e9c0e5206092f1823d6d06828bb497eb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e9c0e5206092f1823d6d06828bb497eb_JaffaCakes118
Size

330KB
MD5

e9c0e5206092f1823d6d06828bb497eb
SHA1

5352acad56ee6059c1d7179ba0b32d0f17a43cbd
SHA256

52c1df91b81f23b7d51fc0b6d6deba580a783304ce893987f29b6455d14005a4
SHA512

04beecd4f59babdcba36d66a1ac872baf376b9243765041e48233542c18248b9c072fff4d8b46b51e2d019a1a925f7c1429dbc2ee18dee9d886807ddfdf46044
SSDEEP

6144:qtDciOWc0Q+IWbVDDLZnX0GeNGoFMr8R73Vhf:PH/WRx18Sr8Rj/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e9c0e5206092f1823d6d06828bb497eb_JaffaCakes118

Files

e9c0e5206092f1823d6d06828bb497eb_JaffaCakes118
.exe windows:6 windows x86 arch:x86

d55f4b62bc37e4408d2284625deab8b9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

unregmp2.pdb

Imports

advapi32

RegDeleteKeyW
RegCloseKey
RegDeleteValueW
RegEnumValueW
RegSetValueExW
RegCreateKeyExW
SetNamedSecurityInfoW
GetSecurityDescriptorControl
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
CloseServiceHandle
ControlService
QueryServiceStatus
ChangeServiceConfigW
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
RegEnumKeyW
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyW

kernel32

GetSystemTimeAsFileTime
SetFileAttributesW
CreateHardLinkW
FindClose
FindFirstFileW
ExpandEnvironmentStringsW
GetTickCount
WriteFile
SizeofResource
CreateFileW
LoadResource
FindResourceW
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
RegisterApplicationRestart
HeapSetInformation
Sleep
GetShortPathNameW
lstrcmpW
FindFirstFileExW
FindNextFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetSystemWindowsDirectoryW
lstrlenW
CloseHandle
FileTimeToSystemTime
CreateFileA
GetFileSize
GetTempPathA
SetFilePointer
GetLocalTime
GetLongPathNameW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetProfileStringW
WriteProfileStringW
GetTempPathW
GetModuleFileNameW
GetWindowsDirectoryA
CreateDirectoryA
LoadLibraryExW
CopyFileW
GetSystemDefaultLangID
GetFileTime
GetTimeZoneInformation
GetVersionExA
GetVersionExW
GetFileAttributesA
LoadLibraryW
GetProcAddress
FreeLibrary
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
LocalFree
SetLastError
DeleteFileW
LCIDToLocaleName
GetUserDefaultLCID
RaiseException
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
GetFileAttributesW
GetWindowsDirectoryW
GetSystemDirectoryW
MoveFileW
GetLastError
MoveFileExW
RemoveDirectoryW
CreateDirectoryW

user32

LoadStringW
CharNextA

msvcrt

_unlock
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
_onexit
exit
_ismbblead
_XcptFilter
_exit
__dllonexit
__getmainargs
free
_wtol
mbstowcs
??_U@YAPAXI@Z
??_V@YAXPAX@Z
memset
wcschr
_wcslwr
wcsstr
wcsrchr
_wcsicmp
_wcsnicmp
_vsnwprintf
_acmdln
_cexit
_lock
_vsnprintf
swscanf
_wtoi
_itow
malloc
memcpy
_wcsupr
iswalnum
iswalpha

ole32

OleInitialize
OleUninitialize
CoInitialize
CoCreateInstance
CoUninitialize
CoCreateGuid
StringFromGUID2

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime
SysFreeString
SysAllocString
VariantClear

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetFolderPathW
SHSetLocalizedName
ShellExecuteW
SHChangeNotify
SHCreateItemFromParsingName
SHGetSpecialFolderPathW
SHGetPathFromIDListA

shlwapi

PathAppendW
PathIsDirectoryW
PathRemoveBlanksW
PathAddBackslashW
PathRemoveFileSpecW
PathAddBackslashA

wmdrmsdk

WMDRMCreateProvider

Sections

.text
Size: 278KB - Virtual size: 278KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

gdynjrn
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d55f4b62bc37e4408d2284625deab8b9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

ole32

oleaut32

version

shell32

shlwapi

wmdrmsdk

Sections

.text Size: 278KB - Virtual size: 278KB

.data Size: 4KB - Virtual size: 12KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 43KB - Virtual size: 45KB

gdynjrn Size: - Virtual size: 4KB

.text
Size: 278KB - Virtual size: 278KB

.data
Size: 4KB - Virtual size: 12KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 43KB - Virtual size: 45KB

gdynjrn
Size: - Virtual size: 4KB