159317f8dc6bba1dbbc98fb6f83854a7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

159317f8dc6bba1dbbc98fb6f83854a7_JaffaCakes118
Size

200KB
MD5

159317f8dc6bba1dbbc98fb6f83854a7
SHA1

abd0af7aeafb811e243f95ee141c794f871efb0f
SHA256

c3dc4bfbb9ef363c445c172d1992ea8368a20fbd99f06505ff2865a8e7155723
SHA512

341ad7f804b1bba519dc7ea1d024a10cea0f7b75e4bd24d05605ab323e9256d2c2abd8d4459f5e1612925b3a142ba6263c856accd12bdeeb8a5934b004eefc8a
SSDEEP

3072:OeChCd7NJFX0HHaRuAxMduvBTp+SIt+8MavtVDG7xdJyJlh49p:KhIsHFA5TYY8v1VmxdiW9p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
159317f8dc6bba1dbbc98fb6f83854a7_JaffaCakes118

Files

159317f8dc6bba1dbbc98fb6f83854a7_JaffaCakes118
.exe windows:6 windows x86 arch:x86

fb92ef247e1be6be67cfa6625459427e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

cipher.pdb

Imports

advapi32

EncryptFileW
DecryptFileW
AddUsersToEncryptedFile
RemoveUsersFromEncryptedFile
AddUsersToEncryptedFileEx
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
LookupAccountSidW
FreeEncryptedFileKeyInfo
FreeEncryptionCertificateHashList
QueryRecoveryAgentsOnEncryptedFile
QueryUsersOnEncryptedFile
EncryptedFileKeyInfo
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptGetUserKey
FlushEfsCache
SetUserFileEncryptionKey

kernel32

GetFullPathNameW
GetComputerNameW
ReadConsoleW
SetConsoleMode
VirtualFree
VirtualAlloc
CloseHandle
SetEndOfFile
SetFilePointer
CreateFileW
DeviceIoControl
GetVolumeNameForVolumeMountPointW
VerifyVersionInfoW
VerSetConditionMask
FindClose
FindNextFileW
WideCharToMultiByte
FindFirstFileW
GetFileAttributesW
QueryDosDeviceW
FindVolumeClose
FindNextVolumeW
GetVolumeInformationW
FindFirstVolumeW
SetErrorMode
RemoveDirectoryW
SetLastError
GetTempFileNameW
CreateDirectoryW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDriveTypeW
GetVolumePathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapSetInformation
DelayLoadFailureHook
FreeLibrary
InterlockedCompareExchange
LoadLibraryExA
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
UnhandledExceptionFilter
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
Sleep
InterlockedExchange
LocalFree
WriteConsoleW
FlushFileBuffers
lstrlenW
WriteFile
HeapFree
GetProcessHeap
HeapAlloc
FormatMessageW
GetFileType
GetStdHandle
GetConsoleMode
GetModuleHandleW
GetLastError
GetProcAddress
lstrcmpW

msvcrt

__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
__set_app_type
?terminate@@YAXXZ
_controlfp
_get_osfhandle
_vsnwprintf
_except_handler4_common
_exit
_cexit
__wgetmainargs
_putws
_wcsnicmp
memcpy
getchar
printf
memset
_iob
fgetws
towupper
wcschr
_wcsicmp

ntdll

RtlNtStatusToDosError

rpcrt4

UuidCreate
RpcStringFreeW
UuidToStringW

user32

MessageBoxW

ntdsapi

DsCrackNamesW
DsBindW
DsUnBindW
DsFreeNameResultW

crypt32

CertCloseStore
CertFindCertificateInStore
CertOpenStore
CryptStringToBinaryW
CertAddCertificateContextToStore
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CryptQueryObject
PFXExportCertStoreEx
CertEnumCertificatesInStore
CertGetCertificateContextProperty

bcrypt

BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptGenerateSymmetricKey
BCryptEncrypt
BCryptDestroyKey
BCryptCloseAlgorithmProvider

netapi32

DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation

efsutil

EfsUtilCreateSelfSignedCertificate
EfsUtilGetSmartcardProviderName
EfsUtilGetCurrentUserInformation

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

PACK
Size: 164KB - Virtual size: 424KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fb92ef247e1be6be67cfa6625459427e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

ntdll

rpcrt4

user32

ntdsapi

crypt32

bcrypt

netapi32

efsutil

Sections

.text Size: 31KB - Virtual size: 30KB

.data Size: 512B - Virtual size: 9KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

PACK Size: 164KB - Virtual size: 424KB

.text
Size: 31KB - Virtual size: 30KB

.data
Size: 512B - Virtual size: 9KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB

PACK
Size: 164KB - Virtual size: 424KB