d5617c16e28b3e5ad875f35528a06938_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d5617c16e28b3e5ad875f35528a06938_JaffaCakes118
Size

112KB
MD5

d5617c16e28b3e5ad875f35528a06938
SHA1

288efbc5abaa0593e7d2eb95012e5ee0a7c294c1
SHA256

ccaff4029267d156aeedcaae824543b91df460fa53e04f9885544ae4a5358a3f
SHA512

d995b005ee1c6ba534e52a6b30398440503a63212c96c89c11a533269a77b155b1df5d2d46bc5e86c928c26eea32f86e35b8b35a2a74986e46488d9d9165fe6d
SSDEEP

3072:DnZDfzgKk4K+MtWu/4X0al1uWWG8ipU9:DnZDRMyX0YDWWp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d5617c16e28b3e5ad875f35528a06938_JaffaCakes118

Files

d5617c16e28b3e5ad875f35528a06938_JaffaCakes118
.dll windows:5 windows x86 arch:x86

07f4c330716b1de5f312c0a51b83d620

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

clusapi.pdb

Imports

msvcrt

iswalpha
_iob
fprintf
printf
wcslen
wcscat
_except_handler3
wcsrchr

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
CreateThread
WaitForSingleObject
InterlockedCompareExchange
CloseHandle
Sleep
lstrcpynW
GetLastError
lstrcpyW
lstrcatW
FindFirstFileW
FindClose
GetFileAttributesExW
FindNextFileW
SetFileAttributesW
CopyFileW
lstrcmpiW
lstrlenW
InitializeCriticalSection
DeleteCriticalSection
SetLastError
EnterCriticalSection
LocalFree
LeaveCriticalSection
LocalAlloc
GetSystemTimeAsFileTime
GetLocaleInfoW
IsDebuggerPresent
OutputDebugStringA
FormatMessageA
FormatMessageW
SetEndOfFile
WriteFile
ReadFile
SetFilePointer
ReleaseMutex
GetFileSize
GetSystemTime
ExpandEnvironmentStringsW
CreateEventW
SetEvent
ResetEvent
WaitForMultipleObjects

advapi32

MakeSelfRelativeSD
TraceMessage
RegUnLoadKeyW
CloseServiceHandle
QueryServiceStatus
OpenServiceW
OpenSCManagerW
RegCloseKey
RegDeleteValueW
StartServiceA
RegSetValueExW
RegOpenKeyW
ControlService
OpenServiceA
OpenSCManagerA
RegConnectRegistryW
RegOpenKeyExW
RegQueryValueExW

rpcrt4

RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
RpcEpResolveBinding
RpcBindingSetAuthInfoW
RpcBindingFree
RpcSmDestroyClientContext
NdrClientCall2

ntdll

RtlNtStatusToDosError
RtlMakeSelfRelativeSD
RtlAllocateHeap
RtlLengthSecurityDescriptor
RtlValidSecurityDescriptor
RtlFreeSid
NtClose
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
NtQueryInformationToken
NtOpenProcessToken
RtlAllocateAndInitializeSid
NtSetInformationThread
NtDuplicateToken
RtlAdjustPrivilege
RtlUnicodeStringToAnsiString
RtlAnsiStringToUnicodeString
RtlInitAnsiString

ole32

CoUninitialize
CoInitializeEx
CoCreateInstanceEx

oleaut32

VariantInit

Exports

Exports

AddClusterResourceDependency
AddClusterResourceNode
BackupClusterDatabase
CanResourceBeDependent
ChangeClusterResourceGroup
CloseCluster
CloseClusterGroup
CloseClusterNetInterface
CloseClusterNetwork
CloseClusterNode
CloseClusterNotifyPort
CloseClusterResource
ClusterCloseEnum
ClusterControl
ClusterEnum
ClusterGetEnumCount
ClusterGroupCloseEnum
ClusterGroupControl
ClusterGroupEnum
ClusterGroupGetEnumCount
ClusterGroupOpenEnum
ClusterNetInterfaceControl
ClusterNetworkCloseEnum
ClusterNetworkControl
ClusterNetworkEnum
ClusterNetworkGetEnumCount
ClusterNetworkOpenEnum
ClusterNodeCloseEnum
ClusterNodeControl
ClusterNodeEnum
ClusterNodeGetEnumCount
ClusterNodeOpenEnum
ClusterOpenEnum
ClusterRegCloseKey
ClusterRegCreateKey
ClusterRegDeleteKey
ClusterRegDeleteValue
ClusterRegEnumKey
ClusterRegEnumValue
ClusterRegGetKeySecurity
ClusterRegOpenKey
ClusterRegQueryInfoKey
ClusterRegQueryValue
ClusterRegSetKeySecurity
ClusterRegSetValue
ClusterResourceCloseEnum
ClusterResourceControl
ClusterResourceEnum
ClusterResourceGetEnumCount
ClusterResourceOpenEnum
ClusterResourceTypeCloseEnum
ClusterResourceTypeControl
ClusterResourceTypeEnum
ClusterResourceTypeGetEnumCount
ClusterResourceTypeOpenEnum
CreateClusterGroup
CreateClusterNotifyPort
CreateClusterResource
CreateClusterResourceType
DeleteClusterGroup
DeleteClusterResource
DeleteClusterResourceType
EvictClusterNode
EvictClusterNodeEx
FailClusterResource
GetClusterFromGroup
GetClusterFromNetInterface
GetClusterFromNetwork
GetClusterFromNode
GetClusterFromResource
GetClusterGroupKey
GetClusterGroupState
GetClusterInformation
GetClusterKey
GetClusterNetInterface
GetClusterNetInterfaceKey
GetClusterNetInterfaceState
GetClusterNetworkId
GetClusterNetworkKey
GetClusterNetworkState
GetClusterNodeId
GetClusterNodeKey
GetClusterNodeState
GetClusterNotify
GetClusterQuorumResource
GetClusterResourceKey
GetClusterResourceNetworkName
GetClusterResourceState
GetClusterResourceTypeKey
GetNodeClusterState
MoveClusterGroup
OfflineClusterGroup
OfflineClusterResource
OnlineClusterGroup
OnlineClusterResource
OpenCluster
OpenClusterGroup
OpenClusterNetInterface
OpenClusterNetwork
OpenClusterNode
OpenClusterResource
PauseClusterNode
RegisterClusterNotify
RemoveClusterResourceDependency
RemoveClusterResourceNode
RestoreClusterDatabase
ResumeClusterNode
SetClusterGroupName
SetClusterGroupNodeList
SetClusterName
SetClusterNetworkName
SetClusterNetworkPriorityOrder
SetClusterQuorumResource
SetClusterResourceName
SetClusterServiceAccountPassword

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

07f4c330716b1de5f312c0a51b83d620

Headers

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

advapi32

rpcrt4

ntdll

ole32

oleaut32

Exports

Exports

Sections

.text Size: 52KB - Virtual size: 51KB

.data Size: 56KB - Virtual size: 56KB

.rsrc Size: 1024B - Virtual size: 992B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 52KB - Virtual size: 51KB

.data
Size: 56KB - Virtual size: 56KB

.rsrc
Size: 1024B - Virtual size: 992B

.reloc
Size: 2KB - Virtual size: 1KB