ec834b505765ccc07e3536f493845f8b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ec834b505765ccc07e3536f493845f8b_JaffaCakes118
Size

76KB
MD5

ec834b505765ccc07e3536f493845f8b
SHA1

a78797613089a60563be9c468f61e4e76e660dd9
SHA256

a0a36076155d07f5f1f8f6659a729c9286c5628dbeebed8bc645b1497fa7c648
SHA512

85c32ab24c97d4e644cbb10b0c949028d10a197c8814d1ee1e786102797a751204d9d27b93434ef98c7d4dfeba4defd0883266a817343c987d80312f77c28311
SSDEEP

1536:r12mHmyj6jdjK+Nbbgw4Zli+BVrQ7lpRdErhGLt3Dw5ZMCs9F4:R2m5jejTvZ4ZHVcEVIk52CUF4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ec834b505765ccc07e3536f493845f8b_JaffaCakes118

Files

ec834b505765ccc07e3536f493845f8b_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6bbb682434806740aacc493f436ac756

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

ZwOpenThread
RtlImageNtHeader
ZwQuerySystemInformation
RtlAdjustPrivilege
ZwImpersonateThread
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
ZwLoadDriver
_snwprintf
strncat
RtlRandom
LdrAddRefDll
ZwMakeTemporaryObject
sscanf
strncpy
strchr
ZwClose
_snprintf
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
RtlEqualUnicodeString
memset
memcpy

shlwapi

SHDeleteKeyA
PathFindFileNameA
PathFileExistsW

imagehlp

CheckSumMappedFile

psapi

GetMappedFileNameW

wininet

InternetConnectA
HttpOpenRequestA
InternetOpenA
HttpSendRequestA
InternetQueryOptionA
InternetSetOptionA
InternetCloseHandle
InternetCrackUrlA

kernel32

DeleteFileW
Sleep
UnmapViewOfFile
GetFileSize
MapViewOfFile
CreateFileMappingA
CreateFileW
CopyFileW
GetModuleHandleW
ExitProcess
GetCurrentProcess
GetModuleHandleA
GetProcAddress
DeleteFileA
GetSystemTime
WritePrivateProfileStringA
GetTickCount
WriteFile
CreateFileA
GetTempFileNameA
GetTempPathA
VirtualFree
CreateThread
CloseHandle
GetLastError
GetVersionExA
MoveFileExW
GetTempPathW
GetModuleFileNameW
VirtualAlloc
GetTempFileNameW

winspool.drv

AddPrintProvidorW
DeletePrintProvidorW

advapi32

CloseServiceHandle
QueryServiceStatusEx
StartServiceA
OpenSCManagerA
OpenServiceA
RegCloseKey
RegSetValueExA
RegCreateKeyA

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tdl
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 644B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6bbb682434806740aacc493f436ac756

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

shlwapi

imagehlp

psapi

wininet

kernel32

winspool.drv

advapi32

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: - Virtual size: 4KB

.tdl Size: 64KB - Virtual size: 64KB

.rsrc Size: 512B - Virtual size: 448B

.reloc Size: 1024B - Virtual size: 644B

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: - Virtual size: 4KB

.tdl
Size: 64KB - Virtual size: 64KB

.rsrc
Size: 512B - Virtual size: 448B

.reloc
Size: 1024B - Virtual size: 644B