bdf41c7ac1d271022132a1518d4b9b78_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

bdf41c7ac1d271022132a1518d4b9b78_JaffaCakes118
Size

467KB
MD5

bdf41c7ac1d271022132a1518d4b9b78
SHA1

a2f7be618bc7fc1508cdf47ce4eb649b95244ced
SHA256

f65bfc57fde97bfe6c303e90d7cb66d15d22bdecaf2be661b9b1dfc0e5f5ca7e
SHA512

be5c13b523bbd6a2c62e647d2472ea3c38948acc678f582d7d9259dc4a27ed2d22c8ac65ed4f4d52d7572acb6f15152b3cb38e43a00123efb666823d11841ac2
SSDEEP

12288:t5llP9+9ettoXjMt1nNd1jT7W7Xa2krT213:t5lxtQjM7Nd1jvW7qx3213

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bdf41c7ac1d271022132a1518d4b9b78_JaffaCakes118

Files

bdf41c7ac1d271022132a1518d4b9b78_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3c225c526a41dbf5bd82f51d8a7e06b5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

cryptdll

CDFindCommonCSystemWithKey
CDLocateCheckSum
MD5Init
MD5Update
CDGenerateRandomBits
CDBuildIntegrityVect
MD5Final
CDLocateCSystem

msasn1

ASN1BERDecU32Val
ASN1BEREncEndOfContents
ASN1BERDecSXVal
ASN1objectidentifier_free
ASN1BEREncOctetString
ASN1BEREncS32
ASN1BERDecNotEndOfContents
ASN1BERDecS32Val
ASN1DecSetError
ASN1_CreateEncoder
ASN1_FreeEncoded
ASN1intx_free
ASN1BERDecGeneralizedTime
ASN1CEREncGeneralizedTime
ASN1Free
ASN1DecAlloc
ASN1intx2uint32
ASN1BEREncBool
ASN1BERDecPeekTag
ASN1_CreateDecoder
ASN1_Decode
ASN1BEREncOpenType
ASN1_CloseEncoder
ASN1BERDecBool
ASN1BEREncObjectIdentifier
ASN1BERDecZeroCharString
ASN1BERDecSkip
ASN1bitstring_free
ASN1EncSetError
ASN1charstring_free
ASN1_Encode
ASN1_CreateModule
ASN1octetstring_free
ASN1BEREncCharString
ASN1intx2int32
ASN1BERDecExplicitTag
ASN1BEREncU32
ASN1BERDecOctetString
ASN1BEREncExplicitTag
ASN1intx_setuint32
ASN1intxisuint32
ASN1_FreeDecoded
ASN1ztcharstring_free
ASN1BERDecBitString
ASN1_CloseDecoder
ASN1BEREncSX
ASN1BEREncBitString
ASN1BERDecOpenType2
ASN1BERDecObjectIdentifier
ASN1BERDecEndOfContents
ASN1BERDecCharString

user32

wsprintfW
CharLowerBuffW

advapi32

SetThreadToken
RegEnumKeyExW
OpenThreadToken
TraceEvent
RegSetValueExW
RevertToSelf
SystemFunction007
RegQueryValueExW
ReportEventW
OpenProcessToken
RegCloseKey
GetTraceLoggerHandle
CryptCreateHash
RegConnectRegistryW
LookupAccountSidW
OpenServiceW
RegNotifyChangeKeyValue
QueryServiceStatus
RegDeleteValueW
CryptAcquireContextW
CryptGetHashParam
CredUnmarshalCredentialW
CryptReleaseContext
DeregisterEventSource
CredFree
CryptHashData
RegOpenKeyExW
SystemFunction006
CryptSetProvParam
RegQueryInfoKeyW
QueryServiceConfigW
OpenSCManagerW
CryptGetProvParam
RegisterEventSourceW
RegCreateKeyExW
AllocateAndInitializeSid
CryptDestroyHash
RegOpenKeyW
RegisterTraceGuidsW
FreeSid
GetTokenInformation
CloseServiceHandle

ntdll

RtlCreateSecurityDescriptor
RtlAnsiStringToUnicodeString
RtlAppendUnicodeStringToString
RtlAddAccessAllowedAce
RtlAllocateAndInitializeSid
RtlRunDecodeUnicodeString
RtlInitializeSid
NtOpenThreadToken
RtlInitializeCriticalSection
RtlCopyUnicodeString
RtlPrefixUnicodeString
RtlCreateTimer
RtlSystemTimeToLocalTime
RtlAcquireResourceExclusive
RtlLeaveCriticalSection
RtlFreeAnsiString
RtlInitializeGenericTable
NtAllocateVirtualMemory
RtlVerifyVersionInfo
RtlFreeUnicodeString
NtQueryInformationToken
RtlEqualSid
RtlInitializeGenericTableAvl
RtlCreateAcl
RtlTimeFieldsToTime
RtlDeleteElementGenericTable
NtQuerySystemInformation
RtlInitAnsiString
RtlCompareMemory
RtlCopySid
RtlInsertElementGenericTableAvl
RtlUniform
RtlCompareUnicodeString
NtAllocateLocallyUniqueId
RtlEnterCriticalSection
RtlEqualDomainName
RtlSubAuthoritySid
NtOpenProcessToken
RtlOemStringToUnicodeString
RtlUnicodeStringToAnsiString
RtlDeleteResource
RtlInsertElementGenericTable
RtlLengthRequiredSid
RtlInitializeResource
RtlSubAuthorityCountSid
RtlConvertSharedToExclusive
RtlConvertSidToUnicodeString
RtlSetDaclSecurityDescriptor
RtlLookupElementGenericTable
RtlValidSid
RtlFreeSid
RtlReleaseResource
RtlTimeToTimeFields
RtlInitUnicodeString
RtlDeleteTimerQueue
DbgPrint
NtQuerySystemTime
RtlLookupElementGenericTableAvl
NtOpenEvent
NtCreateEvent
NtClose
RtlIntegerToUnicodeString
RtlGetElementGenericTable
RtlRegisterWait
NtWaitForSingleObject
RtlEqualUnicodeString
NtDuplicateObject
RtlCreateTimerQueue
NtSetSecurityObject
RtlCopyLuid
RtlDowncaseUnicodeString
RtlDeleteCriticalSection
RtlLengthSid
RtlEraseUnicodeString
RtlNtStatusToDosError
VerSetConditionMask
RtlDeregisterWait
RtlAcquireResourceShared

secur32

CredMarshalTargetInfo
LsaGetLogonSessionData
FreeContextBuffer
LsaFreeReturnBuffer
CredUnmarshalTargetInfo

kernel32

GetCurrentThread
GetLocalTime
GetLastError
MultiByteToWideChar
LocalFree
RaiseException
Sleep
DisableThreadLibraryCalls
CreateFileW
WideCharToMultiByte
lstrlenA
GetProcAddress
UnregisterWait
LocalAlloc
GetModuleFileNameA
DeleteCriticalSection
SetUnhandledExceptionFilter
FileTimeToSystemTime
WriteFile
GetCurrentThreadId
CreateEventW
GetSystemTimeAsFileTime
InterlockedExchange
lstrcmpW
LoadLibraryW
OpenEventW
GetComputerNameExW
InterlockedDecrement
QueryPerformanceCounter
ExpandEnvironmentStringsW
lstrcmpiA
GetACP
RegisterWaitForSingleObjectEx
UnmapViewOfFile
FormatMessageW
GetEnvironmentVariableW
GetProfileStringA
EnterCriticalSection
SetEvent
GetCurrentProcess
UnhandledExceptionFilter
GetComputerNameW
CreateFileMappingW
GetModuleHandleW
LoadLibraryA
GetCurrentProcessId
InitializeCriticalSection
InterlockedCompareExchange
GetTickCount
MapViewOfFileEx
InterlockedIncrement
lstrcpyW
GetModuleFileNameW
CreateFileA
InterlockedExchangeAdd
DebugBreak
CloseHandle
VirtualAlloc
OutputDebugStringA
TerminateProcess
OpenFileMappingW
LeaveCriticalSection
lstrlenW
GetSystemInfo
FreeLibrary

msvcrt

_strcmpi
wcstoul
_vsnprintf
_ultoa
wcscmp
_wcsicmp
swprintf
sscanf
_initterm
sprintf
wcslen
_wcsnicmp
free
_adjust_fdiv
strrchr
_strnicmp
strchr
wcsspn
qsort
malloc
wcsrchr
wcscpy
wcscat
_except_handler3
_stricmp

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 984KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 365KB - Virtual size: 365KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3c225c526a41dbf5bd82f51d8a7e06b5

Headers

File Characteristics

Imports

cryptdll

msasn1

user32

advapi32

ntdll

secur32

kernel32

msvcrt

Sections

.text Size: 31KB - Virtual size: 31KB

.reloc Size: 512B - Virtual size: 20B

.data Size: 23KB - Virtual size: 984KB

.rsrc Size: 46KB - Virtual size: 45KB

.rdata Size: 365KB - Virtual size: 365KB

.text
Size: 31KB - Virtual size: 31KB

.reloc
Size: 512B - Virtual size: 20B

.data
Size: 23KB - Virtual size: 984KB

.rsrc
Size: 46KB - Virtual size: 45KB

.rdata
Size: 365KB - Virtual size: 365KB