cf49dcd93ed07d3a08b3ecf4730b2e0a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

cf49dcd93ed07d3a08b3ecf4730b2e0a_JaffaCakes118
Size

173KB
MD5

cf49dcd93ed07d3a08b3ecf4730b2e0a
SHA1

86a05434977d5f0154c432702cad212e406a1a63
SHA256

0dc742c49a85f9e481148faa5be4d378f6ece23a05005417c5639433859250a6
SHA512

4703fecee365bcca94e46b9a22c12a45841152194a18ee65d7a753f6b6bb860e88c49920da408de0a64d23c40cbfdb3b925d8565ea36260a994b7695cf70801c
SSDEEP

3072:D/CS1/V2EPuYwGbPrJAGHc5DOYm8V8SmHz0E6tgl4dxDV9pkCvhUsFkx4od2j0Gj:LCSuJorJAfOf28FN8lV9HoW4h7y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf49dcd93ed07d3a08b3ecf4730b2e0a_JaffaCakes118

Files

cf49dcd93ed07d3a08b3ecf4730b2e0a_JaffaCakes118
.exe windows:5 windows x86 arch:x86

cf316df07c45b01aa599dc6f12c81bae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
VirtualAlloc

credui

CredUIParseUserNameW
CredUIInitControls

apphelp

GetPermLayers

gdi32

CreateFontIndirectW
GetDeviceCaps
DeleteObject
SetTextColor
GetTextExtentPoint32W
SetBkColor
CreatePatternBrush
CreateBitmap

dsprop

ADsPropGetInitInfo
ADsPropSendErrorMessage
ADsPropShowErrorDialog
ADsPropSetHwndWithTitle
ADsPropCreateNotifyObj
ADsPropSetHwnd
FindSheet

ntdll

NtQuerySystemTime
RtlSubAuthoritySid
RtlIdentifierAuthoritySid
RtlNtStatusToDosError
RtlInitUnicodeString
RtlSubAuthorityCountSid

cryptui

CryptUIDlgViewCertificateW
CryptUIDlgSelectCertificateW

shell32

SHGetFolderPathW

ole32

CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoTaskMemAlloc
StringFromIID
CoGetApartmentID
StringFromCLSID
ReleaseStgMedium
CoTaskMemFree

advapi32

GetSidSubAuthorityCount
ImpersonateLoggedOnUser
RevertToSelf
GetSecurityDescriptorLength
LsaQueryTrustedDomainInfoByName
EqualPrefixSid
GetExplicitEntriesFromAclW
CryptReleaseContext
LsaQueryInformationPolicy
QueryServiceStatus
LogonUserW
RegSetValueExW
SystemFunction040
LsaSetForestTrustInformation
GetSecurityDescriptorDacl
LsaOpenTrustedDomainByName
OpenSCManagerW
MakeSelfRelativeSD
GetSecurityDescriptorControl
EqualSid
LsaSetTrustedDomainInfoByName
CryptAcquireContextW
LsaCreateTrustedDomainEx
RegOpenKeyExW
CryptGenRandom
InitializeSecurityDescriptor
LsaDelete
BuildTrusteeWithSidW
LsaRetrievePrivateData
GetSidLengthRequired
RegQueryValueExW
IsValidSid
SetEntriesInAclW
InitializeAcl
RegCloseKey
RegCreateKeyExW
LsaQueryTrustedDomainInfo
ImpersonateAnonymousToken
LsaFreeMemory
LsaOpenTrustedDomain
LsaQueryForestTrustInformation
AllocateAndInitializeSid
GetNamedSecurityInfoW
GetLengthSid
LsaNtStatusToWinError
OpenServiceW
SetNamedSecurityInfoW
FreeSid
CloseServiceHandle
BuildTrusteeWithObjectsAndSidW
GetSidSubAuthority
LsaLookupSids
LsaOpenPolicy
LsaClose
RegDeleteKeyW
SystemFunction041
GetSidIdentifierAuthority

shlwapi

PathIsUNCServerShareW
PathAppendW

crypt32

CertEnumCertificatesInStore
CertCloseStore
CryptFindOIDInfo
CertSaveStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CertGetNameStringW
CryptDecodeObject
CryptQueryObject
CertControlStore
CertDuplicateStore
CertDeleteCertificateFromStore
CertGetEnhancedKeyUsage
CertFindCertificateInStore
CertGetCertificateContextProperty
CertOpenStore
CertDuplicateCertificateContext
CertEnumSystemStore

ntdsapi

DsBindW
DsCrackSpn3W
DsFreeNameResultW
DsUnBindW
DsCrackNamesW
DsIsMangledDnW

user32

LoadCursorW
MessageBoxW
RegisterClipboardFormatW
RegisterWindowMessageW
IsDlgButtonChecked
WinHelpW
GetDlgCtrlID
GetParent
GetWindowRect
InflateRect
ScrollWindow
FrameRect
UpdateWindow
GetSystemMetrics
GetWindowTextW
MapDialogRect
RegisterClassW
SendDlgItemMessageW
GetScrollInfo
LoadBitmapW
SetScrollInfo
BeginPaint
DialogBoxParamW
DestroyIcon
CallWindowProcW
DrawIcon
SetCursor
ReleaseDC
MessageBeep
SetFocus
CreateWindowExW
IsWindowEnabled
ShowWindow
OffsetRect
DrawFocusRect
FindWindowExW
SetForegroundWindow
IsWindow
GetSysColor
GetWindow
DefWindowProcW
LoadStringW
GetSysColorBrush
CheckDlgButton
SendMessageW
GetClientRect
GetDlgItem
DestroyWindow
ScreenToClient
SystemParametersInfoW
SetWindowTextW
SetWindowPos
GetWindowLongW
MoveWindow
CheckRadioButton
wsprintfW
EnableWindow
MapWindowPoints
SetDlgItemTextW
EndPaint
GetWindowTextLengthW
GetDesktopWindow
EndDialog
GetDC
GetDlgItemTextW
PostMessageW
LoadIconW
MessageBoxA
SetWindowContextHelpId
GetWindowThreadProcessId
SetScrollRange
SetScrollPos
SetWindowLongW

version

GetFileVersionInfoW

dnsapi

DnsNameCompareEx_W

Sections

.text
Size: 512B - Virtual size: 400B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.data
Size: 75KB - Virtual size: 848KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cf316df07c45b01aa599dc6f12c81bae

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

credui

apphelp

gdi32

dsprop

ntdll

cryptui

shell32

ole32

advapi32

shlwapi

crypt32

ntdsapi

user32

version

dnsapi

Sections

.text Size: 512B - Virtual size: 400B

.rsrc Size: 78KB - Virtual size: 78KB

.idata Size: 6KB - Virtual size: 5KB

.rdata Size: 12KB - Virtual size: 11KB

.reloc Size: 512B - Virtual size: 28B

.data Size: 75KB - Virtual size: 848KB

.text
Size: 512B - Virtual size: 400B

.rsrc
Size: 78KB - Virtual size: 78KB

.idata
Size: 6KB - Virtual size: 5KB

.rdata
Size: 12KB - Virtual size: 11KB

.reloc
Size: 512B - Virtual size: 28B

.data
Size: 75KB - Virtual size: 848KB