b5c7a15f7d5f5ba64493df1b777d858b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b5c7a15f7d5f5ba64493df1b777d858b_JaffaCakes118
Size

443KB
MD5

b5c7a15f7d5f5ba64493df1b777d858b
SHA1

6211838a9738acdef6f49292f88f7ccbd4217e2b
SHA256

8f084c4fb6d134c94fc16ef9ca3ea36375c7747fc8f06430e9188ebaf19b23a8
SHA512

f6a0ab6c2d0707fdc29e898f7f76849f6f4f15acfce77827530279c98182b2692d2d382a1499a254fe5fe37ddabc3be03e2b2e4d3bd69c9b62a8320fc8f6937e
SSDEEP

12288:k+wXquuKZKCXBb8GV6GkNLcPMvzCMadS4:k+wXqudZPX5nIGkNLZvzCw4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b5c7a15f7d5f5ba64493df1b777d858b_JaffaCakes118

Files

b5c7a15f7d5f5ba64493df1b777d858b_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e4fd71de087a2a0a63f0e1bec223c7a0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

malloc
_except_handler3
wcslen
wcscpy
wcscat
memmove
free
vfwprintf
_errno
fputs
atoi
wcschr
_initterm
_adjust_fdiv
??2@YAPAXI@Z
??3@YAXPAX@Z
__isascii
swscanf
sprintf
wcstoul
wcstok
_wcsicmp
wcstol
_wtoi
_wtol
wcsrchr
_snwprintf
_vsnprintf
_iob
fflush
strcspn
fwprintf
strchr
fopen
getenv
fseek
ftell
fclose
fprintf
isxdigit
isdigit
isupper
_snprintf
strncmp
wcscmp
swprintf
_wcsnicmp
wcsncpy
wcsstr

atl

ord22
ord18
ord21
ord16
ord32
ord15

kernel32

GetComputerNameA
GetProcAddress
lstrcmpA
GetEnvironmentVariableA
GetVersionExA
GetTimeFormatA
FileTimeToLocalFileTime
GetEnvironmentVariableA
GetConsoleOutputCP
GetFileType
GetComputerNameExA
EnterCriticalSection
LeaveCriticalSection
GetLastError
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
FileTimeToSystemTime
FormatMessageA
CompareFileTime
WriteFile
GetStdHandle
OutputDebugStringA
SetLastError
GetDateFormatA
WriteConsoleA
GetWindowsDirectoryA
GetSystemTime
SystemTimeToFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
DebugBreak
QueryPerformanceCounter
CreateThread
WaitForSingleObject
GetExitCodeThread
GetSystemDirectoryA
Sleep
DuplicateHandle
CreateEventA
RegisterWaitForSingleObject
UnregisterWait
LoadLibraryA
FreeLibrary
GetACP
CreateFileA
GetFileSize
ReadFile
LocalReAlloc
LocalAlloc
LocalFree
DisableThreadLibraryCalls
DeleteCriticalSection
InitializeCriticalSection
lstrcmpiA
GetModuleFileNameA
GetModuleHandleA
GetCurrentThread
GetCurrentProcess
CloseHandle
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
GetTickCount

advapi32

RegOpenKeyW
RegCreateKeyW
AllocateAndInitializeSid
AccessCheckByType
LsaOpenPolicy
LsaNtStatusToWinError
LsaQueryInformationPolicy
LsaFreeMemory
LsaClose
FreeSid
RegQueryInfoKeyW
GetSecurityDescriptorLength
RegOpenCurrentUser
MakeAbsoluteSD
MakeSelfRelativeSD
DuplicateToken
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegDeleteValueW
IsValidSecurityDescriptor
OpenThreadToken
RegEnumKeyExW
EqualSid
RegConnectRegistryW
OpenProcessToken
GetTokenInformation
SetSecurityDescriptorOwner
GetLengthSid
CopySid
RegEnumValueW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteKeyW

wldap32

ord27
ord203
ord69
ord73
ord14
ord145
ord13
ord41
ord36
ord210
ord224
ord79
ord155
ord147
ord142
ord140
ord26
ord113
ord65
ord40
ord194
ord133
ord10
ord12
ord18
ord16
ord167
ord127
ord208
ord122

ole32

CoCreateInstance
CoTaskMemAlloc
StringFromCLSID
CoUninitialize
CoInitialize
CoCreateInstanceEx
CoSetProxyBlanket
CoTaskMemFree

oleaut32

CreateErrorInfo
SystemTimeToVariantTime
VARIANT_UserSize
VARIANT_UserMarshal
VARIANT_UserUnmarshal
VARIANT_UserFree
SetErrorInfo
LoadRegTypeLi
VariantInit
VariantClear
SysStringByteLen
SysAllocStringByteLen
SysFreeString
SysAllocString

secur32

QuerySecurityContextToken
DeleteSecurityContext
AcceptSecurityContext
InitializeSecurityContextW
EnumerateSecurityPackagesW
FreeContextBuffer
AcquireCredentialsHandleW
QueryCredentialsAttributesW
FreeCredentialsHandle

user32

wsprintfW
GetDesktopWindow
LoadStringW

rpcrt4

RpcCancelThreadEx
NdrClientCall2
NdrOleAllocate
NdrOleFree
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
RpcBindingSetAuthInfoW
RpcBindingFree
RpcNetworkIsProtseqValidW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcEpResolveBinding
RpcMgmtInqServerPrincNameW
RpcStringFreeW

cryptui

CryptUIDlgFreeCAContext
CryptUIDlgSelectCA

crypt32

CryptMsgGetParam
CryptMsgClose
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertFindExtension
CryptDecodeObject
CryptSignMessage
CertNameToStrW
CryptMsgUpdate
CryptFindOIDInfo
CryptEncodeObject
CertFindCTLInStore
CertDeleteCTLFromStore
CertAddEncodedCTLToStore
CryptMsgEncodeAndSignCTL
CertGetCertificateContextProperty
CryptHashCertificate
CertGetCertificateChain
CertCreateCertificateContext
CertFindCertificateInStore
CertOpenStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertCloseStore
CertStrToNameW
CryptMsgOpenToDecode
CryptEncodeObjectEx
CryptDecodeObjectEx
CertGetNameStringW

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 420KB - Virtual size: 424KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e4fd71de087a2a0a63f0e1bec223c7a0

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

atl

kernel32

advapi32

wldap32

ole32

oleaut32

secur32

user32

rpcrt4

cryptui

crypt32

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 420KB - Virtual size: 424KB

.data Size: 1KB - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.CRT Size: 512B - Virtual size: 4KB

.rsrc Size: 11KB - Virtual size: 40KB

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 420KB - Virtual size: 424KB

.data
Size: 1KB - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.CRT
Size: 512B - Virtual size: 4KB

.rsrc
Size: 11KB - Virtual size: 40KB