29edbc587a8fd871abf1dcd62aaa1502_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

29edbc587a8fd871abf1dcd62aaa1502_JaffaCakes118
Size

180KB
MD5

29edbc587a8fd871abf1dcd62aaa1502
SHA1

c33952baf246c15ba9cfd1d530ec66755940c3f3
SHA256

2de850e3795f679c1b3c6b651b6136f2f855f558814a9e9fe2e035221aad469b
SHA512

4499734c00504ed52e57b50e0394555656cce5fd4ce5f080407f189a3db114dbe82eea0de6550b10eadc85fe9b6b82e9fbc35c0cf5138da42c5bc3ee84d26e90
SSDEEP

3072:PoSFNW50t2SBO9+PEielk9Nv37TI4G7xnagRZ9ZCInqsMzqkqsyjPMZk:PoSm5iEjkvpGVag/1nqsMzqts+M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29edbc587a8fd871abf1dcd62aaa1502_JaffaCakes118

Files

29edbc587a8fd871abf1dcd62aaa1502_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

b7e98383b91c7e71e893cd0c9132bad8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

raschap.pdb

Imports

msvcrt

strncpy
??3@YAXPAX@Z
_resetstkoflw
_except_handler3
??2@YAPAXI@Z
malloc
free
_purecall
wcscmp
strstr
memset
memcpy
_initterm
_adjust_fdiv
_wcsicmp
memmove
strchr
strncmp
atol
_ltoa
_wcsupr
wcscpy
wcslen
wcsncpy
wcscat
wcschr

atl

ord22
ord32
ord15
ord23
ord18
ord21
ord16

ntdll

RtlInitString
RtlNtStatusToDosError
RtlCreateUnicodeStringFromAsciiz
RtlFreeUnicodeString
RtlInitAnsiString
RtlUpcaseUnicodeStringToOemString
RtlInitUnicodeString
RtlAdjustPrivilege
NtAllocateLocallyUniqueId
RtlFreeOemString
RtlAnsiStringToUnicodeString

advapi32

RevertToSelf
ImpersonateLoggedOnUser
SystemFunction016
SystemFunction018
SystemFunction008
SystemFunction006
SystemFunction007
SystemFunction009
SystemFunction011
LsaOpenPolicy
LsaQueryInformationPolicy
LsaClose
LsaFreeMemory
RegQueryValueExA
RegSetValueExA
RegConnectRegistryA
RegOpenKeyExA
GetTokenInformation
RegCloseKey

kernel32

InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
GetCurrentProcess
LoadLibraryA
DisableThreadLibraryCalls
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
lstrcpyW
lstrcpynA
WideCharToMultiByte
GetLastError
CloseHandle
CreateFileW
GetModuleFileNameW
VirtualQuery
LocalFree
MultiByteToWideChar
LocalAlloc
GetComputerNameExW
lstrlenW
GetSystemTimeAsFileTime
lstrcmpiA
lstrlenA
GetComputerNameA
lstrcpyA
GetComputerNameW

secur32

LsaLookupAuthenticationPackage
LsaLogonUser
LsaRegisterLogonProcess
LsaCallAuthenticationPackage
LsaFreeReturnBuffer
LsaDeregisterLogonProcess
LsaConnectUntrusted
GetUserNameExW

netapi32

NetApiBufferFree
DsGetDcNameW

rtutils

TraceDeregisterA
TraceRegisterExA
TraceDumpExA
TracePrintfExA

samlib

SamiChangePasswordUser2
SamiEncryptPasswords

user32

GetWindowLongA
MessageBoxA
LoadStringA
DialogBoxParamA
GetDlgItem
IsDlgButtonChecked
GetWindowTextA
SetWindowLongA
EndDialog
SendMessageA
EnableWindow
ShowWindow
CheckDlgButton
SetWindowTextA
SetFocus
wsprintfA

wintrust

CryptCATAdminReleaseCatalogContext
WinVerifyTrust
CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
CryptCATCatalogInfoFromContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseContext
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain

crypt32

CryptProtectData
CryptUnprotectData
CertVerifyCertificateChainPolicy

ole32

CoTaskMemAlloc

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
RasCpEnumProtocolIds
RasCpGetInfo
RasEapCreateConnectionProperties
RasEapCreateUserProperties
RasEapFreeMemory
RasEapGetCredentials
RasEapGetIdentity
RasEapGetInfo
RasEapInvokeConfigUI
RasEapInvokeInteractiveUI

Sections

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b7e98383b91c7e71e893cd0c9132bad8

Headers

File Characteristics

PDB Paths

Imports

msvcrt

atl

ntdll

advapi32

kernel32

secur32

netapi32

rtutils

samlib

user32

wintrust

crypt32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 66KB - Virtual size: 65KB

.data Size: 60KB - Virtual size: 61KB

.rsrc Size: 49KB - Virtual size: 48KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 66KB - Virtual size: 65KB

.data
Size: 60KB - Virtual size: 61KB

.rsrc
Size: 49KB - Virtual size: 48KB

.reloc
Size: 3KB - Virtual size: 3KB