14641bcab165d9c6261fe06023199e55_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

14641bcab165d9c6261fe06023199e55_JaffaCakes118
Size

95KB
MD5

14641bcab165d9c6261fe06023199e55
SHA1

893b582fc5e75d07183f366d9f2bbe20c06f4b4c
SHA256

aed645c2048a43737deee9874d1e9d9fc8fedeb368d23430ae8cdec46e9f8a73
SHA512

8f12b012cb0f2c5da83b485e1d745a3789e7505f1c98903d3bc0fb95af30b81011ef417a873446911a3cf8488c2caeb405807d492a03f497f84b4e4344919f8c
SSDEEP

1536:gGkDO+emtRq4NGY2AY9bervTyq0yfDMZccLwKEDNdBiGJMiwC1hGqSFK0aX7FJA9:SDO+H9GY27ebTZ0y7MZcccz5BMivLG7f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14641bcab165d9c6261fe06023199e55_JaffaCakes118

Files

14641bcab165d9c6261fe06023199e55_JaffaCakes118
.exe windows:1 windows x86 arch:x86

c265990bc8aa81b9f6f2bf6d7ed0297b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetBinaryType
GetVersion
CreateRemoteThread
BuildCommDCBAndTimeoutsW
FindNextChangeNotification
LoadLibraryA
GetUserDefaultUILanguage
SetSystemPowerState
EnumTimeFormatsA
SearchPathA
SetConsoleMenuClose
EnumSystemCodePagesW
WriteFile
Process32Next
FindVolumeClose
CreateNamedPipeW
GetDiskFreeSpaceA
GetConsoleInputExeNameW
lstrcpy
EnumerateLocalComputerNamesW
GetHandleInformation
GlobalFindAtomA
GetModuleFileNameA
GetSystemDefaultLCID
InitializeCriticalSectionAndSpinCount
CreateTimerQueueTimer
IsValidLocale
ClearCommBreak
GetFileAttributesExW
BaseCleanupAppcompatCacheSupport
GetEnvironmentVariableW
SizeofResource
OpenWaitableTimerA
GetModuleFileNameW
SetEndOfFile
GetGeoInfoW
VirtualFree
GetNumberOfConsoleInputEvents
VirtualAlloc
GetThreadPriorityBoost
LZClose
InitializeCriticalSection
EnumLanguageGroupLocalesW
GetThreadSelectorEntry
WriteProfileSectionA

ntdll

NtMakePermanentObject
RtlCheckForOrphanedCriticalSections
ZwTerminateThread
ZwEnumerateValueKey
NtQueryInstallUILanguage
ZwResetEvent
NtCreateProcess
ZwCancelIoFile
RtlAppendStringToString
ZwSetEventBoostPriority
RtlAddCompoundAce
DbgUiSetThreadDebugObject
ZwYieldExecution
RtlActivateActivationContextUnsafeFast
DbgUiStopDebugging
ZwAccessCheckByTypeResultList
RtlpNtSetValueKey
RtlGetNativeSystemInformation
strtol
RtlAbsoluteToSelfRelativeSD
NtOpenSymbolicLinkObject
RtlDumpResource
RtlSetThreadPoolStartFunc
RtlWriteRegistryValue
LdrLoadDll
RtlGetAce
CsrCaptureMessageMultiUnicodeStringsInPlace
NtLoadKey
RtlQueueWorkItem
NtReadRequestData
NtCancelTimer
NtEnumerateSystemEnvironmentValuesEx
ZwGetWriteWatch
NtOpenIoCompletion

advapi32

GetSecurityDescriptorSacl
ImpersonateAnonymousToken
CryptHashData
A_SHAFinal
StartTraceA
GetNamedSecurityInfoExA
BackupEventLogW
WmiSetSingleItemA
ConvertSDToStringSDRootDomainA
CredpEncodeCredential
ElfClearEventLogFileW
CheckTokenMembership
WmiQueryAllDataA
ElfOpenEventLogA
ChangeServiceConfigW
CredpConvertTargetInfo
CredpConvertCredential
GetSecurityInfo
QueryServiceLockStatusA
ElfClearEventLogFileA
RegGetKeySecurity
SaferiChangeRegistryScope
CreateProcessWithLogonW
WriteEncryptedFileRaw
AccessCheckByTypeResultListAndAuditAlarmByHandleA
RegisterServiceCtrlHandlerW
ConvertSDToStringSDRootDomainW
SaferGetLevelInformation

