dbcf9b9b5ed7714d1e401d55dd8a275c_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

dbcf9b9b5ed7714d1e401d55dd8a275c_JaffaCakes118
Size

863KB
MD5

dbcf9b9b5ed7714d1e401d55dd8a275c
SHA1

9d4ec1e5d2e3701df2b9ae57b8ebc5b94da22efd
SHA256

90848e39f8934de3667017477e2141dd0d7100004d88a48fee42c334f699a820
SHA512

dad24e1ad4bc27e36f6113cdb8bb63154b38b8c9b8be071edd787d95ce74ba7f414753f0af2490f510656f86522f4ad80faf658161d9f3d693a00d27e670da7b
SSDEEP

12288:YsECnm4mQqLTBz7uflFnjBJ6y+OzB3kjSqc3AMI5LA2+9EvzGWaIfGl7P9FV/+uz:zmQ+YlbJ6BO6Lc3AY9KGXzl7P9j/+u4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dbcf9b9b5ed7714d1e401d55dd8a275c_JaffaCakes118

Files

dbcf9b9b5ed7714d1e401d55dd8a275c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

ec8c4142a57bd32693a71717184788d6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeviceIoControl
SetLocalPrimaryComputerNameW
GetMailslotInfo
GetHandleInformation
FreeConsole
LoadLibraryA
GetCurrentProcessId
GetConsoleCursorInfo
GetThreadContext
GetBinaryType
GetCurrencyFormatW
CreateSocketHandle
lstrcpyW
SetMessageWaitingIndicator
WriteFile
CreateActCtxA
FindVolumeClose
SetTapePosition
SetConsoleInputExeNameA
GetFileAttributesExW
LockResource
DeleteTimerQueue
SetErrorMode
LocalFlags
ExitVDM
SetConsoleOS2OemFormat
ReadConsoleA
GlobalLock
DeleteFileW
VirtualAlloc
TerminateJobObject
SetSystemTimeAdjustment
SetLocaleInfoW
OpenEventA
CreateIoCompletionPort
RemoveLocalAlternateComputerNameW
GetGeoInfoW
CreateEventA
WriteProfileStringW
SetEnvironmentVariableA
EnumSystemLanguageGroupsW
lstrcmpiA
GetNumberOfConsoleInputEvents
HeapAlloc
EnumUILanguagesA
MoveFileExW
DebugSetProcessKillOnExit
GetProcessId
SystemTimeToFileTime
lstrlen
GetNumberFormatW
WriteConsoleA
PurgeComm
GetModuleHandleA
ReadConsoleOutputCharacterW
VirtualFreeEx
DeleteVolumeMountPointW
GetEnvironmentStrings
GetCommandLineW
CommConfigDialogW
EnumTimeFormatsW
GlobalHandle
GlobalAddAtomW
MapViewOfFileEx
GetFileType
DeleteFileA
GetTimeFormatA
Module32FirstW
CmdBatNotification
GetSystemWow64DirectoryA

user32

SendDlgItemMessageW
EqualRect
MenuWindowProcA
GetWindowRgn
MessageBoxExA
SetRectEmpty
CreateWindowExW
CopyAcceleratorTableW
LoadBitmapA
GetClientRect
ToUnicode
CharToOemBuffA
DdeGetQualityOfService
EnumChildWindows
OemToCharBuffA
DdeQueryNextServer
ArrangeIconicWindows
OpenWindowStationW
DdeInitializeA
SetScrollRange
TranslateAccelerator
DdeCmpStringHandles
IsDlgButtonChecked
GetClassNameW
GetUpdateRect

ntdll

RtlNumberOfClearBits
ZwImpersonateClientOfPort
RtlCreateAtomTable
NtCreatePort
RtlDeleteElementGenericTable
ZwCloseObjectAuditAlarm
RtlDeregisterWait
NtAllocateUserPhysicalPages
ZwUnloadKey
ZwLoadKey
ZwSetQuotaInformationFile
RtlFreeSid
NtSaveKey
memchr
RtlIsGenericTableEmptyAvl
_wtoi64
NtPrivilegeObjectAuditAlarm
NtQueryInformationToken
ZwLockProductActivationKeys
RtlDeactivateActivationContext
ZwSetEventBoostPriority
ZwQuerySystemTime
LdrShutdownProcess
ZwSetThreadExecutionState
RtlCreateTimer
RtlEraseUnicodeString
NtQueryValueKey
sqrt
ZwUnloadDriver
ZwTerminateProcess

wldap32

ldap_sasl_bindW
ldap_first_attributeA
ldap_controls_freeW
ldap_extended_operation
ldap_rename_ext
ldap_abandon
ldap_search_st
ldap_parse_extended_resultA
ldap_next_entry
ldap_rename_extW
ldap_parse_referenceW
ldap_addA
ldap_dn2ufnW
ldap_first_attributeW
ldap_modify_extW
ldap_next_attributeW
ldap_rename_ext_s
ldap_search_ext_sA
ldap_count_references
ldap_value_freeA
ldap_free_controls
ldap_modrdnW
ldap_extended_operation_sA
ldap_err2string
ldap_modifyA
ldap_create_vlv_controlA
ldap_search_init_page
ldap_ufn2dn
ldap_parse_vlv_controlA
ldap_create_page_controlW
ldap_count_values_len
ldap_modify_s
ldap_set_optionA
ldap_next_reference
ldap_conn_from_msg
ldap_search_stW
ldap_first_entry
ldap_modrdn2

dsauth

StoreCreateObjectVA
StoreDeleteObject
StoreSetSearchSubTree
StoreSetSearchOneLevel
StoreInitHandle
DhcpDsGetLists
DhcpDsEnumServers
StoreCleanupHandle
DhcpDsDelServer
StoreGetHandle
DhcpDsGetAttribs
DhcpDeleteServerDS
DhcpAddServerDS
DhcpDsCleanupDS
StoreBeginSearch
DhcpDsGetRoot
StoreSearchGetNext
StoreEndSearch
DhcpDsValidateService
StoreCollectAttributes
DhcpEnumServersDS
DhcpDsAddServer
DhcpDsSetLists
DhcpDsInitDS

mfcsubs

??9@YG_NABVCString@@0@Z
?GetHashTableSize@CMapStringToPtr@@QBEIXZ
?GetAssocAt@CMapStringToPtr@@IBEPAUCAssoc@1@PBGAAI@Z
?Lock@CSyncObject@@UAEHK@Z
?AfxA2WHelper@@YGPAGPAGPBDH@Z
?Mid@CString@@QBE?AV1@HH@Z
??H@YG?AVCString@@ABV0@PBG@Z
??O@YG_NPBGABVCString@@@Z
??1CString@@QAE@XZ
??_7CCriticalSection@@6B@
??BCString@@QBEPBGXZ
??4CString@@QAEABV0@D@Z
??M@YG_NPBGABVCString@@@Z
?FormatMessageW@CString@@QAAXIZZ
??1CSyncObject@@UAE@XZ
??0CString@@QAE@PBE@Z
?GetData@CString@@IBEPAUCStringData@@XZ
??0CCriticalSection@@QAE@XZ
??M@YG_NABVCString@@PBG@Z
??0CString@@QAE@XZ
?RemoveAll@CMapStringToPtr@@QAEXXZ
?ReleaseBuffer@CString@@QAEXH@Z
??1CStringArray@@UAE@XZ
??0CSyncObject@@QAE@PBG@Z
?GetLength@CString@@QBEHXZ
?HashKey@CMapStringToPtr@@QBEIPBG@Z
?ReverseFind@CString@@QBEHG@Z
?FreeDataChain@CPlex@@QAEXXZ

Sections

.text
Size: 514KB - Virtual size: 514KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 339KB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec8c4142a57bd32693a71717184788d6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ntdll

wldap32

dsauth

mfcsubs

Sections

.text Size: 514KB - Virtual size: 514KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 339KB - Virtual size: 1.8MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 514KB - Virtual size: 514KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 339KB - Virtual size: 1.8MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB