03872aff1483ee458466f3ef541851e4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

03872aff1483ee458466f3ef541851e4_JaffaCakes118
Size

774KB
MD5

03872aff1483ee458466f3ef541851e4
SHA1

90872c26ab0d8669ae826aafd0c2e78cf7c5faab
SHA256

ffdcc9e745a7fc8a044cadd869e0256b003ea86d37fd25fedf4fb5e9cbb5a401
SHA512

e1f114f3d0f6c2022487f03ab6c060e596dfa6023b41de9956333bb8caf1ebc3cf5027999ebdc6e82716563caea6802af1c7ebd3e3cd69f78ea0460beae294cd
SSDEEP

24576:ZE2rTSPGZo0Bd/ha97SpSMA5Hqb2IClR2AduJn3GL4j:yVP0o0Bd/ha97SpSMA5Hqb2f32LwL4j

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
03872aff1483ee458466f3ef541851e4_JaffaCakes118

Files

03872aff1483ee458466f3ef541851e4_JaffaCakes118
.exe windows:5 windows x86 arch:x86

bcff038dc708be30aa501288191d0f9e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnterCriticalSection
InterlockedDecrement
SetThreadPriority
LeaveCriticalSection
WaitForSingleObject
GetCurrentThreadId
DuplicateHandle
ExitThread
CreateEventW
SetEvent
TerminateThread
CreateThread
ResetEvent
InterlockedIncrement
GetTickCount
GetModuleHandleExW
FreeLibrary
InitializeCriticalSection
SetEndOfFile
CreateFileW
GetFileType
FlushFileBuffers
CompareFileTime
GetTimeFormatW
GetCurrentProcessId
GlobalMemoryStatusEx
GetDateFormatW
GetProcessTimes
WriteConsoleW
HeapSize
SetStdHandle
lstrlenW
LoadLibraryW
Process32FirstW
Process32NextW
InterlockedExchange
Sleep
CreateToolhelp32Snapshot
OpenProcess
TerminateProcess
GetModuleFileNameA
WideCharToMultiByte
GetModuleHandleW
GetFileSize
FindClose
GetModuleFileNameW
FindNextFileW
FindFirstFileW
ReadFile
DeleteCriticalSection
DecodePointer
RaiseException
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
GetTempFileNameA
LocalSize
CloseHandle
DeleteFileA
CreateFileA
GetTempPathA
WriteFile
SetLastError
CreateDirectoryW
lstrcpyW
GetProcAddress
LoadLibraryA
lstrcmpA
LocalAlloc
IsWow64Process
GetCurrentProcess
GetComputerNameW
LocalFree
GetLastError
GetSystemDirectoryW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
GetProcessHeap
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetACP
GetStdHandle
ExitProcess
HeapFree
HeapReAlloc
HeapAlloc
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
OutputDebugStringW
RtlUnwind
LoadLibraryExW
GetVolumeInformationW

user32

wsprintfW

advapi32

IsValidSid
RegCreateKeyA
RegQueryInfoKeyW
RegOpenKeyA
RegDeleteKeyA
RegCreateKeyExA
RegEnumKeyExW
RegSetValueExA
RegQueryInfoKeyA
RegCreateKeyW
RegEnumValueA
RegDeleteValueA
RegEnumKeyExA
GetUserNameW
GetSidSubAuthorityCount
GetSidSubAuthority
SystemFunction036
GetSidIdentifierAuthority
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegEnumKeyW
RegDeleteKeyW
RegQueryValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegOpenKeyW
RegEnumValueW
RegQueryValueExW
CryptAcquireContextW
CryptCreateHash
CryptHashData
ConvertSidToStringSidW
CryptGetHashParam
LookupAccountNameW

shell32

ShellExecuteW
ShellExecuteExA
SHGetFolderPathW
SHGetSpecialFolderPathW

ole32

CoUninitialize
CoCreateInstance
CoInitialize

shlwapi

PathFindFileNameA
UrlCreateFromPathW
PathFileExistsA

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

HttpOpenRequestW
HttpQueryInfoW
HttpEndRequestW
InternetGetLastResponseInfoW
InternetQueryDataAvailable
InternetOpenW
InternetWriteFile
InternetCloseHandle
InternetConnectW
InternetSetOptionW
InternetReadFile
HttpAddRequestHeadersW

Sections

.text
Size: 532KB - Virtual size: 531KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 195KB - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

crf
Size: 512B - Virtual size: 200B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bcff038dc708be30aa501288191d0f9e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

version

wininet

Sections

.text Size: 532KB - Virtual size: 531KB

.rdata Size: 195KB - Virtual size: 195KB

.data Size: 10KB - Virtual size: 16KB

.gfids Size: 2KB - Virtual size: 1KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 30KB - Virtual size: 30KB

crf Size: 512B - Virtual size: 200B

.text
Size: 532KB - Virtual size: 531KB

.rdata
Size: 195KB - Virtual size: 195KB

.data
Size: 10KB - Virtual size: 16KB

.gfids
Size: 2KB - Virtual size: 1KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 30KB - Virtual size: 30KB

crf
Size: 512B - Virtual size: 200B