mapi32

MAPIFindNext
MAPIDetails
FtMulDwDw@8
LpValFindProp@12
BMAPIGetReadMail
UNKOBJ_FreeRows@8
CreateTable@36
HrAddColumns@16
HrValidateIPMSubtree@20
MAPISendDocuments
cmc_send_documents
DeregisterIdleRoutine@4
MAPILogon
FBadSortOrderSet@4
MAPIOpenFormMgr
cmc_free
MAPIAllocateMore
FPropCompareProp@12
SzFindCh@8
HrDispatchNotifications@4
ScRelocProps@20
OpenIMsgSession@12
IsBadBoundedStringPtr@8
WrapProgress@20
ScMAPIXFromSMAPI

wldap32

ldap_abandon
ldap_search_sW
ber_first_element
ldap_sslinitA
ldap_memfreeA
ldap_modrdn
ldap_parse_referenceA
ldap_check_filterA
ldap_compare_extA
ldap_modify_s
ldap_parse_vlv_controlW
ldap_parse_sort_controlA
LdapUTF8ToUnicode
ldap_parse_page_controlW
ldap_dn2ufnA
ldap_first_reference
ldap_get_values_lenW
ldap_stop_tls_s
ldap_add_sW
ldap_controls_freeW
ldap_explode_dnW
ber_bvfree
ldap_add_ext_sW
ldap_search_ext_s
ldap_parse_reference
ldap_explode_dnA
ldap_searchA
ldap_rename_ext_sW
ldap_sasl_bind_sA
ldap_compare_ext
ldap_search_ext
ldap_value_freeW
ldap_delete_extA
ldap_get_values_lenA
ldap_connect
ldap_openA
ldap_simple_bindW
ldap_search_st
ldap_get_values
ldap_parse_sort_control
ldap_value_free_len
ldap_next_entry
ldap_create_page_controlW
ldap_get_next_page_s
ber_next_element

mapistub

MAPILogoff
cmc_logoff
FtMulDwDw@8
WrapCompressedRTFStream@12
HrAddColumns@16
RTFSync
LpValFindProp@12
MNLS_lstrlenW@4
UlFromSzHex@4
MAPISaveMail
GetOutlookVersion
FtMulDw@12
__CPPValidateParameters@8
ScLocalPathFromUNC@12
UlPropSize@4
WrapStoreEntryID@24
FtgRegisterIdleRoutine@20
RTFSync@12
FGetComponentPath@20
MAPIFindNext
CreateIProp@24
MAPIDetails
UNKOBJ_Free@8
ScMAPIXFromCMC
HrComposeEID@28
ScCountProps@12
GetTnefStreamCodepage@12
FPropCompareProp@12
OpenIMsgSession@12
BMAPIAddress

rtm

MgmAddGroupMembershipEntry
RtmGetExactMatchRoute
RtmInvokeMethod
CheckTable
EnumOverTable
RtmMarkDestForChangeNotification
RtmDequeueRouteChangeMessage
RtmGetFirstRoute
RtmDeregisterFromChangeNotification
RtmLookupIPDestination
RtmCreateDestEnum
RtmGetRoutePointer
RtmReleaseDests
RtmReadInstanceConfig
RtmLockNextHop
RtmGetOpaqueInformationPointer
RtmAddRouteToDest
RtmGetRegisteredEntities
MgmDeInitialize
RtmGetNextRoute
RtmReleaseDestInfo
RtmIgnoreChangedDests
MgmGetMfeStats
RtmWriteAddressFamilyConfig
RtmCreateEnumerationHandle
RtmGetEnumDests
RtmDeregisterClient
RtmReferenceHandles
RtmRegisterForChangeNotification
RtmReleaseChangedDests
RtmBlockSetRouteEnable
MgmGroupEnumerationStart
RtmDeleteEnumHandle
RtmUpdateAndUnlockRoute
DeleteFromTable
RtmBlockMethods
RtmIsMarkedForChangeNotification
RtmGetExactMatchDestination
MgmGroupEnumerationEnd
RtmLockDestination
RtmGetRouteInfo
MgmGetFirstMfe
RtmDeleteRouteTable

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c265990bc8aa81b9f6f2bf6d7ed0297b

Headers

File Characteristics

Imports

kernel32

ntdll

advapi32

mapi32

wldap32

mapistub

rtm

Sections

.text Size: 49KB - Virtual size: 49KB

.rdata Size: 27KB - Virtual size: 27KB

.data Size: 14KB - Virtual size: 177KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 49KB - Virtual size: 49KB

.rdata
Size: 27KB - Virtual size: 27KB

.data
Size: 14KB - Virtual size: 177KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 1024B - Virtual size: 1024B