52192c73e1f50a7126f8c672b1e1ede2_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

52192c73e1f50a7126f8c672b1e1ede2_JaffaCakes118
Size

224KB
MD5

52192c73e1f50a7126f8c672b1e1ede2
SHA1

d1c562215302abe87f5f64b77433e45a5dda27af
SHA256

7d1bf1ead304056c4f7485c96db1994d1a162c81322478bd89d468a388e0f08a
SHA512

286b006d57a9566732a6f07c16a6e17785755e5d17fa244e82c7b98a2ea982ed684e14daa0afce97296b43d14aa1ecf4253f8360d5380fe9f73dc51601b759d4
SSDEEP

3072:lZ9UvnBQUg3gBEt9KEBEYyhtwWDsGCFHmWx6mBdn688ScE8p2J8k2Pl:lLUvmUI9KEB36sGCdmWxz38ScE8avcl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
52192c73e1f50a7126f8c672b1e1ede2_JaffaCakes118

Files

52192c73e1f50a7126f8c672b1e1ede2_JaffaCakes118
.dll windows:4 windows x86 arch:x86

491db166724159f04f3a0c6b4014be9f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetDiskFreeSpaceExW
GetModuleFileNameW
DisableThreadLibraryCalls
CreateFileW
lstrcpynW
GetDriveTypeW
LocalFree
FreeLibrary
CreateEventW
SetEvent
GetModuleHandleW
GetVersionExW
GetSystemTimeAsFileTime
SetFileAttributesW
FindNextFileW
FindClose
CreateThread
ExpandEnvironmentStringsW
GetLastError
GetFileAttributesW
WaitForSingleObject
lstrlenA
GetWindowsDirectoryW
LockResource
GetSystemDefaultLangID
MultiByteToWideChar
GlobalAlloc
GetFileSize
GetFileAttributesA
ExpandEnvironmentStringsA
GetSystemDirectoryA
Sleep
CreateDirectoryW
GetLocaleInfoW
GetCurrentProcess
GetTempPathW
lstrlenW
LocalAlloc
VirtualFree
GetSystemTime
DeleteCriticalSection
GetComputerNameExW
CloseHandle
LeaveCriticalSection
SystemTimeToFileTime
InitializeCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
CompareStringW
PulseEvent
GetCurrentThread
lstrcmpiA
FreeLibraryAndExitThread
LoadLibraryA
InterlockedExchange
GetProcAddress
SetFilePointer
HeapAlloc
GetProcessHeap
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetTickCount
ResetEvent
GlobalFree
WideCharToMultiByte
RaiseException

advapi32

IsValidSecurityDescriptor
RegisterEventSourceW
RevertToSelf
ImpersonateLoggedOnUser
DeregisterEventSource
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
AllocateAndInitializeSid
FreeSid
RegDeleteValueW
LookupAccountSidW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
InitializeSecurityDescriptor
SetFileSecurityW
InitializeAcl
GetAce
AddAccessAllowedAce
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExW
ImpersonateAnonymousToken
ImpersonateSelf
MakeAbsoluteSD
SetSecurityDescriptorControl
AddAccessDeniedAce
FindFirstFreeAce
AddAccessAllowedObjectAce
AddAuditAccessObjectAce
GetSecurityDescriptorControl
SetSecurityDescriptorOwner
GetSecurityDescriptorGroup
SetSecurityDescriptorGroup
SetSecurityDescriptorSacl
AddAuditAccessAce
CopySid
GetSecurityDescriptorSacl
AccessCheckByTypeResultList
AccessCheckAndAuditAlarmW
ObjectCloseAuditAlarmW
AreAllAccessesGranted
AccessCheck
OpenThreadToken
GetSecurityDescriptorDacl
AddAccessDeniedAceEx
SetSecurityDescriptorDacl
GetLengthSid
OpenServiceW
CloseServiceHandle
RegCreateKeyExW

ole32

StringFromIID
IIDFromString
CoUninitialize
CoInitializeEx
CoTaskMemFree
StringFromGUID2

msvcrt

wcslen
wcscat
swprintf
wcscmp
wcsncpy
wcschr
sprintf
wcscpy
_chdir
malloc
free
wcsncmp

secur32

InitSecurityInterfaceW
QueryContextAttributesW
DeleteSecurityContext

crypt32

CertFreeCertificateContext
CertVerifySubjectCertificateContext
CertVerifyTimeValidity
CertAddEncodedCertificateToStore
CertCreateCertificateContext
CertOpenSystemStoreW
CertFindCertificateInStore
CertDeleteCertificateFromStore
CertSetCertificateContextProperty
CertCloseStore
CertRDNValueToStrW

shlwapi

PathFindExtensionW

rpcrt4

RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoExW
RpcBindingFree
RpcRevertToSelf
RpcCancelThread
RpcMgmtInqServerPrincNameW
UuidFromStringW
RpcImpersonateClient
RpcStringFreeW
RpcServerUseProtseqEpW

Exports

Exports

AAreAsAnIs
BrokenValuesThat
ConfigurationTheRunWhitespace
ContinuationsWhitespaceSectionInformation
InExceptionNamesFileLines
NameValue
OfLine
OfParticularNotAroundThe
OptionButWhich
SWhatA
TimeNameStartOptionLearn
TrimmedBothFirstPreserved
ValueFormatContinuationTrailingFile
ValueWhitespaceIsLine

Sections

.text
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 148KB - Virtual size: 313KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

491db166724159f04f3a0c6b4014be9f

Headers

File Characteristics

Imports

kernel32

advapi32

ole32

msvcrt

secur32

crypt32

shlwapi

rpcrt4

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 46KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 148KB - Virtual size: 313KB

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 48KB - Virtual size: 46KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 148KB - Virtual size: 313KB

.reloc
Size: 4KB - Virtual size: 1KB