jaffacakes118__d263b7215a0aee64fa0b5c698a54b8ab

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118__d263b7215a0aee64fa0b5c698a54b8ab
Size 140KB
Sample260917-3lnahaed87
SHA256 4013c4b0f1c8f71edbae130412e86d9db64f934372f27f86437f30e37a5765eb
MD5 d263b7215a0aee64fa0b5c698a54b8ab
SHA1 1fc9db858d43a0de461f654f466c89f7803e86b9
SHA512 44eb2cfba9afa4f82612cd555f26f8a1c28ac20d57f3361e26dc8cd7276cc642d2b8e930e71639cf94c2c62ec7952da3835d282ce97a413c89dac0a1acb29e4c
SSDEEP 3072:c01as5ExiHYpaqQ0wX+RrhFCguxInlk7k6GwX:us5EkYXjrugkZ
TLSH
T1C0E3931922E65329F1F2AB700BBC617A99BABC1ADCB9D71D0240D95E1571A01DF30F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118__d263b7215a0aee64fa0b5c698a54b8ab

File Explorer

jaffacakes118__d263b7215a0aee64fa0b5c698a54b8ab

.dll 140KB

jaffacakes118__d263b7215a0aee64fa0b5c698a54b8ab

IMPHASH a048bb4f0b079a68d166b3b3d409b471
SHA256 4013c4b0f1c8f71edbae130412e86d9db64f934372f27f86437f30e37a5765eb
MD5 d263b7215a0aee64fa0b5c698a54b8ab
SHA1 1fc9db858d43a0de461f654f466c89f7803e86b9
SHA512 44eb2cfba9afa4f82612cd555f26f8a1c28ac20d57f3361e26dc8cd7276cc642d2b8e930e71639cf94c2c62ec7952da3835d282ce97a413c89dac0a1acb29e4c
SSDEEP 3072:c01as5ExiHYpaqQ0wX+RrhFCguxInlk7k6GwX:us5EkYXjrugkZ
TLSH
T1C0E3931922E65329F1F2AB700BBC617A99BABC1ADCB9D71D0240D95E1571A01DF30F3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4864

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

adsldpc.pdb

advapi32

RegCreateKeyExW OpenThreadToken OpenProcessToken LsaFreeMemory LsaGetUserName RegCloseKey RegQueryValueExW RegOpenKeyExW GetTokenInformation GetSidSubAuthority GetSidSubAuthorityCount GetSidIdentifierAuthority IsValidSid GetSidLengthRequired SystemFunction040 SystemFunction041 RegSetValueExW

kernel32

MultiByteToWideChar InitializeCriticalSection FreeLibrary DeleteCriticalSection CompareStringW GetProcAddress LoadLibraryW GetLastError GetCurrentThread GetCurrentThreadId EnterCriticalSection LeaveCriticalSection LocalFree LocalAlloc GetCurrentProcessId GetCurrentProcess CloseHandle GetTickCount FileTimeToSystemTime SystemTimeToFileTime SystemTimeToTzSpecificLocalTime ReadFile GetFileSize CreateFileW WriteFile DeleteFileW CreateDirectoryW ExpandEnvironmentStringsW lstrlenW CompareFileTime QueryPerformanceCounter GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError

msvcrt

bsearch _except_handler3 wcscpy wcslen wcsncpy _wcsicmp wcschr swscanf _wtol wcscmp wcstoul _itow swprintf wcscat _adjust_fdiv malloc _initterm free qsort _wcsnicmp wcsstr wcsrchr wcsncat iswdigit _wtoi

netapi32

NetWkstaGetInfo NetApiBufferFree

ntdll

RtlInitUnicodeString

user32

LoadStringW wsprintfW

wldap32

ord13 ord10 ord41 ord36 ord167 ord224 ord79 ord18 ord203 ord194 ord16 ord206 ord134 ord135 ord138 ord191 ord116 ord100 ord173 ord319 ord321 ord179 ord91 ord88 ord145 ord219 ord210 ord208 ord54 ord157 ord155 ord165 ord188 ord161 ord69 ord65 ord113 ord111 ord85 ord40 ord26 ord27 ord127 ord97 ord140 ord77 ord142 ord133 ord73 ord216 ord29 ord53 ord300 ord311 ord301 ord94 ord12 ord120 ord147 ord146 ord304 ord310 ord190 ord309 ord14

