a98bee2006d65b0213820d7a5a8be1ab_JaffaCakes118

General

Target

a98bee2006d65b0213820d7a5a8be1ab_JaffaCakes118
Size

40KB
MD5

a98bee2006d65b0213820d7a5a8be1ab
SHA1

d2c4a7adf483fc63f07eb528954525ff028f0122
SHA256

82ecc49ff682c278c6606fc4032ede90ff02d959c64718f67c14dcb48d8dd5b1
SHA512

544aba87dae89e175842c6b3fbca4099c81ebbcb8a7d96c6d7ac1305fca96e0c4c9db97180786d1eaeeef6227213b5850c6e856e8b5735b3f5c81c1f3ac83c44
SSDEEP

768:KjsiQzRfMpy0BF4+3NoiYsxP6J85Z/PvKqvcBvXIMCB/JT5:KwiQzRk5T4+6DEP6J85Z/PvK/PEB/J9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a98bee2006d65b0213820d7a5a8be1ab_JaffaCakes118

Files

a98bee2006d65b0213820d7a5a8be1ab_JaffaCakes118
.exe windows:5 windows x86 arch:x86

13a5ec758c23c4ebec520a54a47e014a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

lsass.pdb

Imports

advapi32

FreeSid
CheckTokenMembership
AllocateAndInitializeSid
OpenThreadToken
ImpersonateSelf
RevertToSelf

kernel32

CloseHandle
GetCurrentThread
ExitThread
SetUnhandledExceptionFilter
SetErrorMode
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
RtlUnwind
InterlockedExchange
VirtualQuery

ntdll

NtSetInformationProcess
RtlInitUnicodeString
NtCreateEvent
NtOpenEvent
NtSetEvent
NtClose
NtRaiseHardError
RtlAdjustPrivilege
NtShutdownSystem
RtlUnhandledExceptionFilter

lsasrv

LsaISetupWasRun
LsapDsDebugInitialize
LsapAuOpenSam
LsapCheckBootMode
ServiceInit
LsapInitLsa
LsapDsInitializePromoteInterface
LsapDsInitializeDsStateInfo

samsrv

SamIInitialize
SampUsingDsData

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

zftptpj
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

13a5ec758c23c4ebec520a54a47e014a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

ntdll

lsasrv

samsrv

Sections

.text Size: 4KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 108B

.rsrc Size: 34KB - Virtual size: 35KB

zftptpj Size: - Virtual size: 4KB

.text
Size: 4KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 108B

.rsrc
Size: 34KB - Virtual size: 35KB

zftptpj
Size: - Virtual size: 4KB