eb52081f70a03566618622b9fe44c29b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
eb52081f70a03566618622b9fe44c29b_JaffaCakes118
Size 329KB
Sample240919-phpr9sxgnc
SHA256 d4a39b887388bfcb7922418e0168c2ec7c5798374a9d96aeb53fd820ad6a9c29
MD5 eb52081f70a03566618622b9fe44c29b
SHA1 eec6a9435cb03cee0aeea83ced0cf6ac3f7209e8
SHA512 dd6a64a4f67aa7f97b1613f744d1a636a8f52fbb0fd1ebba36391a0c8e52476039370aed4517f2a53fd65284397029672bab00fd69c71af6b0dcf2250881cacc
SSDEEP 6144:SP/f+o8scFq+a7IeJtccdL2tGv9jJyCkjJ/q29QpxZQ03BzpnZGlSTawF:M8++a8eJtccdLrvLkjosQpxZQaBzxYlV
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb52081f70a03566618622b9fe44c29b_JaffaCakes118

File Explorer

eb52081f70a03566618622b9fe44c29b_JaffaCakes118

.exe 329KB

eb52081f70a03566618622b9fe44c29b_JaffaCakes118

IMPHASH a5ae5da02bdc14f7381179b2b7c888fb
SHA256 d4a39b887388bfcb7922418e0168c2ec7c5798374a9d96aeb53fd820ad6a9c29
MD5 eb52081f70a03566618622b9fe44c29b
SHA1 eec6a9435cb03cee0aeea83ced0cf6ac3f7209e8
SHA512 dd6a64a4f67aa7f97b1613f744d1a636a8f52fbb0fd1ebba36391a0c8e52476039370aed4517f2a53fd65284397029672bab00fd69c71af6b0dcf2250881cacc
SSDEEP 6144:SP/f+o8scFq+a7IeJtccdL2tGv9jJyCkjJ/q29QpxZQ03BzpnZGlSTawF:M8++a8eJtccdLrvLkjosQpxZQaBzxYlV
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4318

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

OpenSCManagerW ReportEventW RegNotifyChangeKeyValue DeregisterEventSource CloseServiceHandle RegisterTraceGuidsW RegQueryValueExW CryptGetHashParam RegSetValueExW CryptHashData SetThreadToken CryptReleaseContext CryptGetProvParam LookupAccountSidW RegQueryInfoKeyW RegCreateKeyExW OpenProcessToken RegOpenKeyExW OpenThreadToken SystemFunction007 RevertToSelf QueryServiceStatus CredUnmarshalCredentialW RegisterEventSourceW QueryServiceConfigW AllocateAndInitializeSid TraceEvent RegDeleteValueW GetTraceLoggerHandle FreeSid OpenServiceW RegEnumKeyExW CryptDestroyHash RegCloseKey CryptCreateHash GetTokenInformation SystemFunction006 RegOpenKeyW RegConnectRegistryW CryptAcquireContextW CryptSetProvParam CredFree

msvcrt

wcscpy wcsspn _strcmpi sscanf _wcsnicmp sprintf _vsnprintf free wcscmp wcsrchr _stricmp malloc qsort wcslen _ultoa wcstoul _strnicmp strchr _adjust_fdiv _initterm _except_handler3 strrchr _wcsicmp swprintf wcscat

ntdll

NtOpenThreadToken RtlSystemTimeToLocalTime RtlLengthSid RtlInitializeGenericTable NtSetSecurityObject RtlCopyUnicodeString RtlLookupElementGenericTable RtlNtStatusToDosError NtQuerySystemInformation RtlConvertSidToUnicodeString RtlInitializeCriticalSection RtlEqualDomainName RtlInitAnsiString RtlFreeAnsiString RtlDeleteCriticalSection RtlDeleteResource NtDuplicateObject RtlSubAuthorityCountSid RtlTimeFieldsToTime RtlGetElementGenericTable NtQueryInformationToken RtlEraseUnicodeString RtlEqualSid RtlDeleteTimerQueue RtlAnsiStringToUnicodeString NtAllocateLocallyUniqueId RtlOemStringToUnicodeString RtlCreateTimer RtlAllocateAndInitializeSid RtlIntegerToUnicodeString RtlValidSid RtlAcquireResourceShared RtlTimeToTimeFields RtlFreeSid RtlInsertElementGenericTable RtlDeleteElementGenericTable NtQuerySystemTime NtOpenEvent RtlRegisterWait NtClose RtlDeregisterWait RtlEnterCriticalSection RtlSetDaclSecurityDescriptor RtlCreateAcl NtCreateEvent RtlInitializeSid RtlLengthRequiredSid RtlConvertSharedToExclusive RtlUpcaseUnicodeString RtlCreateTimerQueue RtlDowncaseUnicodeString RtlFreeUnicodeString RtlAddAccessAllowedAce RtlLeaveCriticalSection VerSetConditionMask NtWaitForSingleObject RtlCompareMemory NtAllocateVirtualMemory RtlCompareUnicodeString RtlRunDecodeUnicodeString NtOpenProcessToken RtlUnicodeStringToAnsiString RtlLookupElementGenericTableAvl RtlUniform RtlInitializeResource RtlAcquireResourceExclusive RtlPrefixUnicodeString RtlInsertElementGenericTableAvl RtlEqualUnicodeString RtlReleaseResource RtlInitUnicodeString RtlVerifyVersionInfo RtlAppendUnicodeStringToString RtlCreateSecurityDescriptor RtlCopySid DbgPrint RtlInitializeGenericTableAvl RtlCopyLuid

