389023a7bf9986e0f4837ede900196c8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

389023a7bf9986e0f4837ede900196c8_JaffaCakes118
Size

957KB
MD5

389023a7bf9986e0f4837ede900196c8
SHA1

47b1f4a82b0d02e186893f4f93ab0c89483ae654
SHA256

d2129aceff9f0d9077cb108d6e80264605e7a8b3459879877678e3699ab87352
SHA512

4ce26e8e6b5c46260c9a5ac26ff19f415a3539923ce2c89e1ae49951f3ccf722d0f2fba19674ca47da19faa416ef4dad478243249e763bb69b17ab9fd3bae69d
SSDEEP

24576:kHmbbzhlmRmSnGPTuqME9OrMkCK7XurrsxCOi:vP/mPnYuLM7KLunKi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
389023a7bf9986e0f4837ede900196c8_JaffaCakes118

Files

389023a7bf9986e0f4837ede900196c8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b188159ce273c84fa0cad7792444387d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

msvcrt

wcscpy
_wtol
_ftol
wcscmp
_itow
_except_handler3
_onexit
wcsrchr
wcscat
wcschr
_wcsicmp
_CxxThrowException
_ltow
free
_initterm
__dllonexit
malloc
_adjust_fdiv
_wcsnicmp
wcslen
_purecall

oleaut32

VariantCopy

rpcrt4

RpcStringFreeW

netapi32

NetUseGetInfo
NetLocalGroupDel
NetWkstaUserGetInfo
NetGroupAdd
NetUserGetGroups
NetLocalGroupAddMembers
NetFileGetInfo
NetShareEnum
NetUserModalsGet
NetUserSetInfo
NetGroupGetUsers
NetUserGetInfo
NetServerGetInfo
NetSessionDel
NetGroupSetInfo
NetLocalGroupEnum
NetShareDel
NetLocalGroupSetInfo
NetShareGetInfo
NetUserChangePassword
NetGroupAddUser
NetLocalGroupAdd
NetUserModalsSet
NetGroupGetInfo
NetGroupEnum
DsRoleFreeMemory
NetGroupDel
NetServerSetInfo
NetApiBufferFree
NetGroupDelUser
NetGetDCName
NetSessionEnum
NetQueryDisplayInformation
NetShareSetInfo
NetServerEnum
NetShareAdd
NetUserAdd
DsRoleGetPrimaryDomainInformation
NetLocalGroupGetMembers
NetUserDel
NetLocalGroupGetInfo
NetWkstaGetInfo
NetUserGetLocalGroups
NetGetAnyDCName
NetLocalGroupDelMembers
NetSessionGetInfo

advapi32

RegQueryValueExW
SystemFunction041
ControlService
SystemFunction040
EnumServicesStatusW
GetSidIdentifierAuthority
CloseServiceHandle
LockServiceDatabase
GetSidSubAuthority
RegConnectRegistryW
GetUserNameW
LookupAccountNameW
GetLengthSid
CreateServiceW
GetSidSubAuthorityCount
OpenSCManagerW
StartServiceW
RegCloseKey
RegOpenKeyExW
DeleteService
QueryServiceStatus
RegEnumKeyExW
OpenServiceW
ChangeServiceConfigW
QueryServiceConfigW
UnlockServiceDatabase

ole32

CLSIDFromString
IIDFromString
CreatePointerMoniker
CoTaskMemFree
StringFromCLSID
StringFromGUID2
CoCreateInstance

user32

LoadStringW
wsprintfW

ntdll

RtlAddAccessAllowedAceEx
RtlAdjustPrivilege
NtAllocateVirtualMemory
RtlTimeToSecondsSince1970
RtlInitUnicodeString

kernel32

CloseHandle
GetStartupInfoA
FreeLibrary
InitializeCriticalSection
GetModuleHandleW
DeleteCriticalSection
GetTickCount
SystemTimeToFileTime
LocalFileTimeToFileTime
LocalAlloc
FileTimeToDosDateTime
CreateSemaphoreW
GetLastError
SetLastError
DisableThreadLibraryCalls
lstrlenW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
QueryPerformanceCounter
GetProcAddress
FileTimeToLocalFileTime
GetComputerNameW
GetCurrentThreadId
SystemTimeToTzSpecificLocalTime
TerminateProcess
LocalFree
GetCurrentProcessId
ReleaseSemaphore
LoadLibraryW
GetSystemTime
EnterCriticalSection
InterlockedIncrement
FileTimeToSystemTime
FormatMessageW
GetCurrentProcess
LeaveCriticalSection
CompareStringW
GetSystemTimeAsFileTime
WaitForSingleObject
InterlockedDecrement

mpr

WNetAddConnection2W
WNetCancelConnection2W

Sections

.text
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 237KB - Virtual size: 12.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512KB - Virtual size: 512KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b188159ce273c84fa0cad7792444387d

Headers

File Characteristics

Imports

msvcrt

oleaut32

rpcrt4

netapi32

advapi32

ole32

user32

ntdll

kernel32

mpr

Sections

.text Size: 110KB - Virtual size: 110KB

.data Size: 237KB - Virtual size: 12.9MB

.idata Size: 4KB - Virtual size: 4KB

.rdata Size: 91KB - Virtual size: 91KB

.rsrc Size: 512KB - Virtual size: 512KB

.tls Size: 512B - Virtual size: 4KB

.text
Size: 110KB - Virtual size: 110KB

.data
Size: 237KB - Virtual size: 12.9MB

.idata
Size: 4KB - Virtual size: 4KB

.rdata
Size: 91KB - Virtual size: 91KB

.rsrc
Size: 512KB - Virtual size: 512KB

.tls
Size: 512B - Virtual size: 4KB