a3af676c5f76f840450b247539845ff5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a3af676c5f76f840450b247539845ff5_JaffaCakes118
Size

1.1MB
MD5

a3af676c5f76f840450b247539845ff5
SHA1

54e6d7dc854247c88c18cbb30c9df45d65df901d
SHA256

29ec1a13bae1ce7a8d983d3fc566abeb1cbfb0fc0f010b0b9dc4c6d67f07661f
SHA512

6f518873fec6aa6a3a566f8b6a864e30d449f3481d9d5a8ce1add4fb0c77a191a030154b54afdc2199b8b71da18c1ce70b6e00f10ccef047fc8611a4d29383e5
SSDEEP

24576:kM+9v70yAhPyRB/jvLuWSZQBnd+CtNIfevEmk2ugIRnfoV35oIwbT:kZYyHjTuWSWnjtNIlMIZoDobbT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0

Files

a3af676c5f76f840450b247539845ff5_JaffaCakes118
.cab
0
.exe windows:4 windows x86 arch:x86

27e1b8dbb01807125a50743763d766c2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

ntdll

LdrGetDllHandle
NtAllocateVirtualMemory
RtlUshortByteSwap

user32

GetProcessDefaultLayout
MessageBoxA
GetSystemMetrics
wsprintfW
LoadStringA
wsprintfA
LoadStringW
MessageBoxW

msasn1

ASN1BERDecChar32String
ASN1BEREoid2DotVal
ASN1BERDecUTF8String
ASN1utf8string_free
ASN1CEREncBeginBlk
ASN1BEREncChar32String
ASN1BEREncBool
ASN1_CreateDecoder
ASN1BERDecBool
ASN1CEREncGeneralizedTime
ASN1BERDecEoid
ASN1BERDecCharString
ASN1_FreeDecoded
ASN1octetstring_free
ASN1CEREncFlushBlkElement
ASN1EncSetError
ASN1BEREncOctetString
ASN1_CreateModule
ASN1Free
ASN1BEREncObjectIdentifier2
ASN1CEREncUTCTime
ASN1CEREncEndBlk
ASN1BERDecZeroCharString
ASN1objectidentifier2_cmp
ASN1ztcharstring_free
ASN1BEREncS32
ASN1_Decode
ASN1char32string_free
ASN1_CloseDecoder
ASN1open_free
ASN1intx_free
ASN1BERDecOctetString2
ASN1BERDecObjectIdentifier2
ASN1BERDecGeneralizedTime
ASN1BEREncU32
ASN1_CloseModule
ASN1BERDecChar16String
ASN1BERDecOpenType2
ASN1DecRealloc
ASN1BERDecMultibyteString
ASN1BEREncExplicitTag
ASN1BEREncSX
ASN1BERDecNotEndOfContents
ASN1BEREncBitString
ASN1CEREncNewBlkElement
ASN1BERDecEndOfContents
ASN1_FreeEncoded
ASN1BEREoid_free
ASN1_CloseEncoder
ASN1BEREncEndOfContents
ASN1charstring_free
ASN1BEREncOpenType
ASN1BEREncChar16String
ASN1bitstring_free
ASN1BERDecPeekTag
ASN1BEREncCharString
ASN1DecSetError
ASN1BERDecSXVal
ASN1BEREncEoid
ASN1BERDecOpenType
ASN1BERDecU32Val
ASN1BEREncMultibyteString
ASN1_CreateEncoder
ASN1BERDecOctetString
ASN1BERDecBitString2
ASN1char16string_free
ASN1_Encode
ASN1BERDotVal2Eoid
ASN1BERDecS32Val
ASN1BERDecExplicitTag
ASN1BERDecBitString
ASN1_SetEncoderOption
ASN1BERDecUTCTime
ASN1BEREncUTF8String

advapi32

GetSidSubAuthorityCount
LockServiceDatabase
FreeSid
RegDeleteValueW
CryptDestroyKey
RegEnumValueW
CryptCreateHash
CryptReleaseContext
GetSidSubAuthority
RegCreateKeyExA
CryptSetProviderA
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
SetSecurityDescriptorSacl
RegDeleteValueA
OpenProcessToken
AddAccessAllowedAce
GetLengthSid
CryptDeriveKey
GetUserNameW
RegConnectRegistryA
QueryServiceStatus
RegNotifyChangeKeyValue
CryptGetUserKey
RegDeleteKeyW
RegSetKeySecurity
CryptSignHashA
RegSetValueExA
OpenSCManagerW
StartServiceA
RegSetValueExW
RegConnectRegistryW
RegQueryValueExW
GetSidIdentifierAuthority
RegEnumKeyExA
CryptGetProvParam
RegOpenKeyExA
CryptExportKey
RegEnumValueA
GetAce
CloseServiceHandle
CryptSetHashParam
AdjustTokenPrivileges
RegGetKeySecurity
RegCreateKeyExW
CryptGenRandom
ControlService
RegQueryInfoKeyA
CryptGetHashParam
CryptSetKeyParam
CryptDecrypt
GetTokenInformation
OpenServiceW
CopySid
RegCloseKey
CryptEncrypt
RegDeleteKeyA
CryptHashData
InitializeSecurityDescriptor
CryptImportKey
CryptGenKey
StartServiceW
UnlockServiceDatabase
GetUserNameA
CryptSetProvParam
ChangeServiceConfigA
CryptDestroyHash
RegQueryValueExA
RegOpenKeyExW
CryptGetDefaultProviderW
RegEnumKeyA
SystemFunction041
RegQueryInfoKeyW
GetSecurityDescriptorDacl
CryptGetKeyParam
CryptAcquireContextA
OpenThreadToken
AllocateAndInitializeSid
GetSecurityDescriptorOwner
InitializeAcl
EqualSid
IsValidSid
SetSecurityDescriptorGroup
RegEnumKeyExW
QueryServiceConfigA
LookupPrivilegeValueA
CryptVerifySignatureA

