2aefbcda80299bc7481dffac0936ea82_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2aefbcda80299bc7481dffac0936ea82_JaffaCakes118
Size

448KB
MD5

2aefbcda80299bc7481dffac0936ea82
SHA1

a522fc0d0d044be7a473f03e3f28855aa182cce4
SHA256

dd94c9ef271cfcfa1f97af9c6ae8ad59535be0bf84474f6418e594fbcd123e42
SHA512

889735c41070516c7f9852f213cfee5de1ff3ff88176311345b616b09f1e9d485c65b3f2e133ae8b5d7886a0e71b1f375d8b48a27d021d7460ce7ae2eaae7b84
SSDEEP

12288:qt5GXfEcFmz3ymggCY9Acx/5gz1oHToYI3:quoCmY4lxm1o

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2aefbcda80299bc7481dffac0936ea82_JaffaCakes118

Files

2aefbcda80299bc7481dffac0936ea82_JaffaCakes118
.dll windows:4 windows x86 arch:x86

a6f3e946fcb890d8add1cef3afb9549e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

plc4

PL_strcasecmp
PL_strlen

plds4

PL_ArenaAllocate
PL_ArenaRelease
PL_HashTableEnumerateEntries
PL_HashTableLookup
PL_InitArenaPool
PL_HashTableAdd
PL_HashTableDestroy
PL_CompareValues
PL_NewHashTable
PL_FinishArenaPool
PL_HashTableRemove

nspr4

PR_AtomicIncrement
PR_AtomicDecrement
PR_NewLock
PR_DestroyLock
PR_Lock
PR_Unlock
PR_Calloc
PR_Free
PR_NewThreadPrivateIndex
PR_SetThreadPrivate
PR_GetThreadPrivate
PR_CallOnce

msvcr71

_onexit
__dllonexit
_except_handler3
__CppXcptFilter
_adjust_fdiv
malloc
_initterm
free
memmove
memcmp
memset
memcpy

