f3ec33172c4c877968351c9c44bcf54e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f3ec33172c4c877968351c9c44bcf54e_JaffaCakes118
Size

184KB
MD5

f3ec33172c4c877968351c9c44bcf54e
SHA1

77e32709ad2c649d0698d6d936774af78fb0275f
SHA256

61977616e0ee8a6a55852371cf1debb4ddfb5d1c4f5bd4b771597f6172f120d6
SHA512

aef6665ece47529b42e1a699a0eaabe4e4dfe931cfa3da16c8e448a9c3974543d853cae6194f3937be277da7578ad0eaa3595bd0140ecbdc8e663b315a457f7d
SSDEEP

3072:+3FE113KmYEiJK52YwpAfhuwe8pNyM5x3+O/pLYl+Nvnp4J2d:h1jTiIsYKAfhxjdDNvyO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f3ec33172c4c877968351c9c44bcf54e_JaffaCakes118

Files

f3ec33172c4c877968351c9c44bcf54e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9920591e125a01e673534cb3a47a5afa

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

OpenSCManagerW
CloseServiceHandle
QueryServiceStatus
DeleteService
StartServiceW
OpenServiceW
CreateServiceW
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
SetSecurityDescriptorDacl
IsValidSid
InitializeSecurityDescriptor
GetTokenInformation
GetLengthSid
FreeSid
EqualSid
AllocateAndInitializeSid
GetKernelObjectSecurity

user32

MsgWaitForMultipleObjects
OpenInputDesktop
PeekMessageA
GetUserObjectInformationA
EndDialog
DefWindowProcA
DestroyWindow
GetThreadDesktop
CloseDesktop
GetKeyboardType
DialogBoxParamA
BeginPaint
GetClientRect
DrawTextA
EndPaint
CreateWindowExA
ShowWindow
UpdateWindow
LoadIconA
LoadCursorA
RegisterClassExA
LoadStringA
RegisterWindowMessageA
LoadAcceleratorsA
SetTimer
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
KillTimer
SystemParametersInfoA
GetAsyncKeyState
GetForegroundWindow
GetWindowLongA
MapVirtualKeyA
keybd_event
GetClassNameA
PostMessageA
FindWindowA
GetKeyState
wsprintfA
MessageBoxA
ExitWindowsEx

kernel32

LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
GetOEMCP
GetACP
GetCPInfo
InterlockedIncrement
InterlockedDecrement
IsBadCodePtr
HeapReAlloc
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
SetUnhandledExceptionFilter
CreateEventW
CreateFileMappingA
CreateFileMappingW
CreateMutexA
CreateMutexW
CreatePipe
CreateProcessA
CreateProcessW
DuplicateHandle
FormatMessageA
DeleteFileW
GetSystemDirectoryW
GetVersionExW
Sleep
GetLastError
CloseHandle
GetCurrentProcess
DeviceIoControl
GetVersionExA
CreateEventA
CreateFileA
GetTickCount
ResetEvent
WaitForSingleObject
SetThreadPriority
CreateThread
ExitProcess
VirtualFree
WriteFile
GetSystemDirectoryA
VirtualAlloc
LockResource
LoadResource
SizeofResource
FindResourceA
HeapFree
HeapAlloc
GetProcessHeap
SetPriorityClass
GetCurrentThread
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
GetThreadLocale
GetStartupInfoA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
lstrlenW
lstrlenA
lstrcpyW
lstrcpyA
lstrcmpiW
lstrcmpiA
WriteProcessMemory
WaitForMultipleObjects
VirtualQueryEx
VirtualQuery
VirtualProtectEx
UnmapViewOfFile
TerminateThread
TerminateProcess
SetLastError
SetEvent
ResumeThread
ReleaseMutex
ReadProcessMemory
ReadFile
OpenProcess
OpenMutexW
OpenMutexA
OpenFileMappingW
OpenFileMappingA
OpenEventW
OpenEventA
MapViewOfFile
LoadLibraryExA
LoadLibraryW
LoadLibraryA
IsBadWritePtr
IsBadReadPtr
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
GetModuleFileNameA
GetFileAttributesW
GetFileAttributesA
GetExitCodeThread
GetCurrentProcessId
GetCurrentDirectoryW
GetCurrentDirectoryA
InterlockedExchange

oleaut32

SysReAllocStringLen
SysFreeString

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

CODE
Size: 88KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9920591e125a01e673534cb3a47a5afa

Headers

File Characteristics

Imports

advapi32

user32

kernel32

oleaut32

Sections

.text Size: 36KB - Virtual size: 33KB

CODE Size: 88KB - Virtual size: 85KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 16KB - Virtual size: 16KB

DATA Size: 4KB - Virtual size: 3KB

BSS Size: 4KB - Virtual size: 1KB

.rsrc Size: 24KB - Virtual size: 22KB

.text
Size: 36KB - Virtual size: 33KB

CODE
Size: 88KB - Virtual size: 85KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 16KB - Virtual size: 16KB

DATA
Size: 4KB - Virtual size: 3KB

BSS
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 24KB - Virtual size: 22KB