bd5af49ff4b650b1518334d8eb65f2c1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

bd5af49ff4b650b1518334d8eb65f2c1_JaffaCakes118
Size

96KB
MD5

bd5af49ff4b650b1518334d8eb65f2c1
SHA1

0fb5e9534ab588b66c1ec5facf9afc86f82cc4a7
SHA256

9107e9ba8a4fdc94cf92bbf28c4f51351e632cd96ea83e5c70c963ac2a0fd1c5
SHA512

48a78137d9dc0e3013feca3f3ff7a4a8da5ff6d53cd51599f9ab74eb8d2732a413b866d72105084a36403c7047857bd6226caee269fd9b1c915b8fd8725a74bd
SSDEEP

1536:oh9Zw2CLnKg5poBnr0CZ5M6pjf8uMMWd4KZ36sT8OM02NfsVO1TYJn2:Kpg56Br0gi6Z5y36swOglsVYp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bd5af49ff4b650b1518334d8eb65f2c1_JaffaCakes118

Files

bd5af49ff4b650b1518334d8eb65f2c1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

29761038de737d5bce44b24e8364c07a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

cryptdll

MD5Init
MD5Final
CDFindCommonCSystemWithKey
CDBuildIntegrityVect
CDLocateCheckSum
CDGenerateRandomBits
CDLocateCSystem
MD5Update

advapi32

DeregisterEventSource
OpenServiceW
GetTokenInformation
CryptReleaseContext
CryptHashData
QueryServiceConfigW
RegQueryValueExW
RegOpenKeyW
CryptSetProvParam
ReportEventW
CryptAcquireContextW
CredUnmarshalCredentialW
RegisterEventSourceW
RegOpenKeyExW
RegCreateKeyExW
CryptGetHashParam
RegNotifyChangeKeyValue
SystemFunction007
CredFree
RegEnumKeyExW
RevertToSelf
TraceEvent
FreeSid
RegQueryInfoKeyW
RegConnectRegistryW
LookupAccountSidW
RegCloseKey
CryptGetProvParam
CryptCreateHash
OpenThreadToken
SetThreadToken
OpenProcessToken
SystemFunction006
CryptDestroyHash
RegisterTraceGuidsW
RegDeleteValueW
QueryServiceStatus
AllocateAndInitializeSid
OpenSCManagerW
RegSetValueExW
GetTraceLoggerHandle
CloseServiceHandle

ntdll

NtOpenThreadToken
RtlAllocateAndInitializeSid
RtlNtStatusToDosError
RtlSubAuthoritySid
RtlLengthRequiredSid
RtlInsertElementGenericTable
RtlCompareMemory
RtlInsertElementGenericTableAvl
RtlRegisterWait
RtlInitializeGenericTableAvl
NtSetSecurityObject
RtlSubAuthorityCountSid
RtlTimeToTimeFields
RtlEraseUnicodeString
RtlInitializeResource
RtlUniform
RtlCopyUnicodeString
RtlAddAccessAllowedAce
RtlAppendUnicodeStringToString
RtlDeleteElementGenericTable
RtlVerifyVersionInfo
RtlPrefixUnicodeString
RtlInitializeCriticalSection
RtlCompareUnicodeString
NtCreateEvent
RtlAcquireResourceShared
RtlOemStringToUnicodeString
RtlCopySid
RtlInitializeSid
NtQuerySystemTime
RtlDeleteTimerQueue
RtlLeaveCriticalSection
RtlFreeUnicodeString
RtlReleaseResource
NtAllocateLocallyUniqueId
NtAllocateVirtualMemory
RtlInitAnsiString
RtlDeleteCriticalSection
NtOpenEvent
RtlInitializeGenericTable
NtOpenProcessToken
RtlRunDecodeUnicodeString
RtlCopyLuid
RtlFreeSid
RtlEqualUnicodeString
RtlDeleteResource
RtlSetDaclSecurityDescriptor
RtlIntegerToUnicodeString
RtlUpcaseUnicodeString
RtlCreateTimerQueue
DbgPrint
RtlEqualDomainName
RtlEqualSid
RtlGetElementGenericTable
RtlConvertSidToUnicodeString
RtlCreateSecurityDescriptor
NtClose
RtlConvertSharedToExclusive
RtlLengthSid
RtlCreateAcl
RtlEnterCriticalSection
RtlTimeFieldsToTime
RtlFreeAnsiString
RtlAnsiStringToUnicodeString
RtlCreateTimer
RtlLookupElementGenericTable
NtQueryInformationToken
NtQuerySystemInformation
NtDuplicateObject
RtlSystemTimeToLocalTime
RtlLookupElementGenericTableAvl
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
RtlDowncaseUnicodeString
RtlDeregisterWait
NtWaitForSingleObject
VerSetConditionMask
RtlValidSid

secur32

FreeContextBuffer
CredUnmarshalTargetInfo
CredMarshalTargetInfo
LsaGetLogonSessionData
LsaFreeReturnBuffer

msasn1

ASN1BEREncBool
ASN1BERDecSkip
ASN1intx_free
ASN1_Encode
ASN1BERDecNotEndOfContents
ASN1BEREncBitString
ASN1BERDecBitString
ASN1intx2int32
ASN1BERDecU32Val
ASN1BERDecPeekTag
ASN1octetstring_free
ASN1_FreeDecoded
ASN1objectidentifier_free
ASN1BERDecEndOfContents
ASN1_Decode
ASN1BERDecExplicitTag
ASN1Free
ASN1BERDecBool
ASN1BERDecZeroCharString
ASN1_CloseEncoder
ASN1DecSetError
ASN1bitstring_free
ASN1intxisuint32
ASN1BEREncCharString
ASN1BEREncSX
ASN1_CreateModule
ASN1intx2uint32
ASN1BERDecObjectIdentifier
ASN1intx_setuint32
ASN1BERDecSXVal
ASN1EncSetError
ASN1BERDecCharString
ASN1BEREncOpenType
ASN1BEREncExplicitTag
ASN1BEREncOctetString
ASN1BERDecGeneralizedTime
ASN1BERDecOpenType2
ASN1_CreateDecoder
ASN1ztcharstring_free
ASN1BEREncEndOfContents
ASN1BERDecS32Val
ASN1DecAlloc
ASN1_FreeEncoded
ASN1BEREncObjectIdentifier
ASN1BEREncU32
ASN1CEREncGeneralizedTime
ASN1_CreateEncoder
ASN1BEREncS32
ASN1_CloseDecoder
ASN1charstring_free
ASN1BERDecOctetString

msvcrt

wcscmp
sscanf
wcslen
_strnicmp
wcscat
wcscpy
wcsrchr
sprintf
strchr
_strcmpi
_ultoa
_initterm
wcsspn
_adjust_fdiv
_vsnprintf
_stricmp
malloc
wcstoul
qsort
_except_handler3
_wcsnicmp
free
_wcsicmp
strrchr
swprintf

kernel32

InterlockedIncrement
WriteFile
UnhandledExceptionFilter
SetEvent
GetLocalTime
QueryPerformanceCounter
RegisterWaitForSingleObjectEx
lstrlenA
VirtualAlloc
GetLastError
InterlockedCompareExchange
InterlockedExchangeAdd
ExpandEnvironmentStringsW
InitializeCriticalSection
GetComputerNameExW
LocalFree
DeleteCriticalSection
CreateFileW
GetProfileStringA
LoadLibraryA
CloseHandle
GetProcAddress
GetCurrentProcess
DisableThreadLibraryCalls
GetCurrentThreadId
GetSystemInfo
lstrlenW
TerminateProcess
GetACP
GetModuleFileNameW
CreateFileA
GetModuleFileNameA
GetModuleHandleW
OpenFileMappingW
MapViewOfFileEx
FormatMessageW
SetUnhandledExceptionFilter
lstrcpyW
GetCurrentThread
GetEnvironmentVariableW
CreateEventW
lstrcmpiA
InterlockedDecrement
GetComputerNameW
LeaveCriticalSection
UnregisterWait
CreateFileMappingW
UnmapViewOfFile
WideCharToMultiByte
DebugBreak
LoadLibraryW
GetSystemTimeAsFileTime
GetTickCount
FileTimeToSystemTime
Sleep
MultiByteToWideChar
lstrcmpW
GetCurrentProcessId
FreeLibrary
OpenEventW
EnterCriticalSection
LocalAlloc
InterlockedExchange
OutputDebugStringA
RaiseException

user32

wsprintfW
CharLowerBuffW

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 984KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 365KB - Virtual size: 365KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

29761038de737d5bce44b24e8364c07a

Headers

File Characteristics

Imports

cryptdll

advapi32

ntdll

secur32

msasn1

msvcrt

kernel32

user32

Sections

.text Size: 31KB - Virtual size: 31KB

.reloc Size: 512B - Virtual size: 20B

.data Size: 23KB - Virtual size: 984KB

.rsrc Size: 46KB - Virtual size: 45KB

.rdata Size: 365KB - Virtual size: 365KB

.text
Size: 31KB - Virtual size: 31KB

.reloc
Size: 512B - Virtual size: 20B

.data
Size: 23KB - Virtual size: 984KB

.rsrc
Size: 46KB - Virtual size: 45KB

.rdata
Size: 365KB - Virtual size: 365KB