kernel32

DisableThreadLibraryCalls

Exports

Exports

C_GetFunctionList
NSSArena_Create
NSSArena_Destroy
NSSCKFWC_CancelFunction
NSSCKFWC_CloseAllSessions
NSSCKFWC_CloseSession
NSSCKFWC_CopyObject
NSSCKFWC_CreateObject
NSSCKFWC_Decrypt
NSSCKFWC_DecryptDigestUpdate
NSSCKFWC_DecryptFinal
NSSCKFWC_DecryptInit
NSSCKFWC_DecryptUpdate
NSSCKFWC_DecryptVerifyUpdate
NSSCKFWC_DeriveKey
NSSCKFWC_DestroyObject
NSSCKFWC_Digest
NSSCKFWC_DigestEncryptUpdate
NSSCKFWC_DigestFinal
NSSCKFWC_DigestInit
NSSCKFWC_DigestKey
NSSCKFWC_DigestUpdate
NSSCKFWC_Encrypt
NSSCKFWC_EncryptFinal
NSSCKFWC_EncryptInit
NSSCKFWC_EncryptUpdate
NSSCKFWC_Finalize
NSSCKFWC_FindObjects
NSSCKFWC_FindObjectsFinal
NSSCKFWC_FindObjectsInit
NSSCKFWC_GenerateKey
NSSCKFWC_GenerateKeyPair
NSSCKFWC_GenerateRandom
NSSCKFWC_GetAttributeValue
NSSCKFWC_GetFunctionStatus
NSSCKFWC_GetInfo
NSSCKFWC_GetMechanismInfo
NSSCKFWC_GetMechanismList
NSSCKFWC_GetObjectSize
NSSCKFWC_GetOperationState
NSSCKFWC_GetSessionInfo
NSSCKFWC_GetSlotInfo
NSSCKFWC_GetSlotList
NSSCKFWC_GetTokenInfo
NSSCKFWC_InitPIN
NSSCKFWC_InitToken
NSSCKFWC_Initialize
NSSCKFWC_Login
NSSCKFWC_Logout
NSSCKFWC_OpenSession
NSSCKFWC_SeedRandom
NSSCKFWC_SetAttributeValue
NSSCKFWC_SetOperationState
NSSCKFWC_SetPIN
NSSCKFWC_Sign
NSSCKFWC_SignEncryptUpdate
NSSCKFWC_SignFinal
NSSCKFWC_SignInit
NSSCKFWC_SignRecover
NSSCKFWC_SignRecoverInit
NSSCKFWC_SignUpdate
NSSCKFWC_UnwrapKey
NSSCKFWC_Verify
NSSCKFWC_VerifyFinal
NSSCKFWC_VerifyInit
NSSCKFWC_VerifyRecover
NSSCKFWC_VerifyRecoverInit
NSSCKFWC_VerifyUpdate
NSSCKFWC_WaitForSlotEvent
NSSCKFWC_WrapKey
NSSCKFWFindObjects_GetMDFindObjects
NSSCKFWInstance_CreateMutex
NSSCKFWInstance_GetArena
NSSCKFWInstance_GetConfigurationData
NSSCKFWInstance_GetInitArgs
NSSCKFWInstance_GetMDInstance
NSSCKFWInstance_MayCreatePthreads
NSSCKFWMutex_Destroy
NSSCKFWMutex_Lock
NSSCKFWMutex_Unlock
NSSCKFWObject_GetArena
NSSCKFWObject_GetAttribute
NSSCKFWObject_GetAttributeCount
NSSCKFWObject_GetAttributeSize
NSSCKFWObject_GetAttributeTypes
NSSCKFWObject_GetMDObject
NSSCKFWObject_GetObjectSize
NSSCKFWObject_IsTokenObject
NSSCKFWSession_CallNotification
NSSCKFWSession_GetArena
NSSCKFWSession_GetCurrentCryptoOperation
NSSCKFWSession_GetMDSession
NSSCKFWSession_GetSessionState
NSSCKFWSession_IsRWSession
NSSCKFWSession_IsSO
NSSCKFWSlot_GetFWInstance
NSSCKFWSlot_GetMDInstance
NSSCKFWSlot_GetMDSlot
NSSCKFWToken_GetArena
NSSCKFWToken_GetFWSlot
NSSCKFWToken_GetMDSlot
NSSCKFWToken_GetMDToken
NSS_GetError
NSS_GetErrorStack
nssArenaHashAllocOps
nssArena_Create
nssArena_Destroy
nssArena_Mark
nssArena_Release
nssArena_Unmark
nssCKFWCryptoOperation_Create
nssCKFWCryptoOperation_Destroy
nssCKFWCryptoOperation_DigestKey
nssCKFWCryptoOperation_DigestUpdate
nssCKFWCryptoOperation_Final
nssCKFWCryptoOperation_GetFinalLength
nssCKFWCryptoOperation_GetMDCryptoOperation
nssCKFWCryptoOperation_GetOperationLength
nssCKFWCryptoOperation_GetType
nssCKFWCryptoOperation_Update
nssCKFWCryptoOperation_UpdateCombo
nssCKFWCryptoOperation_UpdateFinal
nssCKFWFindObjects_Create
nssCKFWFindObjects_Destroy
nssCKFWFindObjects_GetMDFindObjects
nssCKFWFindObjects_Next
nssCKFWHash_Add
