e8fd86a09d4ddd7e81fc6fb173dd8ef4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e8fd86a09d4ddd7e81fc6fb173dd8ef4_JaffaCakes118
Size

593KB
MD5

e8fd86a09d4ddd7e81fc6fb173dd8ef4
SHA1

e9b07ece83d8fae1b12fee33e39a07eb1282aa22
SHA256

91dd31ef4b262eb656c6171315ceaa937d8664d6d773f0f942ad6fbc7e3788fa
SHA512

2627b669d9ed8f3b58fa97670be43ea88e75b5f0af452e4cbe2fce4e23bc5e04a48f1fe6d0b475913f7539c805543e4ac8287876bb1bf14acea5e9c537923ff6
SSDEEP

12288:znVklX4ID/3NQWy+1FEl8wiOikTNxLVET5p0vhcLdRt:zne9F/32Wy+1qlsOikxhS30pcLd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e8fd86a09d4ddd7e81fc6fb173dd8ef4_JaffaCakes118

Files

e8fd86a09d4ddd7e81fc6fb173dd8ef4_JaffaCakes118
.exe windows:5 windows x86 arch:x86

56ccd1abfeddd3fa60f44c9363f3916a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

BuildCommDCBW
DeviceIoControl
DnsHostnameToComputerNameA
EnumDateFormatsW
EnumResourceLanguagesW
ExitProcess
FlushInstructionCache
FreeConsole
GetACP
GetCommandLineA
GetCurrencyFormatA
GetCurrentThread
GetMailslotInfo
GetProcessAffinityMask
HeapAlloc
IsValidLanguageGroup
OpenMutexA
RtlZeroMemory
SetCalendarInfoW
SetLastError
SetThreadLocale
SetUnhandledExceptionFilter
SetVolumeLabelA
VerLanguageNameA
VirtualAlloc
VirtualFree
WriteProfileSectionA
_lwrite

version

VerFindFileA
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA
GetFileVersionInfoA

ntdll

RtlExpandEnvironmentStrings_U
NtFsControlFile
RtlNtStatusToDosError
RtlSetThreadPoolStartFunc
ZwCreateProcess
ZwDeleteFile
ZwDuplicateObject
RtlLookupElementGenericTable

userenv

RegisterGPNotification
EnterCriticalPolicySection
ExpandEnvironmentStringsForUserW
FreeGPOListW
GetAppliedGPOListW
CreateEnvironmentBlock
UnregisterGPNotification
DestroyEnvironmentBlock
LeaveCriticalPolicySection
GetProfilesDirectoryW

crtdll

freopen
_mbctoupper
_initterm
_finite
_exit

rpcrt4

IUnknown_Release_Proxy
float_from_ndr
double_from_ndr
RpcSsSetThreadHandle
RpcSmSetClientAllocFree
RpcServerUseAllProtseqsIfEx
RpcServerUseAllProtseqsIf
RpcServerUseAllProtseqsEx
RpcServerInqIf
RpcServerInqDefaultPrincNameA
RpcObjectSetInqFn
RpcMgmtInqIfIds
RpcCancelThread
RpcBindingToStringBindingA
RpcBindingInqAuthClientA
RpcAsyncInitializeHandle
CStdStubBuffer_IsIIDSupported
MIDL_wchar_strcpy

Exports

Exports

IwctmomOwcbrCrnu
aaZUaxGtvsvivk
auVnudZpLdrvIkQrg
bEgwds
bspqbeoKkekjt
cMshpu
gnaupmmLu
gvcgnlQyqhu
kOrQzoyqz
kxVfxEcyflcqjjgc
lFuuxdfLkyocnN
rXXyulZ
shtFdvnrY
tGsdjkweuwlekjosohc
uAriolz
uwfmpgcllguprP
vhKtzsxgju
wcsMfboj

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 506KB - Virtual size: 507KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

56ccd1abfeddd3fa60f44c9363f3916a

Headers

File Characteristics

Imports

kernel32

version

ntdll

userenv

crtdll

rpcrt4

Exports

Exports

Sections

.text Size: 34KB - Virtual size: 33KB

.data Size: 506KB - Virtual size: 507KB

.rsrc Size: 51KB - Virtual size: 51KB

.text
Size: 34KB - Virtual size: 33KB

.data
Size: 506KB - Virtual size: 507KB

.rsrc
Size: 51KB - Virtual size: 51KB