msvcrt

_ltoa
wcscmp
strncmp
wcslen
_wcsnicmp
_itow
isupper
qsort
free
isxdigit
_initterm
wcschr
memmove
_ultoa
_except_handler3
strncpy
_onexit
_wcsicmp
strtoul
isdigit
_snwprintf
atol
sprintf
wcscat
_ltow
malloc
wcscpy
_adjust_fdiv
bsearch
__dllonexit

kernel32

GetDateFormatA
lstrcatA
OpenEventA
FileTimeToLocalFileTime
InterlockedDecrement
LoadLibraryA
GetFileAttributesA
TlsAlloc
SetEndOfFile
FileTimeToSystemTime
CreateDirectoryA
DelayLoadFailureHook
lstrlenA
GetLocalTime
GetSystemTime
GetModuleFileNameA
FindClose
WaitForSingleObjectEx
FindNextChangeNotification
FindNextFileA
SetFileAttributesA
GetVersionExA
ExitThread
WaitForSingleObject
OpenFileMappingW
UnmapViewOfFile
ReadFile
MapViewOfFile
GetCurrentProcess
CreateFileA
OutputDebugStringA
GetTickCount
InterlockedCompareExchange
GetDateFormatW
WriteFile
lstrcmpA
SetEvent
GetTimeFormatA
DuplicateHandle
DeleteFileA
DeleteCriticalSection
InterlockedExchange
FindFirstChangeNotificationA
UnhandledExceptionFilter
FindNextFileW
CompareFileTime
CreateDirectoryW
CreateFileMappingA
MultiByteToWideChar
LocalFree
SetLastError
EnterCriticalSection
GetComputerNameA
CreateFileMappingW
FreeLibraryAndExitThread
SetFileAttributesW
lstrlenW
GetFileAttributesW
GetSystemDefaultLangID
CompareStringW
LeaveCriticalSection
FindCloseChangeNotification
OpenMutexA
FindFirstFileW
CreateEventA
DeleteFileW
lstrcpyA
CreateMutexW
WideCharToMultiByte
LocalAlloc
QueryPerformanceCounter
SystemTimeToFileTime
WaitForMultipleObjectsEx
SetFilePointer
ExpandEnvironmentStringsW
Sleep
GetProcAddress
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTimeFormatW
LoadLibraryExA
FindFirstChangeNotificationW
LoadLibraryExW
PulseEvent
InitializeCriticalSection
GetCurrentThread
LocalReAlloc
LocalSize
FreeLibrary
TlsSetValue
OpenMutexW
CloseHandle
FormatMessageA
ExpandEnvironmentStringsA
TlsGetValue
GetModuleHandleA
ReleaseMutex
SetUnhandledExceptionFilter
FormatMessageW
InterlockedIncrement
FindFirstFileA
CreateMutexA
GetACP
GetFileSize
GetEnvironmentVariableA
GetLastError
GetCurrentProcessId
GetTempPathA
CompareStringA
GetModuleFileNameW
TerminateProcess
CreateThread
GetFileAttributesExW
GetComputerNameW
CreateFileW
GetUserDefaultLCID
TlsFree
GetTempFileNameA

rpcrt4

RpcStringFreeW
RpcBindingFree
RpcBindingFromStringBindingA
UuidToStringA
UuidCreate
RpcStringFreeA
RpcStringBindingComposeW
RpcRevertToSelf
RpcStringBindingComposeA
RpcBindingFromStringBindingW
NdrClientCall2
RpcImpersonateClient

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 120KB - Virtual size: 22.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 290KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

27e1b8dbb01807125a50743763d766c2

Headers

File Characteristics

Imports

ntdll

user32

msasn1

advapi32

msvcrt

kernel32

rpcrt4

Sections

.text Size: 27KB - Virtual size: 26KB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 120KB - Virtual size: 22.3MB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 290KB - Virtual size: 290KB

.text
Size: 27KB - Virtual size: 26KB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 120KB - Virtual size: 22.3MB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 290KB - Virtual size: 290KB