031fad205d4c71b5d3fd0082bf7c54e1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

031fad205d4c71b5d3fd0082bf7c54e1_JaffaCakes118
Size

244KB
MD5

031fad205d4c71b5d3fd0082bf7c54e1
SHA1

cd9458bf06124124ba36493a0daf0db13a054ad3
SHA256

7d39d29e3e676ec6762c49d87d6034e47a809e5059281bde09f4d9b62f5549b1
SHA512

9ef65b3a3a66fa246778cfa130466a5d023d6a62328fb8797f5ffdd8065b5850f87ff3daaa8a2adf47dccd45c0f170f23de81f7f4255e55387b97003e0ebfc3b
SSDEEP

6144:hPrkRib35WqUzlEZ5hpR5mXM/0XaYf7BRgYLceg3:Zruib3ylEFpRGM/0KKBjg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
031fad205d4c71b5d3fd0082bf7c54e1_JaffaCakes118

Files

031fad205d4c71b5d3fd0082bf7c54e1_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

2ec4a80641f2c49d648c8906101f6f4d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

wcsncat
wcscmp
_wcsupr
bsearch
_strnicmp
strtoul
wcsncpy
_ultow
wcsrchr
_wcsicmp
wcschr
_initterm
_adjust_fdiv
??1type_info@@UAE@XZ
__dllonexit
_onexit
sprintf
_wtoi64
_mbschr
_purecall
wcslen
__CxxFrameHandler
?terminate@@YAXXZ
wcscat
wcscpy
swprintf
??0exception@@QAE@ABV0@@Z
free
_CxxThrowException
malloc
_callnewh
wcstoul
_except_handler3

msvcp60

??1bad_alloc@std@@UAE@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
?nothrow@std@@3Unothrow_t@1@B
??0bad_alloc@std@@QAE@PBD@Z
??0bad_alloc@std@@QAE@ABV01@@Z

atl

ord21
ord18
ord22
ord15
ord32
ord16

ntdll

RtlInitUnicodeString
RtlNtStatusToDosError
RtlEqualSid
RtlSubAuthorityCountSid
RtlLengthRequiredSid
RtlAllocateHeap
RtlCopySid
RtlInitializeSid
RtlSubAuthoritySid
RtlGetNtProductType
RtlAdjustPrivilege
RtlInitString
NtAllocateLocallyUniqueId
RtlFreeHeap
RtlLengthSid
RtlCopySidAndAttributesArray
RtlAnsiStringToUnicodeString

iaspolcy

IASAttributeAddRef
IASAttributeAnsiAlloc
IASAttributeAlloc
IASAttributeRelease

iasrad

?radiusToIAS@VSAFilter@@QBEJPAUIAttributesRaw@@@Z
?radiusFromIAS@VSAFilter@@QBEJPAUIAttributesRaw@@@Z

iassvcs

IASGetLocalDictionary
IASAllocateUniqueID
IASAdler32
IASGetHostByName
IASGetDictionary
IASVariantChangeType
IASRegisterComponent

advapi32

DeregisterEventSource
RegisterEventSourceW
RegOpenKeyW
RegNotifyChangeKeyValue
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteKeyW
GetTokenInformation
LsaOpenPolicy
LsaQueryInformationPolicy
LsaClose
LsaFreeMemory
SystemFunction017
SystemFunction019
SystemFunction008
SystemFunction009
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey

kernel32

CreateEventW
GetTimeZoneInformation
FreeLibrary
GetProcAddress
GetComputerNameW
ExpandEnvironmentStringsW
SwitchToThread
TryEnterCriticalSection
FileTimeToSystemTime
InterlockedCompareExchange
RegisterWaitForSingleObject
InterlockedExchange
GetSystemTimeAsFileTime
UnregisterWait
WaitForSingleObject
CreateThread
SetEvent
LocalAlloc
LocalFree
SetLastError
FormatMessageA
Sleep
VirtualProtect
VirtualQuery
SystemTimeToFileTime
LoadLibraryW
VirtualAlloc
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
GetLastError
CloseHandle

netapi32

NetRegisterDomainNameChangeNotification
NetApiBufferFree
DsGetDcNameW
NetpParmsQueryUserProperty
NetpParmsSetUserProperty
NetUnregisterDomainNameChangeNotification

ntdsapi

DsCrackNamesW
DsUnBindW
DsBindW
DsBindWithCredA
DsFreeNameResultW

ole32

CoTaskMemAlloc
CoTaskMemFree

oleaut32

SafeArrayRedim
SafeArrayPtrOfIndex
SafeArrayCreate
VariantTimeToSystemTime
SetErrorInfo
LoadRegTypeLi
VariantClear
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
VariantInit
SysStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound

rtutils

TraceRegisterExW
TraceVprintfExA
TracePutsExA
TraceDeregisterW

user32

wsprintfA

wldap32

ord133
ord13
ord203
ord167
ord145
ord16
ord14
ord88
ord127
ord147
ord41
ord77
ord79
ord142
ord224
ord140
ord26
ord312
ord36
ord18
ord73

secur32

LsaLogonUser
LsaDeregisterLogonProcess
LsaCallAuthenticationPackage
LsaRegisterLogonProcess
LsaFreeReturnBuffer
LsaLookupAuthenticationPackage

samlib

SamLookupNamesInDomain
SamOpenUser
SamConnect
SamOpenDomain
SamiChangePasswordUser2
SamQueryInformationUser
SamGetGroupsForUser
SamGetAliasMembership
SamFreeMemory
SamiChangePasswordUser
SamCloseHandle
SamLookupDomainInSamServer

Exports

Exports

ServiceMain
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IASParmsFreeUserParms
IASParmsQueryRasUser0
IASParmsQueryUserProperty
IASParmsSetRasUser0
IASParmsSetUserProperty

Sections

.text
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2ec4a80641f2c49d648c8906101f6f4d

Headers

File Characteristics

Imports

msvcrt

msvcp60

atl

ntdll

iaspolcy

iasrad

iassvcs

advapi32

kernel32

netapi32

ntdsapi

ole32

oleaut32

rtutils

user32

wldap32

secur32

samlib

Exports

Exports

Sections

.text Size: 75KB - Virtual size: 74KB

.data Size: 1024B - Virtual size: 3KB

.rsrc Size: 160KB - Virtual size: 160KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 75KB - Virtual size: 74KB

.data
Size: 1024B - Virtual size: 3KB

.rsrc
Size: 160KB - Virtual size: 160KB

.reloc
Size: 6KB - Virtual size: 5KB