461927730aaa605a228f7dad4cd7759d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

461927730aaa605a228f7dad4cd7759d_JaffaCakes118
Size

279KB
MD5

461927730aaa605a228f7dad4cd7759d
SHA1

6099af02caab0fab91a49af26872f6270a76c598
SHA256

466bc64df94ff34583e6d859f5e0ce5420f0df2c5a2de759ea73e48a7225f8af
SHA512

f282d365305b76f88308e145303d2908493def10d462955ae59143e1dbce8a9fd87286ee285e0cfa9efeb324bcc54daef5c63c6ddc15f90263d0646093dc03fc
SSDEEP

3072:p6GL3P/S1DYERwDPVKnYYLh6mosfThAccF2mpBUjZNWI4MDIPmXIXKaI8Wzo01P8:p3S1y7VKnxLcmo2hAvpBU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
461927730aaa605a228f7dad4cd7759d_JaffaCakes118

Files

461927730aaa605a228f7dad4cd7759d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6adfa1b3eade3752542a59ede2a51b9a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

dsquery.pdb

Imports

msvcrt

_XcptFilter
_cexit
exit
__winitenv
__wgetmainargs
_initterm
__setusermatherr
_exit
__p__commode
__p__fmode
__CxxFrameHandler
_wcsicmp
wcscmp
_c_exit
wcsncpy
wcscpy
free
_adjust_fdiv
_vsnwprintf
wcschr
wcslen
__set_app_type
_except_handler3
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_controlfp
_iob
wcsstr
_vsnprintf
memmove
setlocale
_setmode
iswdigit
_wtoi
_wtol
_itow
fgetwc
fread
??3@YAXPAX@Z
??2@YAPAXI@Z
fputwc

atl

ord30

advapi32

RegQueryValueExW
RegCloseKey
ConvertSidToStringSidW
RegOpenKeyExW
IsValidSid
GetLengthSid
ConvertSecurityDescriptorToStringSecurityDescriptorW

kernel32

lstrlenW
FormatMessageW
GetSystemTimeAsFileTime
WideCharToMultiByte
MultiByteToWideChar
FindResourceW
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetThreadUILanguage
lstrcpyW
QueryPerformanceCounter
GetFileType
WriteFile
WriteConsoleW
GetCommandLineW
GetConsoleCP
LockResource
LoadResource
lstrcmpiW
SetLastError
ReadConsoleW
SetConsoleMode
GetConsoleMode
GetStdHandle
LocalAlloc
LocalFree
GetModuleHandleW
GetLastError

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance
StringFromGUID2

oleaut32

VariantClear
SysStringLen
SysAllocStringLen
VariantInit
SysFreeString
SysAllocString

user32

LoadStringW

activeds

ord15
ord9
ord13

dsprop

CrackName

crypt32

CryptUnprotectData
CryptProtectData

ntdsapi

DsBindW
DsCrackNamesW
DsUnBindW
DsFreeNameResultW

netapi32

DsGetDcNameW
NetApiBufferFree

Sections

.text
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 165KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6adfa1b3eade3752542a59ede2a51b9a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

atl

advapi32

kernel32

ole32

oleaut32

user32

activeds

dsprop

crypt32

ntdsapi

netapi32

Sections

.text Size: 51KB - Virtual size: 50KB

.data Size: 62KB - Virtual size: 62KB

.rsrc Size: 165KB - Virtual size: 164KB

.text
Size: 51KB - Virtual size: 50KB

.data
Size: 62KB - Virtual size: 62KB

.rsrc
Size: 165KB - Virtual size: 164KB