bbecf9d522b130b18c89bba0891deb4a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

bbecf9d522b130b18c89bba0891deb4a_JaffaCakes118
Size

126KB
MD5

bbecf9d522b130b18c89bba0891deb4a
SHA1

2981e93e39e9a0e9488ec4fe301147dfc3b999d9
SHA256

82b2173e62fb9c0fd4f2adabff1d72d5c13069c5a64f91ff75175f6bece07df8
SHA512

1039961ca7bd61763dd788ffee6bea2654f7379a7bedc56a17788b165266d4a4554199077696047ed5eefb625867171c60c2e15af1423149d180810221cfd2b2
SSDEEP

3072:202gdQoD0TdkxSb2L0MI/O+il3qkymoyj39+VzhNXi8ipYh0hc:2Bgdd+dkxZ4MI/OZ3Qmo632i8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bbecf9d522b130b18c89bba0891deb4a_JaffaCakes118

Files

bbecf9d522b130b18c89bba0891deb4a_JaffaCakes118
.exe windows:6 windows x86 arch:x86

96492b298bc428b6b5486d205cc84968

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

RAServer.pdb

Imports

advapi32

RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
InitializeAcl
InitializeSecurityDescriptor
MakeAbsoluteSD
IsValidRelativeSecurityDescriptor
RegQueryValueExW
IsValidSecurityDescriptor
MakeSelfRelativeSD
FreeSid
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
AddAccessAllowedAce
GetLengthSid
AllocateAndInitializeSid
AddAccessDeniedAce
GetAce
GetAclInformation
IsValidAcl
GetSecurityDescriptorDacl
DeleteAce
EqualSid
RegEnumValueW
CryptReleaseContext
CryptDestroyKey
CryptGenKey
CryptGetUserKey
CryptAcquireContextW
CryptExportKey
CryptDecrypt
CryptImportKey
CryptEncrypt
EventUnregister
EventWrite
EventRegister

kernel32

InterlockedDecrement
LoadLibraryW
GetProcAddress
GetModuleHandleW
lstrcmpiW
CloseHandle
CreateEventW
GetModuleFileNameW
FreeLibrary
InitializeCriticalSection
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
HeapFree
HeapAlloc
GetProcessHeap
WideCharToMultiByte
GetACP
WaitForSingleObject
CreateThread
Sleep
GetCurrentThreadId
SetEvent
GetCommandLineW
CompareStringW
InterlockedIncrement
ResetEvent
SetLastError
GetSystemDirectoryW
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryExA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedExchange
GetVersionExA
GetLastError
HeapSetInformation
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
OutputDebugStringA
lstrlenW
MultiByteToWideChar

user32

CharNextW
UnregisterClassA
CharUpperW
PostThreadMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadStringW

msvcrt

_onexit
__wgetmainargs
_callnewh
_controlfp
?what@exception@@UBEPBDXZ
??0exception@@QAE@XZ
wcsncmp
??1exception@@UAE@XZ
_lock
__dllonexit
_unlock
_errno
_wtol
?terminate@@YAXXZ
_except_handler4_common
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
memcpy
_wtoi
_vsnwprintf
wcscat_s
wcscpy_s
memset
_purecall
__CxxFrameHandler3
wcsncpy_s
_CxxThrowException
memcpy_s
free
malloc
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
realloc
_cexit
??0exception@@QAE@ABV0@@Z
iswdigit

shlwapi

StrCmpIW

oleaut32

SysAllocStringByteLen
SysStringByteLen
UnRegisterTypeLi
RegisterTypeLi
SafeArrayDestroy
SysAllocString
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
SysStringLen
SysFreeString
SafeArrayAccessData
SafeArrayCreateVector
SafeArrayUnaccessData
VarBstrCmp
SysAllocStringLen
VarBstrCat

ole32

CoWaitForMultipleHandles
CoResumeClassObjects
CoCreateInstance
StringFromGUID2
CoRegisterClassObject
CoRevokeClassObject
CoSuspendClassObjects
CoUninitialize
CoInitializeEx
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW
WTSEnumerateSessionsW

shell32

ShellExecuteW
SHGetSpecialFolderPathW

netapi32

NetLocalGroupGetInfo
NetLocalGroupAdd
NetLocalGroupDel
NetLocalGroupAddMembers
NetLocalGroupDelMembers
NetLocalGroupGetMembers
NetApiBufferFree

crypt32

CryptStringToBinaryW
CryptBinaryToStringW

Sections

.text
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

uonmevq
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

96492b298bc428b6b5486d205cc84968

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

shlwapi

oleaut32

ole32

wtsapi32

shell32

netapi32

crypt32

Sections

.text Size: 77KB - Virtual size: 76KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 14KB - Virtual size: 13KB

.reloc Size: 34KB - Virtual size: 35KB

uonmevq Size: - Virtual size: 4KB

.text
Size: 77KB - Virtual size: 76KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 14KB - Virtual size: 13KB

.reloc
Size: 34KB - Virtual size: 35KB

uonmevq
Size: - Virtual size: 4KB