nssCKFWHash_Count
nssCKFWHash_Create
nssCKFWHash_Destroy
nssCKFWHash_Exists
nssCKFWHash_Iterate
nssCKFWHash_Lookup
nssCKFWHash_Remove
nssCKFWInstance_Create
nssCKFWInstance_CreateMutex
nssCKFWInstance_CreateObjectHandle
nssCKFWInstance_CreateSessionHandle
nssCKFWInstance_Destroy
nssCKFWInstance_DestroyObjectHandle
nssCKFWInstance_DestroySessionHandle
nssCKFWInstance_FindObjectHandle
nssCKFWInstance_FindSessionHandle
nssCKFWInstance_GetArena
nssCKFWInstance_GetConfigurationData
nssCKFWInstance_GetCryptokiVersion
nssCKFWInstance_GetFlags
nssCKFWInstance_GetInitArgs
nssCKFWInstance_GetLibraryDescription
nssCKFWInstance_GetLibraryVersion
nssCKFWInstance_GetMDInstance
nssCKFWInstance_GetManufacturerID
nssCKFWInstance_GetModuleHandlesSessionObjects
nssCKFWInstance_GetNSlots
nssCKFWInstance_GetSlots
nssCKFWInstance_MayCreatePthreads
nssCKFWInstance_ReassignObjectHandle
nssCKFWInstance_ResolveObjectHandle
nssCKFWInstance_ResolveSessionHandle
nssCKFWInstance_WaitForSlotEvent
nssCKFWMechanism_Create
nssCKFWMechanism_DecryptInit
nssCKFWMechanism_DeriveKey
nssCKFWMechanism_Destroy
nssCKFWMechanism_DigestInit
nssCKFWMechanism_EncryptInit
nssCKFWMechanism_GenerateKey
nssCKFWMechanism_GenerateKeyPair
nssCKFWMechanism_GetCanDecrypt
nssCKFWMechanism_GetCanDerive
nssCKFWMechanism_GetCanDigest
nssCKFWMechanism_GetCanEncrypt
nssCKFWMechanism_GetCanGenerate
nssCKFWMechanism_GetCanGenerateKeyPair
nssCKFWMechanism_GetCanSign
nssCKFWMechanism_GetCanSignRecover
nssCKFWMechanism_GetCanUnwrap
nssCKFWMechanism_GetCanVerify
nssCKFWMechanism_GetCanVerifyRecover
nssCKFWMechanism_GetCanWrap
nssCKFWMechanism_GetInHardware
nssCKFWMechanism_GetMDMechanism
nssCKFWMechanism_GetMaxKeySize
nssCKFWMechanism_GetMinKeySize
nssCKFWMechanism_GetWrapKeyLength
nssCKFWMechanism_SignInit
nssCKFWMechanism_SignRecoverInit
nssCKFWMechanism_UnwrapKey
nssCKFWMechanism_VerifyInit
nssCKFWMechanism_VerifyRecoverInit
nssCKFWMechanism_WrapKey
nssCKFWMutex_Create
nssCKFWMutex_Destroy
nssCKFWMutex_Lock
nssCKFWMutex_Unlock
nssCKFWObject_Create
nssCKFWObject_Destroy
nssCKFWObject_Finalize
nssCKFWObject_GetArena
nssCKFWObject_GetAttribute
nssCKFWObject_GetAttributeCount
nssCKFWObject_GetAttributeSize
nssCKFWObject_GetAttributeTypes
nssCKFWObject_GetHandle
nssCKFWObject_GetMDObject
nssCKFWObject_GetObjectSize
nssCKFWObject_IsTokenObject
nssCKFWObject_SetAttribute
nssCKFWObject_SetHandle
nssCKFWSession_CallNotification
nssCKFWSession_CopyObject
nssCKFWSession_Create
nssCKFWSession_CreateObject
nssCKFWSession_DeregisterSessionObject
nssCKFWSession_Destroy
nssCKFWSession_DigestKey
nssCKFWSession_DigestUpdate
nssCKFWSession_Final
nssCKFWSession_FindObjectsInit
nssCKFWSession_GetArena
nssCKFWSession_GetCurrentCryptoOperation
nssCKFWSession_GetDeviceError
nssCKFWSession_GetFWFindObjects
nssCKFWSession_GetFWSlot
nssCKFWSession_GetHandle
nssCKFWSession_GetMDSession
nssCKFWSession_GetOperationState
nssCKFWSession_GetOperationStateLen
nssCKFWSession_GetRandom
nssCKFWSession_GetSessionState
nssCKFWSession_InitPIN
nssCKFWSession_IsRWSession
nssCKFWSession_IsSO
nssCKFWSession_Login
nssCKFWSession_Logout
nssCKFWSession_RegisterSessionObject
