df6b1a8ae8a9aa92f4f22a16c5981f69_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

df6b1a8ae8a9aa92f4f22a16c5981f69_JaffaCakes118
Size

273KB
MD5

df6b1a8ae8a9aa92f4f22a16c5981f69
SHA1

fa7539bd51c5ea35bc943f0904975ec3123d0104
SHA256

21bffc1c20c30fde8c03dc2cd75386a9f9adc100c3420c4eaa70bc91b99d3004
SHA512

3b60150454e5a8b3ad354e8283408f12cc1d7d76fc17338e543929a84b3d6bfeb710c93e94624f81a27accc6f40653aa03fd021936affd1e049242dcd71b7262
SSDEEP

3072:I1Tzpc89ZQR/B4x59w+EtHN8KZ2GM3gGAsrCtc5tkzPjmo19GgMkAyEz3/2MyqXz:A9YRB4RwTtHysGAQzmdsvfI8iU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df6b1a8ae8a9aa92f4f22a16c5981f69_JaffaCakes118

Files

df6b1a8ae8a9aa92f4f22a16c5981f69_JaffaCakes118
.exe windows:5 windows x86 arch:x86

901bafda5ca231e2d4d1a944cf675e08

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

msvfw32.pdb

Imports

msvcrt

_adjust_fdiv
malloc
_initterm
free
wcsrchr
_wcsicmp
wcscpy
wcscat
wcslen
_except_handler3

wintrust

CryptCATAdminCalcHashFromFileHandle

rpcrt4

RpcRevertToSelfEx
I_RpcBindingIsClientLocal
RpcServerUnregisterIf
RpcServerRegisterAuthInfoW
RpcServerInqDefaultPrincNameW
RpcStringFreeW
RpcServerRegisterIfEx
RpcServerUseProtseqEpW
RpcImpersonateClient
RpcRevertToSelf
NdrServerCall2

user32

wsprintfW
wsprintfA

kernel32

FindNextFileW
GetACP
WideCharToMultiByte
GetSystemDirectoryW
GetSystemDirectoryA
MultiByteToWideChar
lstrlenW
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
LeaveCriticalSection
SetLastError
GetCurrentThread
DeleteCriticalSection
InitializeCriticalSection
LoadLibraryW
GetProcAddress
FreeLibrary
CreateEventA
RegisterWaitForSingleObject
UnregisterWaitEx
CloseHandle
LocalReAlloc
LocalSize
GetModuleHandleA
LocalFree
DeleteFileW
SetEvent
GetLastError
DisableThreadLibraryCalls
FindFirstFileW
GetFileAttributesW
CreateFileW
MoveFileW
GetTempFileNameW
DelayLoadFailureHook
CreateFileA
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
UnregisterWait
InterlockedExchange
DuplicateHandle
ReadFile
SystemTimeToFileTime
GetLocalTime
GetTimeFormatA
GetDateFormatA
OutputDebugStringA
SetFilePointer
SetEndOfFile
WriteFile
GetFileSize
CreateFileMappingA
MapViewOfFile
GetVersionExA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
LoadLibraryA
CopyFileW
SetFileAttributesW
UnmapViewOfFile
CreateEventW
DeleteFileA
InterlockedCompareExchange
GetTickCount
OpenProcess
LocalAlloc
GetCurrentProcess

advapi32

RegCloseKey
RegEnumValueW
RegEnumValueA
RegCreateKeyExA
CryptAcquireContextA
RegQueryValueExW
RegQueryInfoKeyW
RegEnumKeyW
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyW
CryptSetProviderExW
CryptGetDefaultProviderW
CryptGetProvParam
CryptEnumProviderTypesW
CryptEnumProvidersW
LsaOpenPolicy
LsaRetrievePrivateData
LogonUserW
LsaFreeMemory
LsaClose
ImpersonateLoggedOnUser
RegOpenKeyExW
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
GetLengthSid
CopySid
CryptReleaseContext
RevertToSelf
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
OpenThreadToken
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegisterServiceCtrlHandlerW
SetServiceStatus
RegisterEventSourceW
ReportEventW
DeregisterEventSource

certcli

CACertTypeAccessCheck
CAGetCertTypeProperty
CACountCertTypes
CAFreeCertTypeProperty
CAEnumNextCertType
CAEnumCertTypes
CACloseCA
CAEnumNextCA
CAFreeCAProperty
CAAccessCheck
CAGetCAProperty
CACountCAs
CAEnumFirstCA
CACloseCertType

crypt32

CertFreeCTLContext
CertFreeCertificateContext
CertAddCertificateContextToStore
CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
PFXExportCertStore
PFXImportCertStore
CertCreateContext
CertCloseStore
CryptDecodeObject

esent

JetTerm
JetUpdate
JetSetColumn
JetPrepareUpdate
JetDelete
JetMove
JetMakeKey
JetRetrieveColumn
JetSetSystemParameter
JetCloseTable
JetGetColumnInfo
JetOpenTable
JetRollback
JetCommitTransaction
JetCreateIndex
JetAddColumn
JetCreateTable
JetBeginTransaction
JetOpenDatabase
JetCloseDatabase
JetCreateDatabase
JetSetCurrentIndex
JetAttachDatabase
JetBeginSession
JetInit
JetDetachDatabase
JetEndSession
JetSeek

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 205KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

901bafda5ca231e2d4d1a944cf675e08

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

wintrust

rpcrt4

user32

kernel32

advapi32

certcli

crypt32

esent

Sections

.text Size: 53KB - Virtual size: 53KB

.data Size: 205KB - Virtual size: 320KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 53KB - Virtual size: 53KB

.data
Size: 205KB - Virtual size: 320KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 9KB - Virtual size: 9KB