msasn1

ASN1_CloseEncoder ASN1BERDecOctetString ASN1objectidentifier_free ASN1ztcharstring_free ASN1intx_setuint32 ASN1intxisuint32 ASN1_CloseDecoder ASN1BEREncEndOfContents ASN1BERDecS32Val ASN1BEREncS32 ASN1BERDecGeneralizedTime ASN1DecAlloc ASN1BEREncCharString ASN1BEREncSX ASN1BEREncExplicitTag ASN1BERDecBitString ASN1intx2uint32 ASN1_FreeDecoded ASN1CEREncGeneralizedTime ASN1BERDecOpenType2 ASN1octetstring_free ASN1_Decode ASN1EncSetError ASN1_CreateModule ASN1Free ASN1BERDecExplicitTag ASN1_CreateEncoder ASN1BEREncOpenType ASN1BEREncObjectIdentifier ASN1BERDecEndOfContents ASN1BERDecNotEndOfContents ASN1BERDecZeroCharString ASN1_FreeEncoded ASN1charstring_free ASN1DecSetError ASN1BERDecSkip ASN1intx_free ASN1_CreateDecoder ASN1BERDecU32Val ASN1BEREncU32 ASN1BERDecObjectIdentifier ASN1BERDecSXVal ASN1bitstring_free ASN1BEREncOctetString ASN1BERDecPeekTag ASN1BERDecCharString ASN1_Encode ASN1BERDecBool ASN1BEREncBool ASN1BEREncBitString ASN1intx2int32

secur32

CredUnmarshalTargetInfo LsaFreeReturnBuffer LsaGetLogonSessionData FreeContextBuffer CredMarshalTargetInfo

kernel32

DisableThreadLibraryCalls lstrcpyW FileTimeToSystemTime SetEvent EnterCriticalSection GetComputerNameW CloseHandle InterlockedExchangeAdd GetCurrentProcessId GetCurrentProcess Sleep TerminateProcess LeaveCriticalSection RaiseException LocalAlloc WideCharToMultiByte MapViewOfFileEx VirtualAlloc UnregisterWait GetModuleFileNameA InterlockedCompareExchange GetTickCount InterlockedDecrement InitializeCriticalSection LoadLibraryW GetSystemInfo OpenEventW GetCurrentThread GetACP LoadLibraryA GetProfileStringA CreateFileMappingW OutputDebugStringA lstrcmpW LocalFree QueryPerformanceCounter CreateEventW GetCurrentThreadId MultiByteToWideChar DebugBreak CreateFileW FreeLibrary InterlockedIncrement RegisterWaitForSingleObjectEx GetModuleFileNameW GetSystemTimeAsFileTime GetEnvironmentVariableW ExpandEnvironmentStringsW lstrlenA GetModuleHandleW GetLocalTime lstrlenW DeleteCriticalSection GetProcAddress GetComputerNameExW InterlockedExchange OpenFileMappingW lstrcmpiA WriteFile UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError FormatMessageW CreateFileA UnmapViewOfFile

cryptdll

MD5Init CDBuildIntegrityVect CDLocateCheckSum MD5Final CDLocateCSystem MD5Update CDFindCommonCSystemWithKey CDGenerateRandomBits

user32

CharLowerBuffW wsprintfW

Sharing

General

Malware Config

Signatures

File Explorer

eb52081f70a03566618622b9fe44c29b_JaffaCakes118

advapi32

msvcrt

ntdll

msasn1

secur32

kernel32

cryptdll

user32

generic