3fdbf649662ba0ffa15138c6ecb406b1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3fdbf649662ba0ffa15138c6ecb406b1_JaffaCakes118
Size

258KB
MD5

3fdbf649662ba0ffa15138c6ecb406b1
SHA1

3ddadcbc60d704608811db64cdf3a382ab3819f8
SHA256

b44360e151abcf1360dfcd29414aa9015798c6620c1ec2db5be20936ba53e2e5
SHA512

4f44a8319a4864f03a72334942144f129181a7dbb15e537e4ffdc7122778a072ea4a85892ba82aa901545ee8f404298c2b270dc700a9b47fb2ee947d136aa655
SSDEEP

6144:9QBhbbszAYe3t05+vDt3ktm2EK1fmY0Lr:WBhkoPt3ktm81fmY03

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3fdbf649662ba0ffa15138c6ecb406b1_JaffaCakes118

Files

3fdbf649662ba0ffa15138c6ecb406b1_JaffaCakes118
.dll windows:5 windows x86 arch:x86

ca16d32fc5a77af3609ab84ad3f8d141

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

adsnt.pdb

Imports

activeds

ord7
ord21
ord22
ord23
ord17
ord18
ord15
ord14
ord16

advapi32

LockServiceDatabase
ChangeServiceConfigW
UnlockServiceDatabase
OpenServiceW
QueryServiceConfigW
OpenSCManagerW
CreateServiceW
CloseServiceHandle
QueryServiceStatus
GetSidSubAuthorityCount
GetSidSubAuthority
GetLengthSid
RegConnectRegistryW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
StartServiceW
ControlService
LookupAccountNameW
EnumServicesStatusW
DeleteService
GetUserNameW
SystemFunction040
SystemFunction041
GetSidIdentifierAuthority

kernel32

CompareStringW
GetTickCount
GetSystemTime
SystemTimeToFileTime
SetLastError
GetLastError
InterlockedIncrement
InterlockedDecrement
LocalFree
LocalAlloc
WaitForSingleObject
ReleaseSemaphore
LoadLibraryW
GetProcAddress
FreeLibrary
DeleteCriticalSection
CreateSemaphoreW
InitializeCriticalSection
DisableThreadLibraryCalls
GetComputerNameW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FormatMessageW
FileTimeToDosDateTime
DosDateTimeToFileTime
GetModuleHandleW
CloseHandle
EnterCriticalSection
LeaveCriticalSection
lstrlenW

mpr

WNetCancelConnection2W
WNetAddConnection2W

msvcrt

_CxxThrowException
free
_initterm
wcsrchr
wcscpy
_adjust_fdiv
__dllonexit
_onexit
_ftol
_wcsnicmp
wcschr
_ltow
_wtol
_itow
wcscmp
_except_handler3
wcslen
wcscat
_purecall
_wcsicmp
malloc

netapi32

NetLocalGroupGetMembers
NetGroupDel
NetLocalGroupDel
NetLocalGroupAdd
NetUserDel
I_NetNameCompare
NetFileEnum
NetGroupGetUsers
NetGetDCName
NetGetAnyDCName
DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation
NetWkstaGetInfo
NetUseGetInfo
NetWkstaUserGetInfo
NetGroupEnum
NetFileGetInfo
NetLocalGroupEnum
NetShareEnum
NetShareDel
NetShareSetInfo
NetShareAdd
NetShareGetInfo
NetSessionDel
NetSessionEnum
NetSessionGetInfo
NetServerSetInfo
NetLocalGroupGetInfo
NetGroupAdd
NetGroupDelUser
NetGroupAddUser
NetLocalGroupAddMembers
NetLocalGroupDelMembers
NetUserGetLocalGroups
NetUserGetGroups
NetGroupGetInfo
NetUserChangePassword
NetUserAdd
NetServerGetInfo
NetLocalGroupSetInfo
NetGroupSetInfo
NetUserGetInfo
NetUserSetInfo
NetQueryDisplayInformation
NetUserModalsGet
NetUserModalsSet
NetApiBufferFree
NetServerEnum

ntdll

RtlRunEncodeUnicodeString
RtlInitUnicodeString
RtlRunDecodeUnicodeString
RtlSecondsSince1970ToTime
RtlTimeToSecondsSince1970

ole32

CoCreateInstance
CoTaskMemFree
StringFromCLSID
CreatePointerMoniker
StringFromGUID2
CLSIDFromString
IIDFromString

oleaut32

VariantInit
DispGetIDsOfNames
LoadRegTypeLi
DispInvoke
SetErrorInfo
VariantCopy
SysFreeString
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreate
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocString
SafeArrayUnaccessData
SafeArrayAccessData
CreateErrorInfo
SystemTimeToVariantTime
VariantTimeToSystemTime
DosDateTimeToVariantTime
VariantTimeToDosDateTime
VariantClear

rassapi

ord3
ord2

user32

wsprintfW
LoadStringW

winspool.drv

DeletePrinter
GetJobW
EnumPrintersW
OpenPrinterW
SetPrinterW
ClosePrinter
AddPrinterW
GetPrinterW
EnumJobsW
SetJobW

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 221KB - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ca16d32fc5a77af3609ab84ad3f8d141

Headers

File Characteristics

PDB Paths

Imports

activeds

advapi32

kernel32

mpr

msvcrt

netapi32

ntdll

ole32

oleaut32

rassapi

user32

winspool.drv

Exports

Exports

Sections

.text Size: 221KB - Virtual size: 221KB

.data Size: 21KB - Virtual size: 21KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 221KB - Virtual size: 221KB

.data
Size: 21KB - Virtual size: 21KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 11KB