ac6d5b40be3330eb7e3bf66edeac4c33_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ac6d5b40be3330eb7e3bf66edeac4c33_JaffaCakes118
Size

128KB
MD5

ac6d5b40be3330eb7e3bf66edeac4c33
SHA1

08215cef07b1460b687b9dfe9612e500216bff21
SHA256

32342b1a45689cae220d112124f0effa63c19d2b8dd47e925811cce52f153f4b
SHA512

32f785fd9dcb2fb772c384e359f508f0782098c6e3b1be07fd37d713a52f5a4bb093282ef510f0964f38b1f7a3f53937e43b6bfdee5ca74bf23f74f58d243591
SSDEEP

3072:kpUfMm1iTGGlwpe63b1YJJgctGUkrFACTrJafwcB3M0Od:kpU/1iBI33xvct/k+ebclM0Od

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ac6d5b40be3330eb7e3bf66edeac4c33_JaffaCakes118

Files

ac6d5b40be3330eb7e3bf66edeac4c33_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6a0867ffc690794b54140073db11642d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

RpcBindingFree
NdrClientCall2
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoExW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock
ExpandEnvironmentStringsForUserW

winsta

WinStationFreeMemory
WinStationEnumerateW
WinStationQueryInformationW

kernel32

CreateDirectoryW
GetSystemWindowsDirectoryW
LoadLibraryExW
GetSystemDirectoryW
CloseHandle
GetCurrentThreadId
GetCurrentProcessId
LocalFree
GetCurrentThread
HeapFree
GetProcessHeap
DuplicateHandle
GetCurrentProcess
ProcessIdToSessionId
GetVersionExW
OpenProcess
FreeLibrary
GetLastError
GetProcAddress
DisconnectNamedPipe
WriteFile
GetOverlappedResult
WaitForMultipleObjects
ReadFile
ResetEvent
CreateEventW
SetEvent
ConnectNamedPipe
WaitForSingleObject
CreateNamedPipeW
HeapAlloc
LeaveCriticalSection
EnterCriticalSection
CreateThread
DeleteCriticalSection
InitializeCriticalSection
CreateMutexW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
LocalAlloc
GetTempPathW
DisableThreadLibraryCalls

user32

GetUserObjectInformationW
OpenWindowStationW
CloseWindowStation

advapi32

FreeSid
AllocateAndInitializeSid
GetSecurityDescriptorDacl
AccessCheck
AddAccessDeniedAce
DuplicateToken
GetLengthSid
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
RegisterServiceCtrlHandlerExW
SetServiceStatus
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
CreateProcessAsUserW
GetSecurityInfo
ImpersonateNamedPipeClient
OpenThreadToken
RevertToSelf
SetNamedSecurityInfoW

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 100KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 96KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: 2KB - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ik
Size: 96KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ocode
Size: 2KB - Virtual size: 46B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mcode
Size: 2KB - Virtual size: 46B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.kpack
Size: 2KB - Virtual size: 46B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.kpack0
Size: 96KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.oaks0
Size: 2KB - Virtual size: 162B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gbd
Size: 2KB - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 2KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 394B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6a0867ffc690794b54140073db11642d

Headers

DLL Characteristics

File Characteristics

Imports

rpcrt4

userenv

winsta

kernel32

user32

advapi32

Sections

.text Size: 10KB - Virtual size: 9KB

.rdata Size: 100KB - Virtual size: 98KB

.data Size: 2KB - Virtual size: 1KB

.tls Size: 96KB - Virtual size: 94KB

.ndata Size: 2KB - Virtual size: 328B

.ik Size: 96KB - Virtual size: 94KB

.ocode Size: 2KB - Virtual size: 46B

.mcode Size: 2KB - Virtual size: 46B

.kpack Size: 2KB - Virtual size: 46B

.kpack0 Size: 96KB - Virtual size: 94KB

.oaks0 Size: 2KB - Virtual size: 162B

.gbd Size: 2KB - Virtual size: 48B

.CRT Size: 2KB - Virtual size: 12B

.rsrc Size: 16KB - Virtual size: 15KB

.reloc Size: 2KB - Virtual size: 394B

.text
Size: 10KB - Virtual size: 9KB

.rdata
Size: 100KB - Virtual size: 98KB

.data
Size: 2KB - Virtual size: 1KB

.tls
Size: 96KB - Virtual size: 94KB

.ndata
Size: 2KB - Virtual size: 328B

.ik
Size: 96KB - Virtual size: 94KB

.ocode
Size: 2KB - Virtual size: 46B

.mcode
Size: 2KB - Virtual size: 46B

.kpack
Size: 2KB - Virtual size: 46B

.kpack0
Size: 96KB - Virtual size: 94KB

.oaks0
Size: 2KB - Virtual size: 162B

.gbd
Size: 2KB - Virtual size: 48B

.CRT
Size: 2KB - Virtual size: 12B

.rsrc
Size: 16KB - Virtual size: 15KB

.reloc
Size: 2KB - Virtual size: 394B