4c498fc766176555412746c5ae692ad9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4c498fc766176555412746c5ae692ad9_JaffaCakes118
Size

125KB
MD5

4c498fc766176555412746c5ae692ad9
SHA1

887926492af0e3900cdffc618a7aed5264e92913
SHA256

8a9f570bda068a88ea35d661d4776eb63dc5cbb95348b2414078c9d7ef7f3702
SHA512

0889a095a7d0d2f8d0e4db18941cdb9a817c0c87a5b09fee77765bc2344ccaeab4ed161219acc2831093d4b7ad44559d5749b93478cb62d7730391556b8d7ab0
SSDEEP

1536:nrc3+tUSG0YhvJe04srR8VXn8Tbn3ISy6coEnnXnnXnnXnnXnnXnnXnnXnnXnnXn:nrhuSiRrR8J8Tb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c498fc766176555412746c5ae692ad9_JaffaCakes118

Files

4c498fc766176555412746c5ae692ad9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5009a741ed6ae3153e72235286bf88ea

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

clbcatq

DowngradeAPL
SetSetupSave

cfgmgr32

CM_Add_Empty_Log_Conf
CMP_Report_LogOn
CM_Add_IDA
CM_Add_Range

user32

wsprintfA
LoadBitmapA
IsDialogMessageA
DispatchMessageW
PostMessageA
CharToOemA
LoadIconA
IsCharLowerW
DialogBoxParamA
MessageBoxA
GetClassLongA
DrawStateW
PeekMessageW
InsertMenuW

comsvcs

CoEnterServiceDomain
CoLoadServices

kernel32

GetCommandLineW
InterlockedIncrement
CreateNamedPipeW
GetEnvironmentVariableW
WaitForSingleObject
GetLocalTime
CreateThread
GetComputerNameExA
FindClose
FindResourceExW
OpenThread
GlobalAddAtomW
GetConsoleTitleW
SetPriorityClass
FindNextFileA
CreateFileMappingW
FindFirstFileA
FormatMessageW
CloseHandle
GetLogicalDriveStringsW
GetProcAddress
GetPrivateProfileStringA
CreateDirectoryW
CreateSemaphoreA
LoadLibraryA
SetEnvironmentVariableA
GetModuleHandleA

shlwapi

UrlGetPartA
PathCompactPathW
UrlCreateFromPathA
UrlCombineA
UrlEscapeW
UrlCompareW
UrlUnescapeW
PathIsRootW
UrlHashW
UrlIsNoHistoryA
UrlGetLocationW
PathCommonPrefixW
UrlIsW
PathCombineA

resutils

ClusWorkerStart
ClusWorkerTerminate

shell32

SHFree
DllCanUnloadNow
DragQueryFileA
DllGetVersion
SHBrowseForFolderW
SHGetFolderPathA
StrChrA
ExtractIconA
SHEmptyRecycleBinW
SHCreateDirectoryExW

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

.rdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dec
Size: - Virtual size: 256KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5009a741ed6ae3153e72235286bf88ea

Headers

DLL Characteristics

File Characteristics

Imports

clbcatq

cfgmgr32

user32

comsvcs

kernel32

shlwapi

resutils

shell32

Sections

.text Size: 52KB - Virtual size: 52KB

.rdata Size: 59KB - Virtual size: 58KB

.dec Size: - Virtual size: 256KB

.rsrc Size: 12KB - Virtual size: 12KB

.text
Size: 52KB - Virtual size: 52KB

.rdata
Size: 59KB - Virtual size: 58KB

.dec
Size: - Virtual size: 256KB

.rsrc
Size: 12KB - Virtual size: 12KB