e128d5015a6ea344136c999e7b8c0f26_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

e128d5015a6ea344136c999e7b8c0f26_JaffaCakes118
Size

444KB
MD5

e128d5015a6ea344136c999e7b8c0f26
SHA1

b070b3f11cf2f24059b48ca0ea9464711225efd1
SHA256

a374f3a5b79172be564d4683fa7f04d8ecaa9873081614f4a3859ae57aec9fbe
SHA512

c54568787db893297c7ec4e5fcad89eb4852d97faf144618f8dfc63cfa683bd480f48941f68817fc7452b38411e750a0d77667b70512e834908ded0f7a435301
SSDEEP

6144:CgkA10DBZne161cgusQzKJLmdC/5NkBdpQ+6D02dAIa6+MOG/NCMMuubIlYKp/et:Ub9Ze16qblKJAK2BTk0P6aG/QDBaYKQt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e128d5015a6ea344136c999e7b8c0f26_JaffaCakes118

Files

e128d5015a6ea344136c999e7b8c0f26_JaffaCakes118
.exe windows:5 windows x86 arch:x86

94eb55b5b89c67415157f56ba7ae1b9f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

secur32

ApplyControlToken
LsaCallAuthenticationPackage
LsaFreeReturnBuffer
LsaConnectUntrusted
LsaLookupAuthenticationPackage

msvcrt

wcschr
_except_handler3
wcslen
wcscat
iswctype
memmove
wcscpy
_ltow
wcscmp
time
free
_initterm
malloc
_adjust_fdiv
_ultoa
_ltoa

msasn1

ASN1CEREncNewBlkElement
ASN1_FreeDecoded
ASN1CEREncBeginBlk
ASN1CEREncFlushBlkElement
ASN1CEREncEndBlk
ASN1_FreeEncoded
ASN1_SetEncoderOption
ASN1_Decode
ASN1_Encode
ASN1octetstring_free
ASN1BERDecOctetString
ASN1intx_free
ASN1BERDecS32Val
ASN1BERDecSXVal
ASN1BEREncS32
ASN1BEREncSX
ASN1BERDecObjectIdentifier2
ASN1BEREncObjectIdentifier2
ASN1open_free
ASN1Free
ASN1BERDecExplicitTag
ASN1BERDecNotEndOfContents
ASN1BERDecPeekTag
ASN1DecRealloc
ASN1BERDecOpenType
ASN1BERDecEndOfContents
ASN1BEREncExplicitTag
ASN1BEREncOpenType
ASN1BEREncEndOfContents
ASN1BERDecBitString2
ASN1_CloseModule
ASN1_CreateModule
ASN1BEREncOctetString
ASN1BEREncBitString

crypt32

CryptSignAndEncodeCertificate
CertFindChainInStore
CryptEncodeObject
CryptDecodeObject
I_CryptUninstallAsn1Module
I_CryptInstallAsn1Module
CryptInstallOIDFunctionAddress
I_CryptGetAsn1Decoder
I_CryptGetAsn1Encoder
CertDuplicateCertificateContext
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertVerifyCertificateChainPolicy
CertOpenSystemStoreA
CertAddStoreToCollection
CertEnumCTLsInStore
CertAddEncodedCertificateToStore
CertGetCertificateContextProperty
CertSerializeCertificateStoreElement
CertSaveStore
CertFreeCertificateChain
CertCompareCertificateName
CertGetCertificateChain
CryptDecodeObjectEx
CertGetNameStringW
CertFindCertificateInStore
CertOpenStore
CertAddSerializedElementToStore
CertCloseStore
CertNameToStrW
CertCreateCertificateContext
CertNameToStrA
CertFreeCertificateContext
CertDuplicateStore
CertControlStore

advapi32

AllocateLocallyUniqueId
CryptAcquireContextA
CryptAcquireContextW
CryptReleaseContext
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CryptDestroyHash
CryptSetHashParam
CryptCreateHash
RevertToSelf
CredFree
CredUnmarshalCredentialW
CredIsMarshaledCredentialW
CryptSignHashW
CryptHashData
RegSetValueExW
RegQueryValueExW
RegCreateKeyExA
RegCreateKeyExW
RegOpenKeyExW
RegNotifyChangeKeyValue
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegFlushKey
CryptGenRandom
CryptExportKey
CryptDestroyKey
CryptImportKey
MD5Final
MD5Update
MD5Init
CryptGenKey
CryptGetKeyParam
CryptDuplicateKey
A_SHAFinal
A_SHAUpdate
A_SHAInit
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenThreadToken
CryptGetProvParam
CryptDecrypt
CryptDeriveKey
CryptDuplicateHash
CryptEncrypt
CryptGetUserKey
CryptHashSessionKey
CryptSetKeyParam
CryptSignHashA
CryptVerifySignatureA
CryptGetHashParam

kernel32

LocalReAlloc
InitializeCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
EnterCriticalSection
DeleteCriticalSection
lstrcmpiA
lstrlenA
CreateEventA
RegisterWaitForSingleObject
UnregisterWaitEx
SetEvent
ResetEvent
GetTickCount
FormatMessageW
CreateEventW
OpenProcess
GetCurrentProcess
VirtualAlloc
InterlockedDecrement
lstrcpyW
DisableThreadLibraryCalls
FreeLibrary
LoadLibraryW
GetProcAddress
GetSystemDefaultLCID
GetLocaleInfoA
InterlockedIncrement
SetLastError
GetCurrentThread
GetComputerNameW
GetComputerNameExW
GetSystemWow64DirectoryA
lstrlenW
lstrcmpW
CloseHandle
GetLastError
LocalFree
GetCurrentProcessId
GetCurrentThreadId
WaitForSingleObjectEx
QueryPerformanceCounter
TerminateProcess
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
InterlockedExchange
LoadLibraryA
LocalAlloc

userenv

RegisterGPNotification
UnregisterGPNotification

Sections

.text
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 212KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.uuup
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.kuup
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ouup
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.duup
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.auuu
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qiii
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gooo
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.faaa
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.raaa
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rerq
Size: 206KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.huuu
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

94eb55b5b89c67415157f56ba7ae1b9f

Headers

File Characteristics

Imports

secur32

msvcrt

msasn1

crypt32

advapi32

kernel32

userenv

Sections

.text Size: 7KB - Virtual size: 8KB

.rdata Size: 212KB - Virtual size: 216KB

.data Size: 1KB - Virtual size: 4KB

.uuup Size: 512B - Virtual size: 4KB

.kuup Size: 512B - Virtual size: 4KB

.ouup Size: 512B - Virtual size: 4KB

.duup Size: 512B - Virtual size: 4KB

.auuu Size: 512B - Virtual size: 4KB

.qiii Size: 512B - Virtual size: 4KB

.gooo Size: 512B - Virtual size: 4KB

.faaa Size: 512B - Virtual size: 4KB

.raaa Size: 512B - Virtual size: 4KB

.rerq Size: 206KB - Virtual size: 208KB

.huuu Size: 512B - Virtual size: 4KB

.rsrc Size: 11KB - Virtual size: 12KB

.text
Size: 7KB - Virtual size: 8KB

.rdata
Size: 212KB - Virtual size: 216KB

.data
Size: 1KB - Virtual size: 4KB

.uuup
Size: 512B - Virtual size: 4KB

.kuup
Size: 512B - Virtual size: 4KB

.ouup
Size: 512B - Virtual size: 4KB

.duup
Size: 512B - Virtual size: 4KB

.auuu
Size: 512B - Virtual size: 4KB

.qiii
Size: 512B - Virtual size: 4KB

.gooo
Size: 512B - Virtual size: 4KB

.faaa
Size: 512B - Virtual size: 4KB

.raaa
Size: 512B - Virtual size: 4KB

.rerq
Size: 206KB - Virtual size: 208KB

.huuu
Size: 512B - Virtual size: 4KB

.rsrc
Size: 11KB - Virtual size: 12KB