c8d4835d340510c73a4b7dd1234b3c55_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

c8d4835d340510c73a4b7dd1234b3c55_JaffaCakes118
Size

356KB
MD5

c8d4835d340510c73a4b7dd1234b3c55
SHA1

46c7c4246fb2b886736b547c616dc3d5dbb25009
SHA256

c387d72de359b49963942c392caaae90eb4b61777c699602b7ba610d2e58f323
SHA512

cb0d1fe7a021cf520873010bc8cced89f4d69c180cf4c39fb7856d75287f3a0c6db0dadeec2835b04a88490dc3290caf4fa4ffdde2864fbababf69d5efce6f7d
SSDEEP

6144:9zVYlHLzlOkZU4v/hJsAFVO0N9JQblajADGbDPRpJ8BE942+Ejv1B6+5/fdec/DC:fYl/nhJFN9OBa0kPDTayvHXBDp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c8d4835d340510c73a4b7dd1234b3c55_JaffaCakes118

Files

c8d4835d340510c73a4b7dd1234b3c55_JaffaCakes118
.exe windows:5 windows x86 arch:x86

390cb601cacb3695cd54506b7e03f0ac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

LoadStringW
CharUpperW
wsprintfW

mpr

WNetAddConnection2W
WNetCancelConnection2W
WNetGetLastErrorW

ole32

CoInitializeSecurity
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CoInitializeEx

oleaut32

SafeArrayGetLBound
SafeArrayGetUBound
SysAllocStringByteLen
VariantChangeType
VariantClear
VariantCopy
VariantInit
SysFreeString
SafeArrayGetElement
SysStringLen
SysAllocString

secur32

TranslateNameW
GetComputerObjectNameW
GetUserNameExW

framedyn

??1CHString@@QAE@XZ
??0CHString@@QAE@XZ
?GetData@CHString@@IBEPAUCHStringData@@XZ
?Empty@CHString@@QAEXXZ
?Compare@CHString@@QBEHPBG@Z
?ReleaseBuffer@CHString@@QAEXH@Z
?GetBufferSetLength@CHString@@QAEPAGH@Z
?Format@CHString@@QAAXPBGZZ
??4CHString@@QAEABV0@ABV0@@Z
?Mid@CHString@@QBE?AV1@H@Z
?Find@CHString@@QBEHG@Z
?FindOneOf@CHString@@QBEHPBG@Z
?Left@CHString@@QBE?AV1@H@Z
??YCHString@@QAEABV0@PBG@Z
??0CHString@@QAE@PBG@Z
?Mid@CHString@@QBE?AV1@HH@Z
?Find@CHString@@QBEHPBG@Z
??0CHString@@QAE@ABV0@@Z
??H@YG?AVCHString@@ABV0@PBG@Z
?MakeLower@CHString@@QAEXXZ
?SetAt@CHString@@QAEXHG@Z
??H@YG?AVCHString@@ABV0@0@Z
?GetBuffer@CHString@@QAEPAGH@Z
??4CHString@@QAEABV0@PBG@Z

ntdsapi

DsBindWithCredW
DsUnBindW
DsFreeNameResultW
DsCrackNamesW

msvcrt

calloc
wcstok
wcslen
free
_wcsicmp
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
_iob
wcstod
wcstol
wcsstr
wcsncmp
_wcsnicmp
fflush
fprintf
wcschr
strtok
_CxxThrowException
_c_exit
_exit
?terminate@@YAXXZ
_controlfp
??1type_info@@UAE@XZ
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
_initterm
__setusermatherr
__wgetmainargs
__winitenv
exit
_cexit
wcscpy
_XcptFilter
realloc

advapi32

RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
RegConnectRegistryW
LookupAccountSidW
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

kernel32

CreateMutexW
CloseHandle
GetModuleHandleA
GetConsoleMode
SetConsoleMode
GetConsoleScreenBufferInfo
GetStdHandle
SetLastError
lstrlenW
WriteConsoleW
SetConsoleCursorPosition
lstrcmpiW
lstrcpyW
lstrcmpW
InterlockedIncrement
LocalAlloc
FormatMessageW
lstrcatW
InterlockedDecrement
GetComputerNameW
GetUserDefaultLCID
ReadFile
ReadConsoleW
MultiByteToWideChar
LoadLibraryW
GetProcAddress
FreeLibrary
LocalFree
GetLastError
OpenMutexW
GetTimeFormatW
lstrcpynW
WideCharToMultiByte
VerSetConditionMask
VerifyVersionInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetComputerNameExW
WaitForSingleObject
ReleaseMutex
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLocalTime
GetDateFormatW

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xdata
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 274B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vdata
Size: 512B - Virtual size: 97B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.kpack
Size: 512B - Virtual size: 78B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mpack
Size: 512B - Virtual size: 54B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.umak
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tmak
Size: 512B - Virtual size: 131B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.lmak
Size: 512B - Virtual size: 131B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

390cb601cacb3695cd54506b7e03f0ac

Headers

DLL Characteristics

File Characteristics

Imports

user32

mpr

ole32

oleaut32

secur32

framedyn

ntdsapi

msvcrt

advapi32

kernel32

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 84KB - Virtual size: 83KB

.data Size: 79KB - Virtual size: 79KB

.xdata Size: 79KB - Virtual size: 79KB

.tls Size: 79KB - Virtual size: 79KB

.pdata Size: 512B - Virtual size: 274B

.vdata Size: 512B - Virtual size: 97B

.kpack Size: 512B - Virtual size: 78B

.mpack Size: 512B - Virtual size: 54B

.umak Size: 1024B - Virtual size: 1024B

.tmak Size: 512B - Virtual size: 131B

.lmak Size: 512B - Virtual size: 131B

.CRT Size: 512B - Virtual size: 12B

.rsrc Size: 16KB - Virtual size: 16KB

.reloc Size: 512B - Virtual size: 264KB

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 84KB - Virtual size: 83KB

.data
Size: 79KB - Virtual size: 79KB

.xdata
Size: 79KB - Virtual size: 79KB

.tls
Size: 79KB - Virtual size: 79KB

.pdata
Size: 512B - Virtual size: 274B

.vdata
Size: 512B - Virtual size: 97B

.kpack
Size: 512B - Virtual size: 78B

.mpack
Size: 512B - Virtual size: 54B

.umak
Size: 1024B - Virtual size: 1024B

.tmak
Size: 512B - Virtual size: 131B

.lmak
Size: 512B - Virtual size: 131B

.CRT
Size: 512B - Virtual size: 12B

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 512B - Virtual size: 264KB