpy
_initterm
strrchr
sprintf
swprintf

user32

wsprintfW
CharLowerBuffW

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

40046f19c3b2f7c1d61e8cc26333845f

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

cryptdll

msasn1

kernel32

secur32

advapi32

msvcrt

user32

Sections

.text Size: 18KB - Virtual size: 17KB

.data Size: 9KB - Virtual size: 1.4MB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 36KB - Virtual size: 36KB

.rdata Size: 264KB - Virtual size: 263KB

.text
Size: 18KB - Virtual size: 17KB

.data
Size: 9KB - Virtual size: 1.4MB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 36KB - Virtual size: 36KB

.rdata
Size: 264KB - Virtual size: 263KB