??0CLexer@@QAE@PAG@Z ??1CLexer@@QAE@XZ ?GetNextToken@CLexer@@QAEJPAGPAK@Z ?SetAtDisabler@CLexer@@QAEXH@Z ?SetExclaimnationDisabler@CLexer@@QAEXH@Z ?SetFSlashDisabler@CLexer@@QAEXH@Z ADSIAbandonSearch ADSICloseDSObject ADSICloseSearchHandle ADSICreateDSObject ADSIDeleteDSObject ADSIExecuteSearch ADSIFreeColumn ADSIGetColumn ADSIGetFirstRow ADSIGetNextColumnName ADSIGetNextRow ADSIGetObjectAttributes ADSIGetPreviousRow ADSIModifyRdn ADSIOpenDSObject ADSISetObjectAttributes ADSISetSearchPreference ADsAbandonSearch ADsCloseSearchHandle ADsCreateAttributeDefinition ADsCreateClassDefinition ADsCreateDSObject ADsCreateDSObjectExt ADsDecodeBinaryData ADsDeleteAttributeDefinition ADsDeleteClassDefinition ADsDeleteDSObject ADsEncodeBinaryData ADsEnumAttributes ADsEnumClasses ADsExecuteSearch ADsFreeColumn ADsGetColumn ADsGetFirstRow ADsGetLastError ADsGetNextColumnName ADsGetNextRow ADsGetObjectAttributes ADsGetPreviousRow ADsHelperGetCurrentRowMessage ADsObject ADsSetLastError ADsSetObjectAttributes ADsSetSearchPreference ADsWriteAttributeDefinition ADsWriteClassDefinition AdsTypeFreeAdsObjects AdsTypeToLdapTypeCopyConstruct AdsTypeToLdapTypeCopyDNWithBinary AdsTypeToLdapTypeCopyDNWithString AdsTypeToLdapTypeCopyGeneralizedTime AdsTypeToLdapTypeCopyTime AllocADsMem AllocADsStr BerBvFree BuildADsParentPath BuildADsParentPathFromObjectInfo BuildADsParentPathFromObjectInfo2 BuildADsPathFromLDAPPath BuildADsPathFromLDAPPath2 BuildADsPathFromParent BuildLDAPPathFromADsPath BuildLDAPPathFromADsPath2 ChangeSeparator Component ConvertSidToString ConvertSidToU2Trustee ConvertU2TrusteeToSid FindEntryInSearchTable FindSearchTableIndex FreeADsMem FreeADsStr FreeObjectInfo GetDefaultServer GetDisplayName GetDomainDNSNameForDomain GetLDAPTypeName GetSyntaxOfAttribute InitObjectInfo IsGCNamespace LdapAddExtS LdapAddS LdapAttributeFree LdapCacheAddRef LdapCloseObject LdapCompareExt LdapControlFree LdapControlsFree LdapCountEntries LdapCrackUserDNtoNTLMUser LdapCrackUserDNtoNTLMUser2 LdapCreatePageControl LdapDeleteExtS LdapDeleteS LdapFirstAttribute LdapFirstEntry LdapGetDn LdapGetNextPageS LdapGetSchemaObjectCount LdapGetSubSchemaSubEntryPath LdapGetSyntaxIdOfAttribute LdapGetSyntaxOfAttributeOnServer LdapGetValues LdapGetValuesLen LdapInitializeSearchPreferences LdapIsClassNameValidOnServer LdapMakeSchemaCacheObsolete LdapMemFree LdapModDnS LdapModifyExtS LdapModifyS LdapMsgFree LdapNextAttribute LdapNextEntry LdapOpenObject LdapOpenObject2 LdapParsePageControl LdapParseResult LdapReadAttribute LdapReadAttribute2 LdapReadAttributeFast LdapRenameExtS LdapResult LdapSearch LdapSearchAbandonPage LdapSearchExtS LdapSearchInitPage LdapSearchS LdapSearchST LdapTypeBinaryToString LdapTypeCopyConstruct LdapTypeFreeLdapModList LdapTypeFreeLdapModObject LdapTypeFreeLdapObjects LdapTypeToAdsTypeCopyConstruct LdapTypeToAdsTypeDNWithBinary LdapTypeToAdsTypeDNWithString LdapTypeToAdsTypeGeneralizedTime LdapTypeToAdsTypeUTCTime LdapValueFree LdapValueFreeLen LdapcKeepHandleAround LdapcSetStickyServer MapADSTypeToLDAPType MapLDAPTypeToADSType PathName ReadPagingSupportedAttr ReadSecurityDescriptorControlType ReadServerSupportsIsADControl ReallocADsMem ReallocADsStr SchemaAddRef SchemaClose SchemaGetClassInfo SchemaGetClassInfoByIndex SchemaGetObjectCount SchemaGetPropertyInfo SchemaGetPropertyInfoByIndex SchemaGetStringsFromStringTable SchemaGetSyntaxOfAttribute SchemaIsClassAContainer SchemaOpen SortAndRemoveDuplicateOIDs UnMarshallLDAPToLDAPSynID intcmp

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118__d263b7215a0aee64fa0b5c698a54b8ab

advapi32

kernel32

msvcrt

netapi32

ntdll

user32

wldap32

generic