0ba88b34ebdcdebb0e28c3ef57b62249_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0ba88b34ebdcdebb0e28c3ef57b62249_JaffaCakes118
Size

94KB
MD5

0ba88b34ebdcdebb0e28c3ef57b62249
SHA1

58dcf1cd7d95b363e0330644a240a031a3649311
SHA256

1a31534ad0c63a41a1cf69687b0ac32bc91daa834f00b4b9787cd201024f321c
SHA512

6f2111d76ce6859e32b4b04cb8fe00a0c9e0ffb49d34345177c68a2ea41b89348ecb2acd37624b312a60b60d30e3faa04829fcdfc9e6cb634a9b3ab07591175f
SSDEEP

1536:5WH2/r4s2gq3yQlEQiFXKREc7Mom5dFmEO+OKXqKIMk0:5WY0zfEQiFXKREbdFmEO+OBKhz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ba88b34ebdcdebb0e28c3ef57b62249_JaffaCakes118

Files

0ba88b34ebdcdebb0e28c3ef57b62249_JaffaCakes118
.exe windows:6 windows x86 arch:x86

c16f1f1004b979a76a5917f12197f705

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

wininit.pdb

Imports

advapi32

TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
EventRegister
EventUnregister
EventWrite
EventEnabled
RegOpenKeyW
LsaGetUserName
EventWriteEndScenario
EventWriteStartScenario
EventActivityIdControl
CheckTokenMembership
RevertToSelf
ImpersonateLoggedOnUser
EqualSid
GetTokenInformation
SetNamedSecurityInfoW
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
ConvertStringSecurityDescriptorToSecurityDescriptorW
DeregisterEventSource
RegisterEventSourceW
RegEnumValueW
RegQueryInfoKeyW
RegQueryInfoKeyA
RegQueryValueExA
QueryTraceW
EnableTrace
ControlTraceW
StartTraceW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
NotifyServiceStatusChangeW
CloseServiceHandle
NotifyBootConfigStatus
OpenProcessToken
CreateWellKnownSid
LookupAccountSidW
RegDeleteTreeW
CreateProcessAsUserW
DuplicateTokenEx
I_ScSendTSMessage
ReportEventW

kernel32

HeapAlloc
HeapFree
WaitForSingleObjectEx
ResetEvent
CreateEventW
Sleep
SetThreadExecutionState
MoveFileExW
DeleteFileW
GetSystemDirectoryW
GetCurrentProcessId
SleepEx
CreateThread
InterlockedExchange
CreateProcessW
HeapDestroy
FindClose
FindFirstFileW
GetWindowsDirectoryW
GetTickCount
SetErrorMode
CreateTimerQueueTimer
SetEvent
HeapSetInformation
QueueUserWorkItem
DeleteTimerQueueTimer
GetVersionExW
GetDateFormatW
GetTimeFormatW
FileTimeToSystemTime
SystemTimeToFileTime
GetLocalTime
LockResource
LoadResource
FindResourceExW
ExpandEnvironmentStringsW
lstrlenW
SetLastError
LocalFree
CreateDirectoryW
ReadFile
LocalAlloc
CreateFileW
GetShortPathNameW
lstrcmpiW
FindVolumeClose
FindNextVolumeW
GetDriveTypeW
FindFirstVolumeW
LocalReAlloc
LocalSize
InterlockedCompareExchange
LoadLibraryA
SetUnhandledExceptionFilter
GetStartupInfoA
DelayLoadFailureHook
HeapCreate
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
GetProcessHeap
ResumeThread
CreateRemoteThread
GetModuleHandleW
OpenProcess
SetTimerQueueTimer
GetFileAttributesW
LoadLibraryW
GetProcAddress
FreeLibrary
GetComputerNameW
SetEnvironmentVariableW
GetLastError
GetCurrentProcess
SetPriorityClass
GetCurrentThread
SetThreadPriority
GetExitCodeProcess
CloseHandle
WaitForMultipleObjectsEx
WaitForSingleObject
GetModuleHandleA

user32

GetAsyncKeyState
RecordShutdownReason
UnhookWindowsHookEx
SwitchDesktopWithFade
SetThreadDesktop
UpdatePerUserSystemParameters
LoadLocalFonts
SetWindowStationUser
SwitchDesktop
SetUserObjectSecurity
SetWindowsHookExW
CloseWindowStation
CloseDesktop
CreateDesktopW
SetProcessWindowStation
CreateWindowStationW
RegisterLogonProcess
ExitWindowsEx

msvcrt

_vsnwprintf
_wcsicmp
memcpy
memmove
wcschr
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_amsg_exit
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
?terminate@@YAXXZ
_controlfp
memset
wcsstr

ntdll

NtCreatePagingFile
NtShutdownSystem
RtlDeregisterWaitEx
NtOpenProcessToken
RtlRemovePrivileges
NtClose
RtlDosPathNameToNtPathName_U
NtReplyPort
NtCompleteConnectPort
NtReplyWaitReceivePort
NtAcceptConnectPort
NtCreatePort
NtAllocateLocallyUniqueId
RtlFreeSid
RtlSetSaclSecurityDescriptor
RtlAddMandatoryAce
RtlCreateAcl
RtlInitUnicodeString
NtQueryInformationProcess
RtlGetDaclSecurityDescriptor
RtlCopySid
RtlLengthSid
RtlSetDaclSecurityDescriptor
RtlAddAce
TpSimpleTryPost
RtlUnhandledExceptionFilter
NtQuerySystemInformation
RtlNtStatusToDosError
RtlRegisterWait
RtlDestroyEnvironment
NtSetValueKey
NtCreateKey
RtlSetThreadIsCritical
RtlSetProcessIsCritical
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlCompareUnicodeString
NtPrivilegeObjectAuditAlarm
NtPrivilegeCheck
NtOpenThreadToken
RtlAllocateAndInitializeSid
RtlInitializeCriticalSection
NtQueryInformationToken
RtlSetEnvironmentVariable
RtlQueryEnvironmentVariable_U
RtlInitUnicodeStringEx
RtlCreateEnvironment
NtCreateEvent
RtlAdjustPrivilege
NtSystemDebugControl
DbgBreakPoint
RtlCreateSecurityDescriptor
RtlFreeHeap

rpcrt4

RpcServerRegisterIfEx
RpcServerListen
RpcServerInqCallAttributesW
RpcImpersonateClient
RpcRevertToSelf
RpcBindingServerFromClient
RpcBindingToStringBindingW
RpcStringBindingParseW
RpcBindingFree
RpcServerUseProtseqW
RpcServerInqDefaultPrincNameW
NdrServerCall2
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcMgmtIsServerListening
NdrClientCall2
RpcBindingUnbind
RpcAsyncCompleteCall
RpcAsyncCancelCall
RpcAsyncInitializeHandle
RpcBindingBind
RpcBindingCreateW
RpcBindingCopy
NdrAsyncClientCall
I_RpcBindingIsClientLocal
RpcAsyncAbortCall
RpcServerTestCancel
NdrAsyncServerCall
RpcServerUseProtseqEpW
RpcServerRegisterAuthInfoW
RpcStringFreeW
RpcServerInqBindings
UuidFromStringW
RpcEpRegisterW
RpcServerUnregisterIf
RpcEpUnregister
RpcBindingVectorFree

userenv

GetAllUsersProfileDirectoryW
ord205
ord204
GetUserProfileDirectoryW

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c16f1f1004b979a76a5917f12197f705

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

ntdll

rpcrt4

userenv

Sections

.text Size: 80KB - Virtual size: 79KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 80KB - Virtual size: 79KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 5KB - Virtual size: 5KB