c92f3d837dc7499a6722ff3427f1c8db_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c92f3d837dc7499a6722ff3427f1c8db_JaffaCakes118
Size

329KB
MD5

c92f3d837dc7499a6722ff3427f1c8db
SHA1

a2eaa5a34573c622b3a1ef74557aa6335844e5e9
SHA256

f1f5c100c41d1774f798535e028c03ba022f0ea126595fff4e0f5d135901071d
SHA512

94d663b69ca1d86981110db1dac48f06caa8c97d3a0ab4a7f9dd68f8e7067a1f995fb773801f2e10b105e16ccd614c5a6c9d9b66d1eadbd237c5780fb2648184
SSDEEP

6144:zPAkZ5pUOpotGiIOePFB/wsrAWpU9ph8IUXGLdRuoHrWCpuIcaOLsVIEkKrxUpgH:QtG/PFBVrAxfGIUXjxA53OLs1kKqpZRB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c92f3d837dc7499a6722ff3427f1c8db_JaffaCakes118

Files

c92f3d837dc7499a6722ff3427f1c8db_JaffaCakes118
.exe windows:5 windows x86 arch:x86

4076869c0cc2d5794ad442063e3314de

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LeaveCriticalSection
InterlockedExchange
VirtualAlloc
InterlockedDecrement
lstrcmpiA
RaiseException
DebugBreak
WideCharToMultiByte
SetUnhandledExceptionFilter
GetTickCount
GetLastError
UnmapViewOfFile
UnhandledExceptionFilter
MultiByteToWideChar
TerminateProcess
WriteFile
GetModuleFileNameW
DisableThreadLibraryCalls
CreateFileW
InterlockedIncrement
LoadLibraryA
GetACP
GetProcAddress
CreateFileMappingW
Sleep
GetCurrentThread
FileTimeToSystemTime
LocalAlloc
GetCurrentProcessId
CloseHandle
ExpandEnvironmentStringsW
OpenFileMappingW
SetEvent
GetComputerNameExW
lstrlenW
OpenEventW
GetModuleHandleW
GetLocalTime
lstrcpyW
InterlockedExchangeAdd
CreateEventW
DeleteCriticalSection
QueryPerformanceCounter
UnregisterWait
GetCurrentThreadId
InitializeCriticalSection
GetSystemTimeAsFileTime
EnterCriticalSection
GetProfileStringA
RegisterWaitForSingleObjectEx
FreeLibrary
FormatMessageW
GetModuleFileNameA
CreateFileA
LoadLibraryW
lstrlenA
LocalFree
GetSystemInfo
InterlockedCompareExchange
OutputDebugStringA
GetCurrentProcess
MapViewOfFileEx
GetComputerNameW
GetEnvironmentVariableW
lstrcmpW

user32

CharLowerBuffW
wsprintfW

secur32

CredMarshalTargetInfo
CredUnmarshalTargetInfo
FreeContextBuffer
LsaGetLogonSessionData
LsaFreeReturnBuffer

msasn1

ASN1intx2int32
ASN1ztcharstring_free
ASN1_Decode
ASN1BEREncCharString
ASN1EncSetError
ASN1Free
ASN1BEREncEndOfContents
ASN1_CloseEncoder
ASN1BERDecSXVal
ASN1BEREncExplicitTag
ASN1BERDecObjectIdentifier
ASN1_FreeEncoded
ASN1BERDecCharString
ASN1BERDecBool
ASN1BERDecS32Val
ASN1BERDecBitString
ASN1BERDecPeekTag
ASN1BERDecEndOfContents
ASN1BEREncBool
ASN1intx_setuint32
ASN1BEREncU32
ASN1BERDecExplicitTag
ASN1BERDecOctetString
ASN1_FreeDecoded
ASN1BEREncSX
ASN1DecAlloc
ASN1BEREncOpenType
ASN1intxisuint32
ASN1BERDecGeneralizedTime
ASN1BEREncObjectIdentifier
ASN1BEREncOctetString
ASN1BERDecU32Val
ASN1_Encode
ASN1BERDecSkip
ASN1_CloseDecoder
ASN1_CreateEncoder
ASN1BEREncS32
ASN1octetstring_free
ASN1intx2uint32
ASN1BERDecOpenType2
ASN1BEREncBitString
ASN1intx_free
ASN1CEREncGeneralizedTime
ASN1_CreateModule
ASN1objectidentifier_free
ASN1BERDecZeroCharString
ASN1_CreateDecoder
ASN1charstring_free
ASN1DecSetError
ASN1BERDecNotEndOfContents
ASN1bitstring_free

