b42cee80827f449806e6165576010166_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b42cee80827f449806e6165576010166_JaffaCakes118
Size

850KB
MD5

b42cee80827f449806e6165576010166
SHA1

3bb99e5694803893ff123187d723825be8353158
SHA256

dfe188341b3f47f84eb620edea804c274e5c39ba60f376fc5633fc193954dc9c
SHA512

6987a5f01335953668042add763854d28fb9dc78594adec0ee30c8ffedd6d3654fa048e3c3d7f45b7c28f057febe1e48e14f43051592a120abbce8a283e66a7e
SSDEEP

24576:DDud7JcOp6PpqbQI3kuXY6oVof37iqczeB6tv:YJfajI3kUYczajtv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b42cee80827f449806e6165576010166_JaffaCakes118

Files

b42cee80827f449806e6165576010166_JaffaCakes118
.exe windows:5 windows x86 arch:x86

487d12152847df909ff16278e90bd87f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

FreeSid
UnregisterTraceGuids
RegQueryValueExA
ConvertAccessToSecurityDescriptorW
SetSecurityInfoExA
DeregisterEventSource
SetPrivateObjectSecurity
CreateProcessAsUserA
SaferiPopulateDefaultsInRegistry
LsaSetTrustedDomainInformation
SystemFunction025
IsTokenRestricted
SaferCreateLevel
IsTokenUntrusted
QueryUsersOnEncryptedFile
LsaSetQuotasForAccount
LsaQueryDomainInformationPolicy
CreateWellKnownSid
SystemFunction022
LookupPrivilegeValueA
SystemFunction008
CryptGenRandom

wiadss

UnloadImportDS
FindImportDSByDeviceName
FindNextImportDS
GetLoaderStatus
CloseFindContext
LoadImportDS
FindFirstImportDS

utildll

NetBIOSDeviceEnumerate
GetUserFromSid
RegGetNetworkServiceName
CtxGetAnyDCName
CalculateDiffTime
AsyncDeviceEnumerate
EnumerateMultiUserServers
StrSystemWaitReason
RegGetNetworkDeviceName
StrAsyncConnectState
NetworkDeviceEnumerate
StrConnectState
IsPartOfDomain
GetSystemMessageW
GetSystemMessageA
InitializeAnonymousUserCompareList
InstallModem
FormDecoratedAsyncDeviceName
StrProcessState
StandardErrorMessage
WinEnumerateDevices

crypt32

CertRemoveStoreFromCollection
I_CryptUninstallOssGlobal
CertOIDToAlgId
I_CryptEnumMatchingLruEntries
CryptInstallOIDFunctionAddress
CryptMsgVerifyCountersignatureEncoded
CertGetNameStringA
CertAddCertificateLinkToStore
CertFindSubjectInCTL
CertIsValidCRLForCertificate
CryptMsgDuplicate
CryptUnregisterDefaultOIDFunction
CertVerifyValidityNesting
CertDuplicateCRLContext
CertCompareCertificate
CertFreeCertificateContext
CryptDecryptAndVerifyMessageSignature
CertGetCertificateContextProperty
PFXVerifyPassword

mapistub

UNKOBJ_ScCOAllocate@12
FBadEntryList@4
SzFindLastCh@8
FBadRow@4
cmc_logon
MNLS_MultiByteToWideChar@24
LAUNCHWIZARD
BuildDisplayTable@40
FtDivFtBogus@20
MAPIAllocateBuffer@8
SzFindCh@8
LpValFindProp@12
CbOfEncoded@4
BMAPIGetAddress
cmc_logoff
MAPIFreeBuffer@4

kernel32

lstrcpyn
GlobalHandle
SetPriorityClass
GetTapeParameters
UTUnRegister
GetProcAddress
DeleteFileA
GetFileSize
DebugBreakProcess
VirtualAlloc
SetConsoleNumberOfCommandsW
GlobalUnlock
GetProcessPriorityBoost
GetEnvironmentStringsW
LocalFileTimeToFileTime
LoadLibraryA
FindCloseChangeNotification
SetThreadIdealProcessor
GetProfileSectionW
GetPrivateProfileIntA
GetCPInfo
GetProcessHeaps
GetProcessShutdownParameters

Sections

.text
Size: 717KB - Virtual size: 717KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

487d12152847df909ff16278e90bd87f

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

wiadss

utildll

crypt32

mapistub

kernel32

Sections

.text Size: 717KB - Virtual size: 717KB

.rdata Size: 124KB - Virtual size: 123KB

.data Size: 5KB - Virtual size: 1.4MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 717KB - Virtual size: 717KB

.rdata
Size: 124KB - Virtual size: 123KB

.data
Size: 5KB - Virtual size: 1.4MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB