eb09c58b000cb411a2a43ec8ea6a39a0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

eb09c58b000cb411a2a43ec8ea6a39a0_JaffaCakes118
Size

329KB
MD5

eb09c58b000cb411a2a43ec8ea6a39a0
SHA1

c5706dce30d3484277e9d2e10a91f23ec4c623d8
SHA256

b3f9f4fad7ce60a8119d54d94042b4efa6b9dbb58ed770befb55e25e6a03a39f
SHA512

ce390d51bb71a74695cec9545dadc74e09ebb3bc647015fdf648ed211e6f81f19a717dbf07d3e3992f986b0e9e1117e5a878c5c1acf2f5c0142042bcf0592e75
SSDEEP

6144:ARDk2DfoE2nOx2ypGoASrVpK/B9K1JfilIsSmTavnBe584ycfnP0htN:A87cpGoJK5g1xsSXPn4yUnMh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb09c58b000cb411a2a43ec8ea6a39a0_JaffaCakes118

Files

eb09c58b000cb411a2a43ec8ea6a39a0_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e364657701a382b0462b8275a9f22a50

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

secur32

CredMarshalTargetInfo
LsaGetLogonSessionData
FreeContextBuffer
LsaFreeReturnBuffer
CredUnmarshalTargetInfo

cryptdll

CDBuildIntegrityVect
MD5Final
CDLocateCSystem
CDGenerateRandomBits
MD5Update
CDFindCommonCSystemWithKey
MD5Init
CDLocateCheckSum

user32

wsprintfW
CharLowerBuffW

msasn1

ASN1BEREncU32
ASN1BEREncExplicitTag
ASN1octetstring_free
ASN1_CreateModule
ASN1BERDecEndOfContents
ASN1_CloseEncoder
ASN1_FreeEncoded
ASN1BERDecSkip
ASN1intx_free
ASN1BEREncBool
ASN1BERDecBool
ASN1BEREncBitString
ASN1bitstring_free
ASN1DecSetError
ASN1BERDecNotEndOfContents
ASN1BERDecExplicitTag
ASN1BERDecS32Val
ASN1_Encode
ASN1intxisuint32
ASN1DecAlloc
ASN1BERDecGeneralizedTime
ASN1charstring_free
ASN1_Decode
ASN1_CloseDecoder
ASN1objectidentifier_free
ASN1BERDecPeekTag
ASN1BERDecOpenType2
ASN1_CreateEncoder
ASN1BERDecObjectIdentifier
ASN1BEREncS32
ASN1BEREncObjectIdentifier
ASN1BERDecSXVal
ASN1_CreateDecoder
ASN1_FreeDecoded
ASN1BERDecBitString
ASN1BERDecU32Val
ASN1intx_setuint32
ASN1BEREncCharString
ASN1intx2uint32
ASN1Free
ASN1BEREncOctetString
ASN1ztcharstring_free
ASN1intx2int32
ASN1EncSetError
ASN1BEREncSX
ASN1CEREncGeneralizedTime
ASN1BEREncOpenType
ASN1BERDecZeroCharString
ASN1BEREncEndOfContents
ASN1BERDecOctetString
ASN1BERDecCharString

kernel32

SetEvent
CloseHandle
ExpandEnvironmentStringsW
GetComputerNameExW
OpenEventW
FormatMessageW
GetModuleFileNameW
InterlockedCompareExchange
InterlockedDecrement
lstrcpyW
GetProfileStringA
TerminateProcess
InitializeCriticalSection
GetACP
CreateFileA
LocalAlloc
EnterCriticalSection
LeaveCriticalSection
WriteFile
lstrlenW
GetLastError
GetCurrentProcessId
DebugBreak
CreateFileMappingW
UnregisterWait
OutputDebugStringA
LoadLibraryA
DisableThreadLibraryCalls
GetTickCount
CreateFileW
VirtualAlloc
WideCharToMultiByte
InterlockedExchangeAdd
InterlockedExchange
lstrcmpiA
GetModuleFileNameA
InterlockedIncrement
SetUnhandledExceptionFilter
GetCurrentProcess
GetCurrentThreadId
FreeLibrary
GetModuleHandleW
OpenFileMappingW
MultiByteToWideChar
UnhandledExceptionFilter
CreateEventW
GetLocalTime
LocalFree
GetSystemInfo
Sleep
GetProcAddress
UnmapViewOfFile
FileTimeToSystemTime
MapViewOfFileEx
RaiseException
GetEnvironmentVariableW
lstrlenA
DeleteCriticalSection
LoadLibraryW
GetComputerNameW
lstrcmpW
RegisterWaitForSingleObjectEx
GetSystemTimeAsFileTime
GetCurrentThread
QueryPerformanceCounter

msvcrt

wcsrchr
_stricmp
_wcsnicmp
wcsspn
sscanf
wcslen
malloc
qsort
_initterm
_strnicmp
wcscpy
wcscmp
wcstoul
strrchr
sprintf
free
strchr
swprintf
_ultoa
_strcmpi
wcscat
_wcsicmp
_except_handler3
_adjust_fdiv
_vsnprintf

ntdll

RtlEqualSid
NtOpenThreadToken
RtlCompareUnicodeString
RtlTimeFieldsToTime
RtlTimeToTimeFields
RtlCreateSecurityDescriptor
NtAllocateLocallyUniqueId
RtlRunDecodeUnicodeString
RtlGetElementGenericTable
RtlInitializeSid
RtlInsertElementGenericTableAvl
RtlCreateTimer
RtlInsertElementGenericTable
RtlLeaveCriticalSection
RtlSubAuthorityCountSid
RtlCopySid
RtlConvertSharedToExclusive
NtQuerySystemTime
RtlDeregisterWait
NtQueryInformationToken
RtlEnterCriticalSection
RtlCopyLuid
RtlDeleteElementGenericTable
NtQuerySystemInformation
RtlCompareMemory
NtDuplicateObject
DbgPrint
RtlEqualDomainName
RtlSetDaclSecurityDescriptor
RtlFreeAnsiString
RtlIntegerToUnicodeString
RtlDeleteTimerQueue
RtlAllocateAndInitializeSid
RtlFreeSid
RtlAppendUnicodeStringToString
RtlDeleteResource
RtlLookupElementGenericTableAvl
RtlCopyUnicodeString
RtlReleaseResource
RtlDowncaseUnicodeString
NtClose
RtlAnsiStringToUnicodeString
RtlSystemTimeToLocalTime
RtlAcquireResourceExclusive
RtlInitializeResource
RtlInitAnsiString
RtlEqualUnicodeString
RtlSubAuthoritySid
RtlInitializeGenericTable
RtlCreateAcl
RtlLengthSid
NtOpenProcessToken
RtlAddAccessAllowedAce
RtlUnicodeStringToAnsiString
NtWaitForSingleObject
RtlOemStringToUnicodeString
VerSetConditionMask
RtlValidSid
NtOpenEvent
RtlVerifyVersionInfo
RtlEraseUnicodeString
RtlInitUnicodeString
RtlInitializeGenericTableAvl
RtlDeleteCriticalSection
RtlFreeUnicodeString
RtlUniform
RtlLookupElementGenericTable
RtlConvertSidToUnicodeString
RtlAcquireResourceShared
RtlCreateTimerQueue
RtlUpcaseUnicodeString
NtAllocateVirtualMemory
NtCreateEvent
RtlLengthRequiredSid
RtlPrefixUnicodeString
RtlRegisterWait
RtlInitializeCriticalSection
NtSetSecurityObject

advapi32

RegisterEventSourceW
CredUnmarshalCredentialW
SystemFunction006
QueryServiceStatus
RegOpenKeyW
LookupAccountSidW
CryptCreateHash
CryptSetProvParam
RegCreateKeyExW
RegQueryValueExW
RegDeleteValueW
GetTraceLoggerHandle
TraceEvent
RevertToSelf
SetThreadToken
RegOpenKeyExW
CryptGetHashParam
OpenProcessToken
RegSetValueExW
CryptReleaseContext
QueryServiceConfigW
RegEnumKeyExW
CloseServiceHandle
RegCloseKey
SystemFunction007
CryptAcquireContextW
RegQueryInfoKeyW
GetTokenInformation
CryptGetProvParam
ReportEventW
CredFree
DeregisterEventSource
FreeSid
OpenThreadToken
AllocateAndInitializeSid
CryptHashData
RegNotifyChangeKeyValue
RegConnectRegistryW
OpenServiceW
CryptDestroyHash
OpenSCManagerW
RegisterTraceGuidsW

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e364657701a382b0462b8275a9f22a50

Headers

DLL Characteristics

File Characteristics

Imports

secur32

cryptdll

user32

msasn1

kernel32

msvcrt

ntdll

advapi32

Sections

.text Size: 18KB - Virtual size: 17KB

.data Size: 9KB - Virtual size: 1.4MB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 36KB - Virtual size: 36KB

.rdata Size: 264KB - Virtual size: 263KB

.text
Size: 18KB - Virtual size: 17KB

.data
Size: 9KB - Virtual size: 1.4MB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 36KB - Virtual size: 36KB

.rdata
Size: 264KB - Virtual size: 263KB