msvcrt

_stricmp
wcscat
wcslen
strrchr
_wcsnicmp
strchr
_adjust_fdiv
_strnicmp
malloc
wcscmp
sscanf
wcsrchr
_ultoa
free
sprintf
_initterm
swprintf
_except_handler3
wcscpy
_wcsicmp
_vsnprintf
wcstoul
qsort
_strcmpi
wcsspn

ntdll

RtlAnsiStringToUnicodeString
RtlValidSid
NtOpenEvent
RtlEqualSid
RtlLengthRequiredSid
RtlTimeToTimeFields
NtAllocateVirtualMemory
RtlEqualUnicodeString
RtlEnterCriticalSection
RtlCopyUnicodeString
RtlConvertSharedToExclusive
RtlInitializeSid
RtlDeleteCriticalSection
RtlSubAuthorityCountSid
RtlAppendUnicodeStringToString
RtlCreateSecurityDescriptor
NtOpenThreadToken
NtQuerySystemTime
RtlLeaveCriticalSection
RtlEraseUnicodeString
RtlFreeSid
RtlDeleteTimerQueue
RtlConvertSidToUnicodeString
NtOpenProcessToken
NtAllocateLocallyUniqueId
RtlEqualDomainName
RtlCreateTimerQueue
RtlInsertElementGenericTable
NtDuplicateObject
RtlTimeFieldsToTime
RtlInitializeCriticalSection
RtlLookupElementGenericTable
NtClose
RtlInitAnsiString
DbgPrint
RtlRunDecodeUnicodeString
NtCreateEvent
RtlDowncaseUnicodeString
RtlPrefixUnicodeString
RtlCreateAcl
RtlVerifyVersionInfo
RtlSetDaclSecurityDescriptor
RtlCopySid
RtlUniform
RtlAllocateAndInitializeSid
RtlCopyLuid
NtSetSecurityObject
RtlDeleteElementGenericTable
NtWaitForSingleObject
RtlCompareUnicodeString
RtlReleaseResource
RtlAcquireResourceExclusive
RtlFreeUnicodeString
RtlSystemTimeToLocalTime
RtlOemStringToUnicodeString
RtlInitializeGenericTableAvl
VerSetConditionMask
RtlInitUnicodeString
NtQueryInformationToken
RtlDeleteResource
RtlUpcaseUnicodeString
RtlIntegerToUnicodeString
RtlLengthSid
RtlInsertElementGenericTableAvl
RtlDeregisterWait
RtlCompareMemory
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
RtlAcquireResourceShared
RtlSubAuthoritySid
RtlInitializeGenericTable
RtlNtStatusToDosError
RtlGetElementGenericTable
RtlInitializeResource
RtlLookupElementGenericTableAvl
NtQuerySystemInformation
RtlRegisterWait
RtlCreateTimer

advapi32

ReportEventW
SystemFunction007
CryptGetProvParam
CryptHashData
CryptSetProvParam
CredFree
GetTokenInformation
RegCloseKey
RegCreateKeyExW
QueryServiceStatus
CryptDestroyHash
RegNotifyChangeKeyValue
SetThreadToken
CryptAcquireContextW
CryptGetHashParam
LookupAccountSidW
RegQueryValueExW
FreeSid
QueryServiceConfigW
RegQueryInfoKeyW
RevertToSelf
RegOpenKeyW
SystemFunction006
OpenSCManagerW
RegisterEventSourceW
RegSetValueExW
RegOpenKeyExW
CredUnmarshalCredentialW
CryptReleaseContext
AllocateAndInitializeSid
RegEnumKeyExW
CloseServiceHandle
DeregisterEventSource
RegConnectRegistryW
RegisterTraceGuidsW
OpenServiceW
OpenProcessToken
TraceEvent
CryptCreateHash
OpenThreadToken
RegDeleteValueW
GetTraceLoggerHandle

cryptdll

CDLocateCSystem
MD5Update
MD5Final
CDLocateCheckSum
CDGenerateRandomBits
CDFindCommonCSystemWithKey
MD5Init
CDBuildIntegrityVect

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4076869c0cc2d5794ad442063e3314de

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

secur32

msasn1

msvcrt

ntdll

advapi32

cryptdll

Sections

.text Size: 18KB - Virtual size: 17KB

.data Size: 9KB - Virtual size: 1.4MB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 36KB - Virtual size: 36KB

.rdata Size: 264KB - Virtual size: 263KB

.text
Size: 18KB - Virtual size: 17KB

.data
Size: 9KB - Virtual size: 1.4MB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 36KB - Virtual size: 36KB

.rdata
Size: 264KB - Virtual size: 263KB