209899efaeef69e70437c19d2a39c868_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

209899efaeef69e70437c19d2a39c868_JaffaCakes118
Size

798KB
MD5

209899efaeef69e70437c19d2a39c868
SHA1

2fa10fc2d8fd565a03425998896796bb2388713c
SHA256

11ead2e02695a7348926d3facf2ca8b50b934599afe7aff4245136639ba67ec0
SHA512

5ee379d6eb300fccb95ee2b5e4d730b970de5ef243b49fedf1ca45c1a1a22a426fc76d54a32627c37046880019ca190fb8cdd6ff66e88646e8fa7a9a1010d70a
SSDEEP

12288:kc3sXMFFR0C/16QUXcSMgKlEEr5mHo12Njj+Fbsg9WnY7CpwKLUc:kCnL6QUsSMflEEr5mO2N2Fb394pwKQc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
209899efaeef69e70437c19d2a39c868_JaffaCakes118

Files

209899efaeef69e70437c19d2a39c868_JaffaCakes118
.exe windows:5 windows x86 arch:x86

152601b957faf88ea0fc72ae26e7c51a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReleaseMutex
Sleep
GetFileSize
CloseHandle
UnmapViewOfFile
CreateMutexA
OpenMutexA
CreateEventA
LoadLibraryA
GetModuleHandleA
InterlockedDecrement
GetProcAddress
VirtualFree
GetLastError
GetModuleHandleExW
IsBadReadPtr
GetEnvironmentVariableW
GetCurrentDirectoryW
GetFullPathNameW
GetFileAttributesExW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
SetEvent
SetLastError
WriteFile
DeleteFileA
HeapReAlloc
OpenProcess
GetCurrentProcess
ExitProcess
TerminateProcess
SetUnhandledExceptionFilter
GetProcessId
DuplicateHandle
GetLocalTime
SystemTimeToFileTime
GetTickCount
CreateProcessW
GetTempPathA
GetTempFileNameA
MoveFileExA
AddVectoredExceptionHandler
GetCurrentProcessId
GetCurrentThread
GetThreadContext
FindClose
GetCurrentDirectoryA
CreateDirectoryA
RemoveDirectoryA
GetFileAttributesA
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
WriteConsoleW
FlushFileBuffers
SetStdHandle
GetProcessHeap
HeapFree
HeapAlloc
FreeLibrary
InterlockedCompareExchange
InterlockedIncrement
GetStringTypeW
GetConsoleCP
RaiseException
RtlUnwind
GetCurrentThreadId
LoadLibraryExW
GetCommandLineA
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetStdHandle
GetModuleFileNameW
IsProcessorFeaturePresent
HeapSize
IsDebuggerPresent
VirtualQuery
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetConsoleMode
SetFilePointerEx
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
OutputDebugStringW
LoadLibraryW
LCMapStringW

user32

IsDialogMessageA
MessageBoxA
DialogBoxParamA
SetDlgItemInt

advapi32

RegOpenKeyExA
RegCloseKey
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
RegQueryValueExA

shell32

ShellExecuteExW

oleaut32

SysFreeString
SysAllocString

Sections

.text
Size: 165KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

152601b957faf88ea0fc72ae26e7c51a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

oleaut32

Sections

.text Size: 165KB - Virtual size: 164KB

.rdata Size: 48KB - Virtual size: 47KB

.data Size: 12KB - Virtual size: 23KB

.rsrc Size: 17KB - Virtual size: 16KB

.text
Size: 165KB - Virtual size: 164KB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 12KB - Virtual size: 23KB

.rsrc
Size: 17KB - Virtual size: 16KB