a84bf4905de646249fef23d3894e93d8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a84bf4905de646249fef23d3894e93d8_JaffaCakes118
Size

364KB
MD5

a84bf4905de646249fef23d3894e93d8
SHA1

93b6d56a80958747c534c5003c3f216a888ccce4
SHA256

b4343dbeb77bc1d5cba9804dc05b336eb4cbf5dd4245acf1b0d6b00934375374
SHA512

dabc33759ebc15045188c973932909f5005abd36025ad853429727c54e5cff4fa2f4b49cfcd09091add542b04c3f08de0cecae8a4eb96b9a206ca1980ff1ae94
SSDEEP

6144:nOEm7pSi2RTmPv/nj+Rf6AJsqfmuS+zIwijTsnUiKvKsQF20jj3FjY:ndm7wiJjY6AJsqOF+EzjTsn+uPj5Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a84bf4905de646249fef23d3894e93d8_JaffaCakes118

Files

a84bf4905de646249fef23d3894e93d8_JaffaCakes118
.dll windows:5 windows x86 arch:x86

56a453714620f5453e38d6b00e9885fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

mst120.pdb

Imports

msvcrt

free
_initterm
malloc
_adjust_fdiv
_vsnprintf

kernel32

LoadLibraryA
MulDiv
LocalFree
LocalAlloc
FindAtomA
VirtualAlloc
lstrlenW
WideCharToMultiByte
DisableThreadLibraryCalls
GetVersionExA
FreeEnvironmentStringsA
CreateProcessA
GetEnvironmentStrings
SetEnvironmentVariableA
GetComputerNameA
MultiByteToWideChar
lstrcatA
GetLocalTime
InterlockedDecrement
LocalReAlloc
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LoadLibraryExA
GetSystemDirectoryA
lstrlenA
lstrcmpA
lstrcpynA
FreeLibrary
InitializeCriticalSection
GetProcAddress
LeaveCriticalSection
EnterCriticalSection
SetEvent
Sleep
CreateEventA
CloseHandle
GetLastError
GetOverlappedResult
lstrcpyA
ResetEvent
GetCurrentThreadId
GetCurrentThread
SetThreadPriority
DeleteCriticalSection
InterlockedIncrement
WriteFile
ReadFile
CreateThread
WaitForSingleObject

user32

wsprintfA
PostThreadMessageA
PostMessageA
MsgWaitForMultipleObjects
DispatchMessageA
PeekMessageA
CreateWindowExA
RegisterClassA
UnregisterClassA
DestroyWindow
KillTimer
IsWindow
CharNextA
DefWindowProcA
PostQuitMessage
SetTimer

advapi32

CryptGetHashParam
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
LogonUserA
RegFlushKey
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptReleaseContext
CryptAcquireContextA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegCreateKeyA
RegOpenKeyA
LookupAccountNameA

wsock32

getpeername
inet_addr
shutdown
socket
WSAAsyncSelect
htons
bind
listen
closesocket
accept
WSAGetLastError
send
recv
connect
ioctlsocket
WSACleanup
setsockopt
WSAStartup
getsockname

ole32

CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree

netapi32

Netbios

crypt32

CertFreeCertificateContext
CertGetIssuerCertificateFromStore
CertOpenSystemStoreA
CertNameToStrA
CertCloseStore

msasn1

ASN1PERDecObjectIdentifier
ASN1objectidentifier_free
ASN1PEREncSimpleChoiceEx
ASN1PERDecSkipFragmented
ASN1PERDecSimpleChoiceEx
ASN1uint32_uoctets
ASN1PEREncOctetString_FixedSize
ASN1PERDecOctetString_FixedSize
ASN1PEREncInteger
ASN1PERDecInteger
ASN1PERDecSkipNormallySmall
ASN1PEREncSeqOf_VarSize
ASN1PERDecU16Val
ASN1_CreateDecoder
ASN1_CreateEncoder
ASN1_CloseDecoder
ASN1_CloseEncoder
ASN1_FreeEncoded
ASN1PEREncObjectIdentifier
ASN1PERDecChar16String
ASN1PEREncChar16String
ASN1char16string_free
ASN1PERDecAlignment
ASN1PERDecZeroTableCharStringNoAlloc
ASN1PERDecTableChar16String
ASN1PEREncAlignment
ASN1PEREncTableCharString
ASN1PEREncTableChar16String
ASN1PERDecOctetString_VarSize
ASN1PEREncOctetString_VarSize
ASN1PERDecSkipNormallySmallExtensionFragmented
ASN1PEREncExtensionBitClear
ASN1PERDecBit
ASN1BERDecPeekTag
ASN1BERDecBool
ASN1BEREncBool
ASN1BERDecExplicitTag
ASN1BERDecEndOfContents
ASN1BEREncExplicitTag
ASN1BEREncEndOfContents
ASN1BERDecU32Val
ASN1BEREncU32
ASN1BERDecOctetString
ASN1BEREncOctetString
ASN1PERDecSimpleChoice
ASN1DecSetError
ASN1_FreeDecoded
ASN1_Encode
ASN1_GetDecoderOption
ASN1_Decode
ASN1objectidentifier_cmp
ASN1PERDecSeqOf_VarSize
ASN1_CreateModule
ASN1_CloseModule
ASN1PEREncUnsignedShort
ASN1PERDecUnsignedShort
ASN1PEREncBoolean
ASN1PERDecBoolean
ASN1octetstring_free
ASN1PEREncUnsignedInteger
ASN1PERDecUnsignedInteger
ASN1PEREncBitVal
ASN1PERDecU32Val
ASN1PEREncOctetString_NoSize
ASN1PERDecOctetString_NoSize
ASN1PEREncBits
ASN1PERDecExtension
ASN1PEREncSeqOf_NoSize
ASN1PERDecSeqOf_NoSize
ASN1PERFreeSeqOf
ASN1EncSetError
ASN1PEREncSimpleChoice

Exports

Exports

GCC_CreateAppSap
MCS_AttachRequest
T120_AppletStatus
T120_CloseApplet
T120_CreateAppletSAP
T120_CreateControlSAP
T120_CreateNodeController
T120_CreatePluggableTransport
T120_GetNodeName
T120_GetNodeVersion
T120_GetSecurityInfoFromGCCID
T120_GetUserData
T120_LoadApplet
T120_QueryApplet
T120_TprtSecCtrl

Sections

.text
Size: 244KB - Virtual size: 241KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

56a453714620f5453e38d6b00e9885fc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

user32

advapi32

wsock32

ole32

netapi32

crypt32

msasn1

Exports

Exports

Sections

.text Size: 244KB - Virtual size: 241KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 100KB - Virtual size: 96KB

.reloc Size: 12KB - Virtual size: 9KB

.text
Size: 244KB - Virtual size: 241KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 100KB - Virtual size: 96KB

.reloc
Size: 12KB - Virtual size: 9KB