321c6230b9d1a1082461464b9faf1570_JaffaCakes118

General

Target

321c6230b9d1a1082461464b9faf1570_JaffaCakes118
Size

595KB
MD5

321c6230b9d1a1082461464b9faf1570
SHA1

c302f07f6c01ab0c6b831865d092afb902ee1e83
SHA256

4d17534f1f36caa88187ffb6d18fada59e60130a03106630c1cf51fd3c302148
SHA512

90897955fc124b9d725b56780ed14d20233283a75ad190558fde41f8c8d7388a7b62ffa24d0018b372ecbf0956df235006d07af9bf83dbb2c8e4e91162485986
SSDEEP

12288:YW9xNbjckK1U5K62bjgJJZ+at9upCAt7VoiRw:tbjrKef2/g4aD87yii

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
321c6230b9d1a1082461464b9faf1570_JaffaCakes118

Files

321c6230b9d1a1082461464b9faf1570_JaffaCakes118
.exe windows:5 windows x86 arch:x86

5ed83e961a7cc99a4065c18a8f15c442

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ctl3d32

Ctl3dGetVer
Ctl3dEnabled
Ctl3dUnregister
Ctl3dRegister
Ctl3dCtlColor

crypt32

CryptMsgGetParam
CryptEnumOIDInfo
CertOpenStore
CryptFindOIDInfo
CertGetNameStringW
CryptMsgDuplicate
CertFindCRLInStore
CryptMsgUpdate
CryptMemAlloc
CryptMemRealloc
CryptMsgControl
CertAlgIdToOID
CertCloseStore

cryptdll

MD5Init
MD5Update
MD5Final
CDBuildVect
CDLocateRng

advapi32

RegEnumKeyA
CreateServiceA
RegOpenKeyA
RegSaveKeyA
LogonUserW
RegLoadKeyW
GetUserNameA
RegRestoreKeyW
RegUnLoadKeyW
CryptSignHashA
ReadEventLogW
OpenEventLogW
RegDeleteValueW

user32

MessageBoxW
IsWindow
InsertMenuW
MessageBoxExA
GetMessageW
DispatchMessageW
GetDlgItemTextA
FindWindowA
LoadMenuA
CharToOemW
CreateDesktopA
DrawStateW
IsDialogMessageW
GetClassLongW

kernel32

WriteFile
LoadLibraryExA
GetProcessHeap
OpenJobObjectA
GetLogicalDriveStringsW
lstrlenA
InitializeCriticalSection
SleepEx
CreateMutexW
GetCommandLineA
GetModuleHandleA
GetStringTypeW
GetConsoleAliasA
lstrcat
HeapFree
CreateFileW
GetACP
GetProcAddress

Sections

.text
Size: 560KB - Virtual size: 560KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5ed83e961a7cc99a4065c18a8f15c442

Headers

DLL Characteristics

File Characteristics

Imports

ctl3d32

crypt32

cryptdll

advapi32

user32

kernel32

Sections

.text Size: 560KB - Virtual size: 560KB

.rdata Size: 15KB - Virtual size: 15KB

.data Size: 1024B - Virtual size: 972B

.rsrc Size: 17KB - Virtual size: 16KB

.text
Size: 560KB - Virtual size: 560KB

.rdata
Size: 15KB - Virtual size: 15KB

.data
Size: 1024B - Virtual size: 972B

.rsrc
Size: 17KB - Virtual size: 16KB