General

Malware Config

Signatures

Files

• 5524511b34816ee595b195eebe2495bb_JaffaCakes118

  .exe windows:5 windows x86 arch:x86

  65c7f3c584f86005fcc52e67f4371b32

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  herklLEGHKWR#;3kl.pdb

  Imports

  oleaut32

  GetActiveObject

  VarBoolFromStr

  setupapi

  SetupDefaultQueueCallbackW

  SetupDiGetDeviceRegistryPropertyA

  advapi32

  LockServiceDatabase

  CryptSetProvParam

  QueryUsersOnEncryptedFile

  rpcrt4

  RpcNetworkIsProtseqValidA

  RpcStringFreeA

  iphlpapi

  CreateIpForwardEntry

  ws2_32

  recv

  user32

  DlgDirListComboBoxA

  RealGetWindowClassA

  GetDesktopWindow

  LookupIconIdFromDirectoryEx

  SubtractRect

  UnloadKeyboardLayout

  GetWindowThreadProcessId

  SendMessageA

  CreateWindowExW

  GetInputState

  kernel32

  FreeEnvironmentStringsW

  OpenFile

  DeleteTimerQueueTimer

  GetTimeZoneInformation

  SetFileAttributesA

  GetModuleHandleA

  IsBadWritePtr

  lstrcatW

  opengl32

  glEvalMesh2

  glGetString

  shell32

  ShellExecuteW

  gdi32

  GetTextFaceA

  wininet

  InternetSetOptionA

  msacm32

  acmStreamPrepareHeader

  winmm

  waveOutSetPitch

  crypt32

  CertCreateCertificateChainEngine

  CryptSIPRemoveProvider

  Sections

  .text

  Size: 129KB - Virtual size: 128KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 176KB - Virtual size: 180KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 145KB - Virtual size: 144KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 24KB - Virtual size: 23KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