nssCKFWSession_SeedRandom
nssCKFWSession_SetCurrentCryptoOperation
nssCKFWSession_SetFWFindObjects
nssCKFWSession_SetHandle
nssCKFWSession_SetMDSession
nssCKFWSession_SetOperationState
nssCKFWSession_SetPIN
nssCKFWSession_Update
nssCKFWSession_UpdateCombo
nssCKFWSession_UpdateFinal
nssCKFWSlot_ClearToken
nssCKFWSlot_Create
nssCKFWSlot_Destroy
nssCKFWSlot_GetFWInstance
nssCKFWSlot_GetFirmwareVersion
nssCKFWSlot_GetHardwareSlot
nssCKFWSlot_GetHardwareVersion
nssCKFWSlot_GetMDInstance
nssCKFWSlot_GetMDSlot
nssCKFWSlot_GetManufacturerID
nssCKFWSlot_GetRemovableDevice
nssCKFWSlot_GetSlotDescription
nssCKFWSlot_GetSlotID
nssCKFWSlot_GetToken
nssCKFWSlot_GetTokenPresent
nssCKFWToken_CloseAllSessions
nssCKFWToken_Create
nssCKFWToken_Destroy
nssCKFWToken_GetArena
nssCKFWToken_GetFWSlot
nssCKFWToken_GetFirmwareVersion
nssCKFWToken_GetFreePrivateMemory
nssCKFWToken_GetFreePublicMemory
nssCKFWToken_GetHardwareVersion
nssCKFWToken_GetHasClockOnToken
nssCKFWToken_GetHasProtectedAuthenticationPath
nssCKFWToken_GetHasRNG
nssCKFWToken_GetIsWriteProtected
nssCKFWToken_GetLabel
nssCKFWToken_GetLoginRequired
nssCKFWToken_GetMDObjectHash
nssCKFWToken_GetMDSlot
nssCKFWToken_GetMDToken
nssCKFWToken_GetManufacturerID
nssCKFWToken_GetMaxPinLen
nssCKFWToken_GetMaxRwSessionCount
nssCKFWToken_GetMaxSessionCount
nssCKFWToken_GetMechanism
nssCKFWToken_GetMechanismCount
nssCKFWToken_GetMechanismTypes
nssCKFWToken_GetMinPinLen
nssCKFWToken_GetModel
nssCKFWToken_GetObjectHandleHash
nssCKFWToken_GetRestoreKeyNotNeeded
nssCKFWToken_GetRoSessionCount
nssCKFWToken_GetRwSessionCount
nssCKFWToken_GetSerialNumber
nssCKFWToken_GetSessionCount
nssCKFWToken_GetSessionObjectHash
nssCKFWToken_GetSessionState
nssCKFWToken_GetSupportsDualCryptoOperations
nssCKFWToken_GetTotalPrivateMemory
nssCKFWToken_GetTotalPublicMemory
nssCKFWToken_GetUTCTime
nssCKFWToken_GetUserPinInitialized
nssCKFWToken_InitToken
nssCKFWToken_OpenSession
nssCKFWToken_RemoveSession
nssCKFWToken_SetSessionState
nssCKMDFindSessionObjects_Create
nssCKMDSessionObject_Create
nssItem_Create
nssItem_Destroy
nssItem_Duplicate
nssItem_Equal
nssUTF8_CaseIgnoreMatch
nssUTF8_CopyIntoFixedBuffer
nssUTF8_Create
nssUTF8_Duplicate
nssUTF8_Equal
nssUTF8_GetEncoding
nssUTF8_Length
nssUTF8_PrintableMatch
nssUTF8_Size
nss_ClearErrorStack
nss_SetError
nss_ZAlloc
nss_ZFreeIf
nss_ZRealloc
nss_builtins_CreateMDObject
nss_builtins_CreateSession
nss_builtins_FindObjectsInit
nsslibc_memcmp
nsslibc_memcpy
nsslibc_memequal
nsslibc_memset

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 180KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a6f3e946fcb890d8add1cef3afb9549e

Headers

File Characteristics

Imports

plc4

plds4

nspr4

msvcr71

kernel32

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 39KB

.rdata Size: 208KB - Virtual size: 207KB

.data Size: 180KB - Virtual size: 178KB

.rsrc Size: 4KB - Virtual size: 776B

.reloc Size: 12KB - Virtual size: 8KB

.text
Size: 40KB - Virtual size: 39KB

.rdata
Size: 208KB - Virtual size: 207KB

.data
Size: 180KB - Virtual size: 178KB

.rsrc
Size: 4KB - Virtual size: 776B

.reloc
Size: 12KB - Virtual size: 8KB