4c7042976f144d9b78b61399d172b2fc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4c7042976f144d9b78b61399d172b2fc_JaffaCakes118
Size

1.2MB
MD5

4c7042976f144d9b78b61399d172b2fc
SHA1

4a167bace4723939834ca82a747038108145135c
SHA256

35c485ce5058c8779c2c1eef7eceae140262bc9b6aff9d269fd250232ee02dfb
SHA512

f75e20b358255b795a02a250e7f7fe2daa3c2c4e64a8e7e92ff0dbff948a71f494b3aef9c31277be6ebf9b9ceb0f6ea819d5adb83733b023fd39437faf66a63a
SSDEEP

24576:VTbuNxyJTKJDA5h/T8CAiWcqZDNFfuQedlQSVLm5b:VmAl5RTicqBNFf2lVy5b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c7042976f144d9b78b61399d172b2fc_JaffaCakes118

Files

4c7042976f144d9b78b61399d172b2fc_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7623943f9e25814d79c7583f9ebc1216

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetDriveTypeA
GetDiskFreeSpaceExW
ExpandEnvironmentStringsW
GetPrivateProfileSectionA
DeleteFileA
GetEnvironmentVariableA
SetCurrentDirectoryA
SetEnvironmentVariableA
OutputDebugStringA
GetLastError
CreateDirectoryA
GetFileAttributesA
LocalReAlloc
GetCurrentDirectoryA
GetOverlappedResult
WaitForMultipleObjects
ReadFile
CreateEventA
CreateNamedPipeA
CreateProcessA
WaitForSingleObject
GetSystemDirectoryA
LoadLibraryA
FreeLibrary
LocalAlloc
CloseHandle
CreateFileA
RtlUnwind
IsProcessorFeaturePresent
GetCommandLineA
HeapAlloc
IsDebuggerPresent
HeapCreate
GetModuleHandleW
WriteFile
GetFileAttributesW
GetModuleFileNameW
TlsGetValue
TlsSetValue
TlsFree
SetLastError
InterlockedDecrement
Sleep
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetModuleFileNameA
WideCharToMultiByte
GetEnvironmentStringsW
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetProcAddress
MapViewOfFileEx
UnmapViewOfFile
RaiseException
GetProcessHeap
HeapFree
SetFilePointer
InterlockedExchange
InterlockedCompareExchange
QueryPerformanceCounter
GetSystemTimeAsFileTime
UnhandledExceptionFilter
VirtualFree
GetLogicalDrives
GetModuleHandleA
GetVolumePathNameW
ReadDirectoryChangesW
ResetEvent
VerSetConditionMask
VerifyVersionInfoA
GetStdHandle
RemoveDirectoryA

advapi32

RegSetValueA
RegCloseKey
GetFileSecurityW
GetSecurityDescriptorGroup
RegEnumValueW
RegOpenKeyExW
RegQueryValueExA
RegCreateKeyA

shell32

SHGetFileInfoW
SHFileOperationW
ShellExecuteExW

msvcrt

puts
wcslen
wcscat
strncmp
malloc
strstr
strchr
memset
free
isspace
calloc
mbtowc
localeconv
realloc
strrchr
tolower
isleadbyte
wcstombs
getenv
atoi
memchr
strlen
strncpy

shlwapi

AssocQueryKeyW
AssocQueryStringW

ws2_32

shutdown
WSAAddressToStringA
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSARecvFrom
WSASend
WSASendTo
WSAStringToAddressA
WSAWaitForMultipleEvents
accept
closesocket
connect
freeaddrinfo
getnameinfo
getpeername
getservbyname
getsockname
getsockopt
ioctlsocket
listen
send
socket
setsockopt

Sections

.text
Size: 136KB - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7623943f9e25814d79c7583f9ebc1216

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

msvcrt

shlwapi

ws2_32

Sections

.text Size: 136KB - Virtual size: 134KB

.rdata Size: 84KB - Virtual size: 83KB

.data Size: 60KB - Virtual size: 2.2MB

.rsrc Size: 80KB - Virtual size: 78KB

.text
Size: 136KB - Virtual size: 134KB

.rdata
Size: 84KB - Virtual size: 83KB

.data
Size: 60KB - Virtual size: 2.2MB

.rsrc
Size: 80KB - Virtual size: 78KB